1. Every app that collects personal or sensitive user data must provide a privacy policy that is reachable from the Play Console Data Safety form (shown on the store listing) and accessible inside the app itself.
2. The policy must disclose exactly what data is collected, why it is collected, who it is shared with (including third-party SDKs and AI providers), and how long it is retained.
3. It must describe how data is secured (encryption in transit and at rest, access controls) and give users a clear way to request access, correction, and deletion of their data.
4. The policy must not contradict your Data Safety form answers - mismatches between the two are a leading cause of rejection and enforcement, because Google cross-checks declared collection against actual SDK behavior.
5. If your app lets users create accounts, the policy must explain how to delete the account and its data, matching the in-app path and web resource required by the Account Deletion policy.
6. Update the policy whenever your app changes (new SDK, new data types, AI integrations, new markets) and keep the link valid - a broken privacy policy link is treated as non-compliance.
7. Google refreshed its privacy-policy guidance in July 2026 (Play Academy Privacy Policy best practices video) - use it as the checklist when drafting or reviewing your policy.