Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageWhat Google requires from the privacy policy
Google's User Data policy requires a privacy policy for every app, including apps that do not access any personal or sensitive data. It must be linked in the privacy policy field on the App content page in Play Console, and it must be available inside the app, as a link or as text. The page behind the link has to meet a few formal conditions:
- It loads on an active, publicly accessible URL that is not restricted by country or region.
- It is a web page, not a PDF, and visitors cannot edit it.
- It is clearly labeled as a privacy policy, for example in the page title.
- It names the app or the developer shown on your store listing and gives a privacy contact or a way to send privacy questions.
- It explains which personal and sensitive data the app accesses, collects, uses and shares, with which parties, how it is protected, and how long it is kept and how it is deleted.
The content must also agree with your Data safety answers without being limited to them. The privacy policy guide for web-wrapped apps covers what to write; this page is about getting the link accepted.
How the rejection usually reads
The notice typically says Invalid Privacy Policy or that a privacy policy is missing, refers to the User Data policy and adds one specific reason. Typical reasons are: the link is broken or does not load; the page is not a privacy policy (for example your home page or your terms of service); the policy does not name your app or developer; it leaves out data the app is known to handle; or the reviewer could not find the policy inside the app.
Read the reason carefully. Each one has a different fix, and resubmitting the same URL after changing something unrelated only costs you another review round.
Why the reviewer could not open your policy
| Problem | Typical cause in a vibe-coded app | Fix |
|---|---|---|
| 404 when opened directly | The /privacy route exists only inside your single-page app. Clicking it in the app works, but a direct visit returns the host's 404 page because the server has no fallback to index.html. | Add a rewrite rule for client-side routes at your host, or publish the policy as a static privacy.html file. |
| Redirect to the login screen | The router guards every route, so the policy page sends visitors to /login. | Make the policy route public. Do the same for your terms and the account deletion page. |
| Preview or staging URL | The link points to a builder preview, a password-protected preview deployment or a development URL that goes to sleep. | Use your production custom domain and keep the path stable. |
| Blocked by region or bot protection | Country blocking, a firewall rule against data-center traffic, or an aggressive challenge page in front of the whole site. | Exclude the policy URL from geo rules and challenges, then test it through a VPN from another country. |
| PDF or editable document | A PDF exported from a policy generator, or a shared Google Doc that anyone can edit or that asks for access. | Publish the text as a normal web page. A public, view-only page on a site builder is fine; an editable document is not. |
| Wrong or missing name | The policy names the builder or a template company, or still contains "[Company Name]". | Name the app and the developer exactly as on the store listing and add a contact email. |
| Text hidden behind a consent wall | A cookie or consent overlay covers the whole page until the visitor accepts. | Let the policy page show readable text before consent, or exclude it from the overlay. |
I am very happy I bought this app! Extremely easy and great documentation. Was in contact with the customer service, they replied very quickly and very friendly. They solved my question within a day. 10/10 would recommend.
Check the URL from outside your browser
Run these from any terminal. The first command must end in a 200 status without a redirect to a login page. The second shows whether the policy text is in the HTML itself; a policy that only appears after JavaScript runs usually works in a browser, but static text removes one more way for a check to see an empty page.
bash
# 1. Status code and redirects (the last line should be HTTP/2 200)
curl -sIL https://www.example.com/privacy | grep -iE "^(HTTP|location)"
# 2. Is the policy text in the HTML, not only rendered by JavaScript? (should print a number above 0)
curl -sL https://www.example.com/privacy | grep -ic "privacy policy"
# 3. Same status check with a mobile browser user agent
curl -sIL -A "Mozilla/5.0 (Linux; Android 15) AppleWebKit/537.36 Chrome Mobile Safari/537.36" https://www.example.com/privacy | grep -iE "^HTTP"The in-app link: where reviewers look for it
The second half of the requirement is the one web-wrapped apps miss most. On your website, the privacy link sits in the footer. In the app you probably hid that footer to get an app-like layout, and the link disappeared with it. Reviewers look in the obvious places: the settings or profile screen, the menu, and the sign-up and login screens.
- In your web app: add a "Privacy policy" entry to the settings or account screen and a small link under the sign-up form. If you hide the footer only inside the app, for example with the custom CSS file or a custom
USER_AGENT, move the link somewhere that stays visible. - In the native shell: WebViewGold for Android has an optional native navigation drawer, switched on with
ENABLE_NAVIGATION_DRAWER. Its entries come fromres/menu/menu_drawer.xmland each one loads its URL in the WebView, so a "Privacy policy" row is a small addition; see the navigation drawer docs. - Policy on another domain: if a policy service hosts the page,
EXTERNAL_LINK_HANDLING_OPTIONSin Config.java decides whether it opens in the app, in an in-app tab or in the browser. Any of these is acceptable, as long as it opens.
Fix it and resubmit
Usually one evening, and most of it happens in your web app.
Publish the policy at a stable public URL
Use a path on your own domain such as /privacy, reachable without login, without accepting cookies and without a challenge page, and give the page the title "Privacy Policy".
Name the app and the developer
State the app name and the developer or company name exactly as they appear on the store listing, plus an email or postal contact for privacy requests.
Cover what the app adds to the website
A wrapped app often handles data the website does not: push tokens from OneSignal or Firebase, crash reports, the advertising ID if you show AdMob ads, camera or location if your web app requests them. Mention each one and keep it consistent with your Data safety answers. WebViewGold also provides an optional app disclosure paragraph that explains the app displays your website in a WebView.
Add the in-app link
Settings or account screen, the sign-up screen, and optionally the native drawer. Check it in the installed build, not only in the browser.
Update Play Console
Paste the exact URL into App content, Privacy policy. If you changed Data safety answers, save those too.
Resubmit or reply
Send the changes for review. If the policy was reachable all along and you can show it, reply or appeal from the Policy status page instead; the template below helps, and the appeal guide explains the process.
Reply template: what you checked and changed
Be specific. A reply that lists the URL, where the link sits in the app and what you changed is answered faster than a protest.
Paste into the appeal or reply form and adapt
Hello Google Play team, Thank you for reviewing [app name] ([package name]), version code [number]. The notice says our privacy policy is invalid because [quote the reason from the notice]. We have checked and addressed this: - Privacy policy URL: [https://www.example.com/privacy]. It is a public web page, requires no login, is not a PDF and has no regional restrictions. We tested it from [countries] on [date]. - The page is titled "Privacy Policy" and names the app [app name] and the developer [developer name as on the listing], with the contact [email]. - It covers the data the app handles: [account data, push token, crash reports, ...], consistent with our Data safety answers. - Inside the app, the policy is linked from [Settings > Privacy policy] and from the sign-up screen. To reach it: [steps]. [If you changed something: Since the review, we have (describe the change).] Please let us know if a specific part of the policy still does not meet the requirements. Kind regards, [name], [developer account name]
Frequently asked questions
Does my app need a privacy policy if it collects no data?
Yes. Google requires a privacy policy for every app, including apps that do not access any personal or sensitive data. The policy can be short in that case, but it must exist and say so.
Can I host the privacy policy on Notion, Google Sites or a policy generator?
Generally yes, if the page is public, loads without login, cannot be edited by visitors, is not a PDF and names your app or developer. A shared Google Doc that anyone can edit, or that asks for access, does not meet that bar.
Is my website privacy policy enough for the app?
It can be the same page, as long as it also covers what the app adds: push tokens, crash reports, the advertising ID and any device permissions your web app uses.
May the in-app privacy link open in the external browser?
Yes. The requirement is that users can reach the policy from within the app. Opening it in the WebView, in an in-app tab or in Chrome is acceptable.
Does the privacy policy have to mention WebViewGold?
No. WebViewGold offers an optional disclosure paragraph for transparency, but Google asks for a description of your data practices, not of the technology the app is built with.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.