How to handle the privacy policy for Sign in with Apple

By Paul Cranmer, Founder · Last verified October 2026 · App Store Connect · App Information, Guidelines 4.8 and 5.1.1

Adding Sign in with Apple changes what your app receives, often only a name and a relay email address, but it does not remove the privacy policy requirement. Guideline 5.1.1 still wants the policy linked in App Store Connect and inside the app, and the policy must describe the little you do receive. This page shows the two guidelines, the App Store Connect field, and what to write.

Who this is for

iOS and macOS developers adding Sign in with Apple next to Google, Facebook or other logins
Apps that received a 4.8 note in review
Anyone unsure what to say about Hide My Email relay addresses in a privacy policy

Not for

Web-only Sign in with Apple outside the App Store (the guidelines below are App Store review rules)
Apps that use only their own account system, which 4.8 exempts

What the platform requires

App Store Review Guideline 4.8 (Login Services): apps that use a third-party or social login service (such as Facebook Login, Google Sign-In, Log in with X, Sign In with LinkedIn, Login with Amazon or WeChat Login) to set up or authenticate the user's primary account must also offer an equivalent option that limits data collection to name and email, lets users keep their email private, and does not collect interactions with the app for advertising without consent.
Guideline 5.1.1(i): all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner; the policy must identify what data the app collects, how, and all uses; confirm third parties protect it equally; and explain retention, deletion and how a user revokes consent or requests deletion.
App Store Connect Help, App Information: the Privacy Policy URL property is a URL that links to your company's privacy policy, required for iOS and macOS apps.
Apple's Human Interface Guidelines: when people share a private relay address, avoid asking for a personal email address instead; minimize the data you request at account setup, say which extra fields are required and why, and be transparent about the data you collect, for example by showing the name or email the person shared.
Apple does not use Sign in with Apple to profile people or their activity in apps; the data your policy must describe is what your own service receives and stores.

Get a live URL first

Mobile apps are on the developer door: create a hosted privacy policy URL here, paste it into App Store Connect's Privacy Policy URL field, and link it from the app's settings or sign-in screen.

Get a hosted privacy policy URL

Step-by-step: paste your privacy policy URL

Check whether 4.8 applies. If your app's primary account can be created with Facebook, Google, X, LinkedIn, Amazon or WeChat login, 4.8 requires an equivalent privacy-preserving option. Sign in with Apple meets its three conditions. Apps using only their own account system are exempt.
Write what your service receives. With Sign in with Apple you may get a name and either a real email or a private relay address. Say exactly that: which of the two you store, that relay addresses forward through Apple, how long you keep them, and how a user deletes the account.
Do not ask around the relay address. Follow the HIG: do not ask for a personal email when a relay address was shared. If support needs an identifier, show the relay address in the app or use an order number.
Enter the Privacy Policy URL in App Store Connect. Open the app → App Information → Privacy Policy URL (required for iOS and macOS; tvOS apps paste the text into the Apple TV Privacy Policy field). Use a public HTTPS page, not a PDF.
Link it inside the app and keep it current. Put the same URL in settings or on the sign-in screen, as 5.1.1 requires. When you add a login provider or start storing more, update the policy before the build goes to review.

Field labels to look for

App Information → Privacy Policy URL: App Store Connect field, required for iOS and macOS apps.
Guideline 4.8: Why an equivalent login like Sign in with Apple is required next to social logins.
Private relay address: The Hide My Email address a user may share instead of their real email.

Common reasons the form fails

Treating Sign in with Apple as a reason to skip the privacy policy
Asking users for their real email after they chose a relay address
A policy that lists Facebook and Google data but never mentions what Apple sign-in sends
A policy URL that redirects to the homepage or needs a login

Exemptions in 4.8, none in 5.1.1

Guideline 4.8 lists exemptions: apps that exclusively use the company's own account system, education or enterprise apps that require an existing account, and apps that use a government or industry-backed citizen ID. The privacy policy requirement in 5.1.1 applies to every app regardless.

Get a hosted privacy policy URL

FAQ

Do I still need a privacy policy if I only use Sign in with Apple?

Yes. Guideline 5.1.1 requires every app to link a privacy policy in App Store Connect and in the app, whatever login it uses.

What should the policy say about Sign in with Apple?

That you may receive a name and either an email or a private relay address, what you store, how long, and how the user deletes the account. Apple does not profile users through the sign-in; describe only what your service receives.

When is Sign in with Apple required?

Guideline 4.8: when a third-party or social login sets up the user's primary account, an equivalent option with 4.8's three privacy features must be offered. Sign in with Apple is one such option.

Can I ask for the user's real email later?

Apple's HIG says to avoid asking for a personal email when a relay address was shared; show the relay address in the app or use another identifier.