Privacy policy URL required; a support URL that resolves
Every app needs a privacy policy URL in App Store Connect. There is no exemption for apps that collect nothing. A support URL is not listed as required, but App Review routinely rejects apps whose support URL is missing or dead, so both need to resolve publicly.
Why it matters
The privacy policy URL is one of the properties App Store Connect lists as required, alongside name, age rating, bundle ID and price. The common belief that an app collecting no data does not need one is wrong.
The URL has to be publicly reachable: not behind a login, not on a staging domain, not a page that has since moved. A reviewer opens it.
The support URL is the softer case and it is graded as a risk rather than a blocker for exactly that reason, because Apple does not list it as required while reviewers do reject on it.
Both fields are editable after submission, which sounds reassuring and is the reason they rot. A URL entered for the first version is still there three site redesigns later, pointing at a path that now returns a 404.
If you sell subscriptions, the same two URLs have a second obligation: Guideline 3.1.2 requires the subscription screen itself to link to your terms of use and your privacy policy, so a dead link fails in two places at once.
How to fix it
- Publish a privacy policy at a stable public URL and put it in App Store Connect, and on your subscription screen if you sell subscriptions.
- Publish a support page with a way to contact you, and check it loads in a private browser window with no session.
- Check both again right before submitting. These break quietly when a site is rebuilt.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Support and privacy policy URLs. A privacy policy URL is required for every app; a dead support URL invites rejection.
- Asks whether both URLs resolve publicly, and records your answer as the evidence.
- Does not fetch them: ReviewAhead contacts no URL it is given, including yours.
- Grades the privacy policy as a blocker and the support URL as a risk, matching what Apple lists as required rather than flattening the two.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.