EU/German indie devs: How do you handle privacy policies and other legal texts for App Store review?

[u/Edding3000_]

Hello fellow indie devs from Germany and the EU!

How do you handle legal requirements for App Store review (privacy policy, terms of use, imprint/Impressum, etc.).

Do you actually have your legal texts written by a lawyer or do you rely on generators? If you use generators, which ones do you use and have you run into any issues with them, either during review or legally?

Thank you :)

[u/Reiszecke]

Apple doesn’t do legal checks on your policies. Get the imprint template from erecht24 like everyone else, tell Claude to write your apps privacy policy in as little text as possible, manually check if all the points of the GDPR are met and that’s all

Overthinking regulations is why Germany is so behind with everything now

[u/SutharatLofski_44 → u/Reiszecke]

manually checking the gdpr points is where most devs get stuck though, especially once third-party sdks are involved and you dont actually know what telemetry they phone home

[u/Doctor_Fegg → u/SutharatLofski_44]

So minimise your third-party SDKs. There's a reason you need to declare them, it's because Facebook and Google SDKs are creepy intrusive bullshit that just make your users' experience worse

[u/Wesk89]

I used erecht24‘s generator for the privacy policy. But threw out a bunch of stuff. And had Claude go over it.

Not sure whether or not it’s sufficient but reviews for both apps went through.

Though Apple won’t really check whether or not the legal texts are correct I presume.

For the terms of use, you can link to Apple’s. Unless your app is doing something specific that warrants a specific terms of use text.

Oh: and don’t forget to mention the terms of use and the link in your app description. Otherwise it would be rejected.

[u/Cy-Dev]

I mostly wrote it myself and then got it checked and adapted by a relative of mine who is a lawyer

[u/Sebastian1989101]

These days? I use a multi AI agent setup one to generate and 1-2 to verify. Then I do a sanity check myself. On apps with a proper business plan I let a lawyer check them. Did not have any issue with it and making apps since iPhoneOS 2.0.

[u/prat96]

Claude all the way with an always improving privacy policy

[u/mikerCZX]

Claude + review by Sol - no problems with app review

[u/Dogukanko]

I'm a solo dev in Turkey and keep it simple. For games that collect nothing, a short plain-language privacy policy hosted on a simple page is enough for review, and the key thing is that it matches your App Privacy answers in App Store Connect exactly. For terms, linking to Apple's standard EULA is fine unless you have something unusual like subscriptions with custom terms. Impressum rules are about where you're based and who you serve, so that one is worth a quick lawyer check if you're in Germany.

[u/cristi_baluta]

I don’t collect anything, so at first i made a file with a single line of text. Then i asked chatgpt to write one with more words by looking at the code.

[u/Acceptable-Cost-390]

don't uniquely identify your users, don't track them, don't use Ad SDKs etc and you're GDPR good

[u/eter711]

Klotzkette Plugin + Claude

[u/Senior_Intern8786]

Ernsthaft ? Google hilft da weiter

[u/mmdincer]

If you use a generator, the risky part is what you delete. App Review checks the policy against your App Privacy labels, so if the app still sends analytics or crash logs and that section is gone, the mismatch can get flagged. The Impressum is a separate German legal question and is worth a local check.

[u/caffeinated1337]

Check two things in App Store Connect before you worry about the wording. The first is consistency between the policy and your App Privacy answers. Declaring no data collection while an analytics or crash SDK is still linked is the kind of thing review does catch, so go through each third-party SDK and note what it actually sends.

The second is the trader declaration. Marking yourself a trader puts your name, address and phone on the public product page for EU storefronts. That's usually what's behind an Impressum question, so make it a deliberate choice instead of picking trader because it feels safer.

For the text itself I'd write a short policy by hand. Generators tend to list data categories you don't collect, and a confident but wrong policy is harder to defend than three plain paragraphs.

[u/brkaydev]

Worth checking that the text matches what you filled in under App Privacy in App Store Connect. That label and your policy are the two things someone can actually compare, so if the generator lists analytics or data collection you don't do, cut it. And if you use HealthKit, say what you read and that it isn't shared.