A valid, publicly accessible privacy policy is a non-negotiable prerequisite for App Store and Google Play submission — both platforms validate the URL during review and reject the binary if the link is broken or the policy is a placeholder. Under GDPR Art. 13, users must be informed of data processing purposes before data is collected; a missing policy means every install is processing personal data without the legally required disclosure. Under CCPA §1798.100, California users have a right to disclosure that cannot be honored without a policy in place. A privacy policy URL that resolves to a 404 or https://example.com/privacy placeholder causes immediate submission rejection and, if discovered post-publication, risks app removal and regulatory scrutiny.
Critical because both stores reject submissions without a valid, reachable privacy policy URL, and a missing policy violates GDPR Art. 13 disclosure requirements from the first install.
Host a real privacy policy at a public HTTPS URL, then reference it in app.json. The policy must cover every permission and data collection your app performs — a generic template that doesn't mention your actual permissions will be flagged in manual review.
// app.json
{
"expo": {
"privacy": "https://yourapp.com/privacy"
}
}
Write the policy to cover: data collected (by permission type), storage location, third-party sharing, user deletion rights, and contact method. Free generators (Termly, iubenda, PrivacyPolicies.com) can scaffold a GDPR/CCPA-compatible policy in minutes. Verify the URL returns HTTP 200 before submitting — store review infrastructure makes a live HTTP check against the URL at submission time.
mobile-store-readiness.store-compliance.privacy-policy-configuredcriticalapp.json for privacy field or check iOS Info.plist for NSPrivacyAccessedAPITypes and privacy-related URLs. Count all privacy policy URL references found across config files. Check android/app/src/main/AndroidManifest.xml or app config for privacy policy URL reference. The URL should point to a public, accessible privacy policy (e.g., https://example.com/privacy). Verify the URL is valid and the policy is readable.app.json or Info.plist. The URL must be publicly accessible and the privacy policy must cover the app's data practices.https://example.com/privacy is used — the URL must point to an actual, reachable privacy policy."No privacy policy URL found in app.json or Info.plist" or "Privacy policy URL points to 404: https://example.com/privacy-policy""privacy": "https://yoursite.com/privacy"
"ios": {
"infoPlist": {
"NSUserTrackingUsageDescription": "...",
"NSPrivacyTracking": false
}
}