Do I need a published privacy policy before Google Play will let my app move from testing to production?

Do I need a published privacy policy before Google Play will let my app move from testing to production

Yes. Google Play requires every app to have a privacy policy, and the policy must be publicly accessible, linked in Play Console, and reachable from inside the app. If your app collects no user data, Google Play still requires a privacy policy.

The part people get wrong is thinking the Data safety form replaces the privacy policy. It does not. Google Play treats them as separate requirements. The Data safety form explains what you collect in Play Console, while the privacy policy explains the same handling in a formal public policy that users can read before and after install.

For apps that access, collect, use, or share personal and sensitive user data, Google Play says you must post a complete privacy policy in Play Console and within the app itself. The policy has to disclose the types of data involved, who it is shared with, how it is handled securely, and the developer’s retention and deletion rules. Google Play also requires the listed developer or app name to appear in that policy.

For production access, the testing rules are a separate gate. Google Play’s closed testing requirement for newer personal developer accounts requires 12 opted-in testers for 14 continuous days before you can apply for production access. That is not a privacy policy rule, but the same release path still expects the privacy policy to be in place.

The inconvenient part is that a policy URL is not enough if the page is not usable. Google Play says the policy must be on an active, publicly accessible, non-geofenced URL, and it must not be a PDF. If the page is hidden behind login, blocked by region, or not actually reachable, review can fail even when the text itself is fine.

A practical setup is simple: publish the policy on your own site, make it readable without sign-in, link it in Play Console, and add the same link inside the app. Then check that the app store listing name matches the name in the policy. That avoids the common mismatch where the listing uses one entity name and the policy names another.

If your app uses account creation, Google Play also expects a clear account deletion path. That is not a substitute for the privacy policy, it is another requirement that often appears in the same review. If you collect nothing, keep the policy short but real, and state that no personal or sensitive user data is collected or shared.

A good way to think about it is this: testing gets you to the production review door, but the privacy policy is part of the room you are trying to enter. Google Play can ask for both the policy and the Data safety form, and production access does not remove the privacy-policy requirement.

If you want a reference page for the release workflow, DevConnect keeps a simple testing tracker at https://devconnectplatform.com. That does not replace Google Play’s own requirements, but it can help you keep the closed test organized while you prepare the release paperwork.

What to do before you apply for production access:

1. Publish a privacy policy on a public web page.
2. Make sure the page is accessible without login and not geofenced.
3. Link the policy in Play Console.
4. Add the policy link or text inside the app.
5. Complete the Data safety form.
6. Confirm the app name or developer name in the policy matches the store listing.
7. If you use account creation, add account deletion.
8. If you are on the closed-testing path, verify your tester count and 14-day requirement before applying.

If the policy is missing, unpublished, or inaccessible, review can stop there. If the policy exists but the app listing, Data safety form, or in-app link does not match it, review can still stop there. The fastest path is to treat privacy policy work as part of release setup, not as something you finish after the app is ready.