Privacy policy and support page, without a landing page

Runs on: your browser. No server needed.

Apple asks every app for two public web pages, even a free app with no accounts: a privacy policy and a support page. If you use box:new-landing-page, those pages come with it: you still need “Deleting the account: the wording” below. If you do not want a landing page, this guide gets you the two pages for free in about half an hour.

What Apple needs

Rules that people often miss:

• The URLs must be public and load without a login.
• The privacy policy must match your App Privacy answers in App Store Connect. If the app sends data to an AI provider or RevenueCat, the policy says so.
• A subscription paywall must also link to the privacy policy and the terms inside the app (App Review Guideline 3.1.2). Apple’s standard EULA (https://www.apple.com/legal/internet-services/itunes/dev/stdeula/) is fine as the terms if you have none of your own.
• The support page needs a way to reach you: an email address is enough.

Where to host the two pages

Pick one. All are free.

A page on your own domain looks most trustworthy to reviewers and users, but any stable public URL is accepted.

GitHub Pages in five steps

1. Create a public repository, for example myapp-pages.
2. Add two files: privacy.md and support.md (the checklists below).
3. In the repository’s settings, open Pages, choose Deploy from a branch, pick main and the root folder, and save.
4. Wait a minute. The pages are at https://<user>.github.io/myapp-pages/privacy and …/support.
5. Open both URLs in a private browser window to prove they are public.

What the privacy policy says

Use plain words, not legal-sounding ones. Cover each point in one or two sentences:

• Who you are and how to contact you (name or company, email).
• What the app collects: account data (Sign in with Apple gives a name and an email, which may be a private relay address), content the user creates, purchase status, crash or usage data if you collect any.
• Why: to run the features. Say “we do not sell your data” if true.
• Who else gets it (processors): your hosting, RevenueCat, an AI provider, an analytics or crash tool. Name each one.
• AI features: what is sent to the model provider, and that the user agreed to it in the app (see ai-consent.md).
• Where it is stored and how long.
• Deleting the account: where in the app, and what gets deleted. Apple requires in-app account deletion when the app has sign-up. Use the wording below.
• Children: say the app is not made for children under 13 (or your country’s age), unless it is.
• Changes: the date of this version, and that you will update the page.

If users are in the EU or the UK, also name the legal basis (usually “to provide the service you asked for”) and the right to see, correct and delete their data. This checklist is a starting point, not legal advice.

Deleting the account: the wording

An app with sign-up needs account deletion inside the app (App Review Guideline 5.1.1(v)). Say it in three places, in the same words: the Settings screen, the privacy policy and the support page. Copy these and fill in the <…> parts with what your app really does.

In the app, on the Settings screen (the button, and the line under it):

Delete account Delete your account and everything in it. This cannot be undone.

Ask once before you do it (“Delete your account and everything in it?”).

In the privacy policy:

Deleting your account. Open Settings in the app and tap Delete account. We delete your account and everything in it: <your list, for example your receipts, your settings and your sign-in tokens>. This happens at once. Backups that still hold a copy are deleted within <30> days. Deleting your account does not cancel a subscription. Cancel it in your Apple Account settings. If you cannot open the app, write to and we delete it for you.

On the support page, as one question:

How do I delete my account? Open Settings in the app and tap Delete account. Your account and everything in it are deleted. If you cannot open the app, write to .

Make each <…> true:

• The list is what the delete code really removes. Read the code, and include every table and file that holds the user’s data (also AI consent records and push tokens).
• The backup time is your backup retention (box:box-setup, the backup timer), not a number you like.
• Sign in with Apple: if the app also revokes the user’s Apple token on deletion (sign-in-with-apple.md, step 6), you may add “We also disconnect the app from your Apple Account.” Say it only when the code does it.
• A subscription is not cancelled by deleting the account. Keep that sentence. Reviewers and users both look for it.

What the support page says

• The app’s name and one line about what it does.
• How to reach you: an email address, and how fast you usually answer.
• Answers to the two or three questions you will get most, for example “how do I restore my purchase” and “how do I delete my account”.
• A link to the privacy policy.

Where the values go

Check it works

• Both URLs open in a private browser window, on your phone, on mobile data.
• The privacy policy lists every service that App Privacy says receives data.
• The Settings screen, the privacy policy and the support page describe account deletion in the same words. Delete a test account and check that the list in the policy is true.
• ship-ios:app-store-ready reports privacy-deletion and support-deletion as OK. It reads the pages from your site folder, or from app.privacyUrl and app.supportUrl in .onebox.json.

Common errors

• “The support URL does not lead to support information.” A bare home page or a 404. Put a contact email on the page itself.
• Rejected under 5.1.1 for a missing privacy policy. The link in the app’s settings or paywall is missing, even though App Store Connect has one.
• GitHub Pages shows a 404. Pages is not enabled, or the repository is private on a free account.

Wrong or out of date? Fix it on GitHub.