Skip to content
AppFoyer
Start free

Guides

Generator, hosted page, or a lawyer: which one you actually need

Three categories of answer to 'I need a privacy policy', what each one hands you, which part of the problem each leaves behind, and how to tell which one your situation is.

A generator produces text and leaves you to host it. A hosted page gives you the URL and a working deletion route but makes you depend on someone else's hostname. A lawyer covers what neither template can. Most apps with accounts need the second; unusual data handling needs the third.

Checked 19 September 2026. Store policies change, sometimes without notice. Everything below links to the official documentation, and that page — not this one — is the authority. If the two disagree, the store is right.

“I need a privacy policy” is usually two problems wearing one coat: producing the text, and publishing it at a URL that still works in two years. Most tools solve one of them well and leave you holding the other, which is why developers end up using two and paying twice.

This page compares the three categories rather than naming products. Anything we ranked would be a sales pitch with a table in front of it, and the useful distinction is structural, not competitive.

Category 1 — a generator

You answer a questionnaire; you get text.

What it solves: the blank page. A decent generator knows which clauses are conventional for a mobile app and will produce something more complete than most developers write unaided.

What it leaves you: hosting. You still need a public URL, and if your app has accounts you still need somewhere a user can actually submit a deletion request — which text cannot do. You also inherit whatever the questionnaire did not ask about: if it never asked which SDKs you ship, the output names none of them, and that section is the one compared against your Data safety form.

Worth checking before you pay: what happens to the URL when you stop. Some generators host the result and take it down with the subscription. A privacy URL that goes dark while it is printed in a live store listing is a problem you hear about from the store, not from the vendor.

Category 2 — a hosted compliance page

You get the pages and a URL, on a subdomain, usually with the account-deletion route working.

What it solves: publishing, and the receiving problem — the thing static hosting structurally cannot do.

What it leaves you: the text is still a template you have to complete honestly, and you are depending on somebody else’s hostname being resolvable for as long as your app is listed. That dependency is the real question to interrogate, ours included: what happens to the URL when you stop paying, and what happens if the company disappears.

Worth checking before you paste the URL anywhere: whether the account-deletion page survives non-payment, whether you can export the content, and whether there is a written commitment about shutdown rather than a reassuring sentence in a chat window.

Category 3 — a lawyer

You describe your business; you get a policy written for it.

What it solves: the thing neither of the others can. A template cannot know that you process health data, operate in a regulated sector, ship to children, or have a data-sharing arrangement with a partner.

What it leaves you: hosting again, and a cost that is hard to justify for a free utility app with no accounts.

When it is not optional: if you would hesitate to explain your data handling in one sentence, you are in this category, and a generator’s output will read as confidently wrong rather than usefully incomplete.

How to tell which one you are

  • No accounts, no ads, no analytics, no backend. A short honest policy on any public URL. Do not overbuy — a generated page listing advertising identifiers for an app with no ads is itself a mismatch with your Data safety form.
  • Accounts, ordinary SDKs, no unusual data. This is most apps. You need a complete policy and a working account-deletion route, which is what makes hosting the deciding factor rather than the text.
  • Health, finance, children, or anything you would explain carefully. A lawyer, hosted wherever you like.

The question to ask any of them

Not “is this policy good”, which you cannot evaluate, but: does the output match my app? The stores compare your policy against your Data safety declarations and against what the app does, and Google Play is explicit that the declaration has to cover data handled by third-party SDKs. So the test is mechanical — open your dependency file, and check every SDK in it appears in the policy you just produced. Whatever failed that test produced generic text, whatever it cost.

What AppFoyer does here

We are the second category, and we try to be honest about the dependency that implies. We draft the pages from the SDKs found in your build files — a coding agent reads the repository, or you fill in a short form — and host all five on your app’s own subdomain, with an account-deletion page that receives the request and notifies you.

The commitments, since this page says to ask for them: the account-deletion page stays online even if you stop paying; you can export every page’s Markdown, your app-ads.txt and your settings at any time; and our Terms commit to at least twelve months’ notice with the pages kept serving if the service is ever discontinued. One app is free, with no card.

What we are not is the third category. The templates are a starting point and every generated page says so; they are not legal advice, and you are responsible for their accuracy.

The authoritative sources

Do this in a few minutes instead

AppFoyer hosts the pages this guide is about — privacy policy, terms, support, account deletion and app-ads.txt — on their own subdomain, with no domain or server of your own. One app is free, and nothing a store requires is ever behind a paywall.

Start free See a live example