PeerPlay
A lot of solo developers find out about the privacy policy requirement at the worst moment: the app is built, the closed test is about to start, and Play Console shows a red mark next to App content. "My app doesn't collect anything" feels like a good reason to skip it. It usually isn't.
Here's what Google Play asks for, what a small app's policy actually needs to say, and the hosting mistakes that cause trouble in review. This isn't legal advice, and Google's policy pages change, so check the current Play Console Help article before you publish.
Does a small app really need one?
In practice, yes. Play Console asks for a privacy policy URL under App content for apps on Google Play, and you'll find it hard to get through review without one. Apps aimed at children and apps that handle personal or sensitive data have stricter rules on top.
Also, your app probably collects more than you think. If you use Firebase Analytics, Crashlytics, AdMob or almost any ad or analytics SDK, data such as device identifiers, crash logs and usage events leaves the phone. That counts, even if you never see it yourself. PeerPlay is a Flutter and Firebase app, and the analytics data Firebase collects was detailed enough that a Firebase analytics export is how I tracked down a real bug, which is a good reminder of how much these SDKs record.
What the policy should cover
Keep it short and specific to your app. A small app's policy can fit on one page if it answers these questions in plain language.
Who you are and how to contact you: your name or business name and an email address that works. What data the app collects, both what the user types in and what is collected automatically, including by third-party SDKs. Why you collect it, for example to run the app, fix crashes or show ads.
Who it's shared with: name the services involved, such as Firebase or your ad network, and link to their privacy policies. How long you keep data and how users can ask for it to be deleted. How you protect it, in general terms. And a date, so readers know which version they're looking at.
If your app truly collects nothing and uses no SDKs that do, say exactly that. A clear "this app does not collect or share personal data" is better than a generic template full of things you don't do.
Where to host it
The policy has to live at a public web address that anyone can open without signing in. Google's guidance says it should be an active, publicly accessible URL, not a PDF, and not something that can be edited by others. A page on your own website is the safest option. A free static page, such as GitHub Pages, works too.
Avoid links that change or break: a shared Google Doc can be edited and can lose its sharing settings, and a page on a free site builder can disappear when the trial ends. If the link goes dead after launch, your listing can get flagged later.
Put the same link in your store listing details and, for apps that handle personal data, inside the app as well, for example in a settings or about screen.
Make it match your Data safety form
Play Console also has a Data safety form where you declare what data your app collects and shares. Reviewers and users can compare the two, so they need to tell the same story. If the policy says you collect nothing but the Data safety form lists crash logs and device IDs, that mismatch is a reason for rejection.
The easiest way to get both right is to list your SDKs first. Most major SDK providers publish what their library collects for Data safety purposes. Use that list to fill in the form, then write the policy from the same list.
Before your closed test starts
Sort the privacy policy out before you invite testers, not after. App content items like this can hold up your release on the testing track too, and the 12 testers for 14 days that new personal accounts need are hard enough to organise without a paperwork delay in the middle.
Once the policy, Data safety form and store listing are done, you can focus on the testing itself. If you need real Android testers for that, PeerPlay lets developers test each other's apps in tracked 14-day rounds and checks that testers actually open your app, not just install it.
FAQ
Can I use a privacy policy generator?
You can use one as a starting point, but edit the result. Generators often add sections about data you don't collect, which can contradict your Data safety form. Remove what doesn't apply and add the specific SDKs and services your app actually uses.
Can my privacy policy be a Google Doc?
It's risky. Google's guidance asks for a public, active URL that others can't edit, and shared documents can be edited or lose their sharing settings. A simple page on your own website or a static hosting service is safer and looks more professional.
Does my app need a privacy policy if it has no login?
Usually yes. Google Play asks for a privacy policy URL in Play Console, and even apps without accounts often collect data through analytics, crash reporting or ad SDKs. If your app really collects nothing, the policy can be short and say exactly that.
Do I need to update the policy when I add an SDK?
Yes. Any new SDK that collects data, such as an ad network or analytics tool, changes what your app collects or shares. Update the policy and the Data safety form together, before or with the release that adds it.