How to add a Privacy Policy URL to an app built with Lovable, Bolt, Replit or v0

By Paul Cranmer, Founder · Last verified October 2026 · AI app builders · Lovable, Bolt.new, Replit, v0

You prompted an app into existence and it works. The first wall is not code: sign-in with Google wants a privacy policy URL on your domain before it verifies the consent screen, Stripe wants your legal pages when you activate payments, and every store or ad platform has a field for the link. The generated /privacy page is usually a placeholder. This page gives the order of operations and keeps the builder doing the typing.

Who this is for

Founders shipping a Lovable, Bolt, Replit or v0 app to real users
Anyone blocked on Google OAuth consent screen verification
Builders who want the agent to create the policy, not a lawyer

Not for

Native mobile apps (use the free Mobile App path and the Play / App Store how-tos)
Internal tools that never collect data from outside users

What the platform requires

Google OAuth consent screen: a privacy policy URL and a homepage, both on a domain you have verified, before Google verifies the app for sign-in with Google.
Stripe: a business website reachable by Stripe during activation, with terms and a privacy policy linked from it.
App stores, Meta login and ad platforms: a privacy policy URL field that must open publicly over HTTPS, with no login, and not as a PDF.
The policy must name what the app actually uses: the auth provider, the database, payments, email and analytics the builder wired in.

Get a live URL first

A generated web app is a SaaS product, so it is on the hosted plan. Answer the wizard with the app's name, the services it uses (Supabase, Firebase, Stripe, Google sign-in, analytics) and a contact, and you get a stable HTTPS URL to paste into every field. If the app is only an API, pick API/SDK and it is free.

Get the app's policy URL

Step-by-step: paste your privacy policy URL

Create the hosted privacy policy URL. Run the wizard as SaaS/Web App. Name the app, tick the services the builder connected (auth, database, payments, analytics), add a contact. Copy the live URL.
Tell the builder to link it. Prompt your builder: add a footer link labelled Privacy Policy pointing at the hosted URL, and remove the placeholder /privacy page. One sentence; it will do it.
Paste it into the Google OAuth consent screen. In Google Cloud Console, open the consent screen, fill Application home page and Privacy policy link with pages on your verified domain (the footer link satisfies the homepage requirement), then submit for verification.
Paste it where payments and stores ask. Stripe activation: your business website with the footer link. App stores, Meta login and ad platforms: the privacy policy URL field directly.
Keep the URL stable while you regenerate. Builders rewrite pages freely. The hosted URL lives outside the app, so regenerations never break the link that Google, Stripe or a store already approved. Edit the policy text when you add services.
Or let the agent do all of it. Our MCP server exposes create_privacy_policy_url. An agent inside the builder, or any MCP client, can create the URL and paste it into the footer in one go.

Field labels to look for

Google Cloud Console → OAuth consent screen: Application home page, Privacy policy link, Authorized domains. Verification checks that the links live on an authorized domain.
Builder prompt: "Add a footer link to https://<your hosted url> labelled Privacy Policy and remove the /privacy placeholder page."
Stripe activation: Business website field; Stripe reviews the site for legal pages and a description of what you sell.

Common reasons the form fails

Submitting the placeholder /privacy page with lorem ipsum
Privacy policy link on a different domain from the Google-authorized one
A policy that never names Supabase, Firebase, Stripe or the analytics the app runs
Regenerating the app and losing the footer link

Google wants your domain

The hosted URL is on privacypolicyurl.com, not your domain. Google's consent screen wants the policy link on an authorized domain, so link the hosted policy from your app's own /privacy route (a one-line redirect or an embed) and submit that route; the content stays maintained here.

Get the app's policy URL Learn more

FAQ

Does Lovable, Bolt, Replit or v0 require a privacy policy?

No. The requirement comes from what the app connects to: Google sign-in verification, Stripe activation, app stores and ad platforms. Any app with users will hit at least one of them.

Can the policy live on privacypolicyurl.com if Google wants my domain?

Yes. Keep the content hosted here and point your app's own /privacy route at it; submit your route to Google. The content stays maintained without touching the app.

Is this free?

Web apps are on the hosted plan. If what you built is only an API or a mobile app, pick that type and the URL is free.