App Store support URL and privacy policy: what Apple requires
Updated 21 October 2026
Every app you submit to the App Store needs a few public web pages before it can go to review. They are easy to forget until App Store Connect refuses to save without them, usually the night before you submit.
This guide covers what each URL is for, what Apple expects the page to say, and how to avoid the rejections that come from thin or missing pages.
The URLs App Store Connect asks for
- Support URL: required for every app, on the version page. It must lead to a way to contact you.
- Privacy Policy URL: required for every app, on the App Privacy page. The same policy must also be reachable inside the app.
- Marketing URL: optional. A landing page for the app.
- Terms of Use (EULA): required in practice for apps that sell auto-renewable subscriptions. You can use Apple’s standard EULA, but the listing and the purchase screen still need a link to it.
What the Support page needs
Guideline 1.5 asks that your app and its Support URL include an easy way to contact you. A page that only says “Thanks for using our app” is not enough.
- A real contact route: an email address or a contact form that works.
- A short FAQ for the questions people actually ask: restoring purchases, cancelling a subscription, syncing between devices.
- How to cancel a subscription. Apple handles billing, so point people to their Apple ID subscription settings.
- The app’s name and your name or company, so a reviewer can see the page belongs to the app.
What the Privacy Policy must cover
Guideline 5.1.1(i) sets out what the policy has to say. A generic policy copied from another site usually misses at least one of these, and a mismatch with your App Privacy label is a common reason for rejection.
- What data the app collects, and how it collects it.
- Every use of that data.
- Which third parties receive it (analytics, crash reporting, payments, AI providers), and that they protect it to the same standard.
- How long you keep data, and how someone can ask for it to be deleted.
- How someone can withdraw consent.
Rejections these pages cause
- 1.5: the Support URL has no way to contact you, or does not load.
- 5.1.1(i): the privacy policy link is missing, broken, or not reachable inside the app.
- 3.1.2: a subscription app has no Terms of Use link in the listing or on the paywall.
- Mismatch: the policy says you collect nothing, but the App Privacy label (or an SDK) says otherwise.
A quick way to get all three
Host three plain pages on one domain: a landing page, /support and /privacy. Static HTML on a free host is fine; App Review checks that the pages load and say the right things, not how they are built.
Launchpad ships exactly that: a launch page plus Support and Privacy Policy pages written for App Store Connect, in light and dark mode, ready to edit in any text editor.
Questions
- Can my Support URL be a mailto link?
- App Store Connect expects a web URL. Use a page that shows your email address or a contact form.
- Does a free app with no accounts still need a privacy policy?
- Yes. Every app needs a Privacy Policy URL, even one that collects no data. In that case the policy says so plainly.
- Can the support and privacy pages be on the same site as my landing page?
- Yes. One domain with /support and /privacy pages is the usual setup.