What the store reviewer checks
These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.
The policy link opens a public page
The link in Play Console must open an active, public web page: not geofenced, not a PDF and not editable. The page must be labelled as a privacy policy, and the app must also link to it or show its text.
The policy names your app or developer
The developer or company in your store listing, or the app name, must appear in the policy. It also needs a privacy contact, the data you collect and share, who receives it, how you protect it, and your retention and deletion rules.
An in-app disclosure where the rules need one
When the rules require a prominent disclosure, it must be inside the app, shown in normal use and not only in a menu. The user must accept it with an action, such as a tap. A policy link alone is not enough.
What to account for
A reachable policy URL
Play requires a public, non-geofenced, non-PDF policy, linked in Play Console and available in-app. Identify the app or listed developer, contact, data uses, recipients, security, retention and deletion.
A separate Data safety review
Review collection and sharing across your app, including third-party SDKs. The Data safety answers are separate from the policy and must stay accurate as behavior changes.
Account deletion that works
If users can create an account in-app, provide deletion initiation in the app and on the web. Explain justified retained data; disabling an account is not deletion.
Common mistakes to check
The policy is not the permission prompt
Unexpected sensitive-data access can require a prominent in-app disclosure and affirmative consent before collection. A policy link alone does not meet that requirement.
Only reviewing first-party code
An SDK can change the answers even when your own code does not collect that data. Check its actual configuration and disclosures.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Inventory before drafting
List the app name, developer, login fields, permissions, SDKs, backend processors and support contact. Assign an owner to each unknown.
Add facts the scan cannot see
Scan the public website, then answer the questionnaire about native collection, purposes, retention and deletion. Confirm vendor suggestions before using them.
Reconcile and test
Compare the draft, SDK inventory and console answers side by side. Open the final policy and deletion URLs while signed out; test the actual deletion journey.
Example
Fictional app: Harbor Notes
Assume an email account, cloud note storage and a crash SDK, with no advertising. The website scan finds the support form; the owner adds the native crash SDK and storage provider as confirmed facts.
The review handoff
Draft the purpose for each data type, confirm a real retention period, and test account deletion. A reviewer compares these facts with the Play submission.
Questions before publishing
Do apps with no sensitive data need a policy?
Yes. Google explicitly requires a privacy policy even for apps that do not access personal and sensitive user data.
Can I just freeze the account?
No. Temporary suspension is not account deletion. Review the permitted retention exceptions and disclose what remains and why.
How do I prepare to submit?
Review your draft alongside native app behavior, console answers and the required disclosures. Then test the links and user flows in your final build.
Source review and changes
Review checks added: the public policy link, what the policy must name and the in-app disclosure. Sources reviewed on the date above.