The two web pages Play Console asks for, what they need to contain and the most common mistakes.
When you add an app to Play Console, you are asked for two links: a privacy policy and, if your app lets users create an account, an account deletion page. Both must be at a public web address that doesn’t require signing in. Rather than a PDF or a Google Drive link, a plain page on your own domain is the least troublesome option.
The Falla AI, HOPIX and Takipsly pages on this site were prepared for exactly this. Here is a summary of what I learned along the way.
What should a privacy policy contain?
- The app and developer name. It should match the developer name in Play Console.
- The data you collect. Email, photos, device information, advertising ID and so on. State clearly which stays on the device and which goes to a server.
- Third-party services. Firebase, AdMob, Play Billing, AI APIs and similar. If data such as the user’s photo goes to an AI service, say so explicitly.
- Retention and deletion. How long is data kept, and how can the user have it deleted?
- Children. If the app is not aimed at children, say so; if it is, the Families policy asks for much more.
- A contact address. An email address that works and gets answered.
The most common mistake: inconsistency
Play can compare your privacy policy with your Data safety form declarations and with how the app actually behaves. Policies copied from ready-made templates are full of contradictions like these:
- “We don’t collect personal data” in one paragraph and “we store your email address” in another.
- “Data is stored on our servers” and “no data is ever sent to a server” in the same text.
- Describing a feature the app doesn’t have, such as “an option to turn off ads”.
After writing the policy, go through your app’s code and every SDK you use one by one: does each of them really behave the way the text says?
The account deletion page
If users can create an account in your app, Play asks for two things:
- A way to delete from inside the app. A “Delete my account” option that is easy to find in settings or the profile menu.
- A way to request it on the web. A page where even a user who has already uninstalled the app can have their account deleted. This link goes into the Data safety form.
On the web page, include:
- The steps for deleting from inside the app.
- How to request deletion on the web. A plain email address is enough; specifying a subject line in advance makes your life easier.
- Which data is deleted, and which is kept, and for how long, because of legal obligations.
- How long it takes to process a request.
You can look at the Falla AI account deletion page (in Turkish) as an example.
Pick the address once and don’t change it
Once these links are saved in Play Console, their addresses must stay the same. When you rebuild your site, change hosting or move away from WordPress, make sure these pages keep opening at the same address. A broken privacy policy link is reason enough for your app to be rejected in review.