Generating Privacy Policy
Document the data practices of your Account or Guest Expo app before release.
This is a template, not legal advice
App Store and Google Play submissions require a public privacy-policy URL. Generate or draft a policy with counsel, then customize it to the exact profile, vendors, permissions, and data flows your app ships.
Data to review in the Expo template
Account profile
Document the data your app and backend may process, including:
- Name, email, password/verification state, phone number, avatar, and connected Google/Apple identities.
- Sanctum tokens, device/session metadata, login history, and security actions.
- Preferences (language, region, timezone, privacy choices, notification preferences).
- Feedback, FAQ/help requests, uploaded profile/media files, and billing entitlement records.
- Native device/FCM tokens when the user enables Account push notifications.
Laravel owns the Account database, mail, uploads, webhooks, and notification delivery. State your retention, deletion, processor, and cross-border-transfer practices rather than copying the template's field names blindly.
Guest profile
Guest runtime data is local-first: auth/API calls, remote preference sync, FCM token registration, and server entitlement checks are disabled. The profile still includes Paywall/RevenueCat and AdMob, so document the store/payment and advertising SDK data flows if those features are enabled. Purchase/restore operations require internet access.
Third-party services and optional integrations
Only list services that you actually configure and ship. Possible integrations include RevenueCat, Google Sign-In, Apple Sign-In, Firebase Cloud Messaging, Google Mobile Ads, Expo native services, and your mail/storage provider. The Expo template does not initialize Sentry, Firebase Analytics, or Crashlytics by default.
Hosting the policy
Host the final policy at a stable public HTTPS URL, for example:
- The Guest profile's generated
landing-page/public site. - The Account profile's public
admin-panelroute (including its built-in landing/legal surface). - A Laravel
public/route. - A separate legal/docs domain.
The policy URL must be reachable without authentication and must match the app/store listing. Link it from the app's About/Settings screen; expo-web-browser is already included in the Expo template.
Before submission
- Inventory every permission, SDK, API, cookie, storage key, and backend table used by the shipped profile.
- Explain Account versus Guest behavior if both are distributed.
- Add contact, controller, retention, deletion, and regional-rights information.
- Publish the policy over HTTPS and test the URL on a logged-out device.
- Complete Apple App Privacy and Google Play Data safety forms consistently with the policy.
- Update the policy when you add analytics, ads, purchases, push, uploads, or new backend data.