Privacy policy URL is set and accessible

A valid, publicly accessible privacy policy is a non-negotiable prerequisite for App Store and Google Play submission — both platforms validate the URL during review and reject the binary if the link is broken or the policy is a placeholder. Under GDPR Art. 13, users must be informed of data processing purposes before data is collected; a missing policy means every install is processing personal data without the legally required disclosure. Under CCPA §1798.100, California users have a right to disclosure that cannot be honored without a policy in place. A privacy policy URL that resolves to a 404 or https://example.com/privacy placeholder causes immediate submission rejection and, if discovered post-publication, risks app removal and regulatory scrutiny.

Host a real privacy policy at a public HTTPS URL, then reference it in app.json. The policy must cover every permission and data collection your app performs — a generic template that doesn't mention your actual permissions will be flagged in manual review.

// app.json
{
  "expo": {
    "privacy": "https://yourapp.com/privacy"
  }
}

Write the policy to cover: data collected (by permission type), storage location, third-party sharing, user deletion rights, and contact method. Free generators (Termly, iubenda, PrivacyPolicies.com) can scaffold a GDPR/CCPA-compatible policy in minutes. Verify the URL returns HTTP 200 before submitting — store review infrastructure makes a live HTTP check against the URL at submission time.