Meet Apple App Store Privacy Policy Rules

## Mandatory Privacy Policy Elements

Your app needs a public privacy policy URL and an in-app privacy policy that clearly explains, in plain language:

- **What data you collect**: email, workout/activity data, precise GPS location, HealthKit data, purchase information, device identifiers/analytics data from Firebase, and any data collected via the Meta SDK.  
- **Why you collect it**: account creation, workout tracking, location-based features, syncing with Apple Health/HealthKit, analytics, ad delivery/measurement, fraud/security, and processing in-app purchases. Apple requires data collection/use transparency under **Guideline 5.1.1**.
- **Who you share it with**: identify third parties such as **Firebase/Google**, **Meta**, and any payment/hosting providers. Explain whether they act as service providers, analytics providers, or advertising partners. If data is used for advertising/tracking, disclose that clearly (**5.1.2**).
- **How long you keep data**: retention periods or the criteria used to determine them (for example, account data kept until deletion; analytics retained for X months).
- **User rights and controls**: how users can access, correct, delete, or export data; how they can withdraw permissions for location/HealthKit; and how to close accounts. Apple expects account deletion if account creation is supported (**5.1.1(v)**).
- **Children’s data / COPPA / age rules**: since users may be **13+**, avoid collecting from children under 13 unless you fully comply with COPPA and Apple kids rules. If the app is not intended for under-13 users, say so and block use where feasible. If you knowingly collect from teens, avoid sensitive profiling/behavioral ads.
- **Contact information**: provide an email or web contact for privacy questions.
- **Policy URL requirement**: Apple requires a privacy policy URL in **App Store Connect** and it must match actual app practices (**5.1.1**). Google Play also requires a policy URL for apps handling personal or sensitive data.

## App Store Connect Privacy Nutrition Label Requirements

In App Store Connect, you must accurately declare all data types collected by you and your SDKs, whether linked to the user, and whether used for tracking. For PulseFit, likely disclosures include:

- **Contact Info**: email  
- **Location**: precise location  
- **Health & Fitness**: HealthKit data, workout/activity data  
- **Purchases**: in-app purchase history  
- **Identifiers / Usage Data / Diagnostics**: Firebase and Meta SDK data, device/advertising identifiers if applicable  

Apple requires these disclosures to be complete and accurate under **5.1.1** and app submission rules. Google Play has a similar **Data safety** form, but categories and wording differ.

## Tracking & ATT (App Tracking Transparency) Disclosures

If the **Meta SDK** or any SDK uses data to track users across apps/websites for advertising or shares data with brokers/partners, you likely need **ATT permission** before tracking (**5.1.2(i)**).  
You must:

- Show the ATT prompt before tracking starts  
- Explain why tracking is requested  
- Not gate functionality on consent  

If Firebase is configured only for analytics and not cross-app tracking, ATT may not be required for Firebase alone.

## Common Rejection Reasons to Avoid

- Privacy policy is missing, vague, or inconsistent with actual SDK behavior (**5.1.1**)  
- Nutrition Label is incomplete or fails to include SDK-collected data  
- HealthKit data is used for advertising or disclosed improperly; Health data needs especially careful handling (**5.1.3**)  
- ATT not shown before Meta/ad tracking begins (**5.1.2**)  
- No account deletion option where account creation exists (**5.1.1(v)**)  
- Declared age range conflicts with ad/tracking practices for younger users

Of course. Here is a clear explanation of the privacy policy requirements for your PulseFit app, tailored for Apple App Store compliance.

### Mandatory Privacy Policy Elements

Your privacy policy must be a clear, publicly accessible document. Per Apple’s App Store Review Guideline 5.1.1, it must be linked within your app and in the App Store Connect metadata. The policy must clearly state:

*   **Data Collected:** Explicitly identify all data you collect. For PulseFit, this includes email, workout data (e.g., duration, type), precise GPS location, and health data via HealthKit (e.g., heart rate, steps).
*   **Purpose of Collection:** Explain *why* you collect each piece of data. For example, "GPS location is used to map your run," and

### Mandatory Privacy Policy Elements
Per Guideline 5.1.1(i), apps collecting user data must link a privacy policy in App Store Connect and within the app. It must clearly disclose:
- **Data collected**: Email (contact info), workout data & HealthKit (health/fitness), GPS location; list all categories (Guideline 5.1.1(i)).
- **Purpose**: E.g., account management, fitness tracking, personalized ads/analytics.
- **Third-party sharing**: Firebase Analytics (usage data), Meta SDK (ad targeting); specify recipients and purposes (Guideline 5.1.1(iii)).
- **Retention**: How long data is kept (e.g., until account deletion).
- **User rights**: Access, correction, deletion (align with GDPR/CCPA if applicable).
- **Children's data/COPPA**: Disclose no collection from under 13; for 13+ users, get verifiable parental consent if features target kids (Guideline 5.1.2(i)). Google Play requires similar in Data safety form.
- **Contact info**: Provide support email/company details.
- **Policy URL requirement**: Publicly accessible URL in App Store listing and app settings.

### App Store Connect Privacy Nutrition Label Requirements
Complete the label (Guideline 5.1.1(ii)) categorizing data:
- Linked to user: Email, Health/Fitness (workout/HealthKit), Location (GPS).
- Not linked: Diagnostics (Firebase).
- Third-party: Analytics (Firebase), Advertising (Meta), Purchases (IAP).
- HealthKit data requires explicit permission prompts (Guideline 5.1.4). Google Play's Data safety mirrors this.

### Tracking & ATT (App Tracking Transparency) Disclosures
If Meta SDK tracks across apps/devices (e.g., ad ID), implement ATT prompt before tracking (Guideline 5.1.3). Disclose in policy/nutrition label: "Track[ing] across apps/websites." Firebase Analytics may not require ATT if non-identifiable. Google Play mandates similar Limited Use disclosure for ads.

### Common Rejection Reasons to Avoid
- Vague/missing disclosures (5.1.1(iv)).
- Unlinked or inaccurate policy URL.
- Mismatched nutrition label vs. policy/practices.
- No ATT for trackers like Meta (5.1.3).
- HealthKit without privacy details (5.1.4).
Test via TestFlight; update post-launch if changes occur.

(Word count: 378)