Quick answer
A privacy policy is a public notice that explains what personal data your product collects, why, who receives it, how long you keep it and how people can exercise their rights. Playxoft's free privacy policy generator asks about your app, website, Chrome extension or game, the SDKs you use and where your users live, then assembles matching GDPR, CCPA and COPPA clauses as HTML, Markdown or plain text. It is a template, not legal advice.
- Websites, apps, extensions and games
- GDPR and UK GDPR
- California privacy rights
- Children's privacy
- SDK catalog with vendor links
- HTML, Markdown and text
- Runs in your browser
How to use the Privacy Policy Generator
- 1In Product, choose what the policy covers (a website, an app, a Chrome extension, a game or desktop software) and name it.
- 2In Publisher, add your business name and contact email, plus your data protection officer and EU or UK representative if you have them.
- 3In Audience, choose where your users are and whether children use the product.
- 4Turn on your Features, such as accounts, payments or user content, and pick your SDKs in Services. Each one adds its own disclosure with a link to the vendor's privacy policy.
- 5Check Data, fix anything flagged in Review, then Copy HTML or download the policy as HTML, Markdown or plain text and publish it at a public URL.
What should a privacy policy include?
Under the GDPR (Articles 13 and 14) and the UK GDPR, a privacy notice must tell people the following, in concise, clear and plain language (European Commission, ICO checklist):
| Item | What to write |
|---|---|
| Who you are | Name and contact details, plus your data protection officer or EU/UK representative if you have one |
| What you collect | The categories of personal data, and where data came from if you did not collect it yourself |
| Why, and on what legal basis | Each purpose (accounts, analytics, ads) and its lawful basis, such as contract, consent or legitimate interests |
| Who receives it | Processors and third parties: SDK vendors, payment providers, hosting |
| Transfers abroad | Whether data leaves the EU or UK, and the safeguard you rely on |
| How long you keep it | A retention period, or the criteria that decide it |
| People's rights | Access, correction, deletion, restriction, objection, portability, withdrawing consent and complaining to a regulator |
| Automated decisions | Any profiling or automated decision-making with significant effects |
California's CCPA, as amended by the CPRA, adds the categories of personal information collected in the last 12 months, their sources and purposes, the third parties you disclose to, whether you sell or share it, and how to submit requests, updated at least once every 12 months.
Do I need a privacy policy?
Almost certainly: an email address from a contact form or an IP address logged by analytics is personal data. Laws require a policy in many places, and every major platform asks for a link:
| Where you publish | Privacy policy required? | Where the link goes |
|---|---|---|
| Apple App Store | Yes, for every app (Guideline 5.1.1) | App Store Connect and inside the app |
| Google Play | Yes, for every app, even one that collects no data (User Data policy) | Play Console and inside the app |
| Chrome Web Store | Yes, if the extension handles any user data (policy) | The Developer Dashboard |
| Website using Google Analytics | Yes, the Analytics terms require one | Usually the site footer |
Each platform adds its own checklist, covered in detail by the variants of this generator: privacy policies for mobile apps, for Chrome extensions, for games and for websites.
Which privacy laws apply to me: GDPR, CCPA or COPPA?
Privacy laws follow your users, not your office. A studio in India with players in Germany and California can be covered by both the GDPR and the CCPA.
| Law | Protects | Applies when | Notice essentials |
|---|---|---|---|
| GDPR and UK GDPR | People in the EU, EEA and UK | You are based there, offer goods or services to people there, or monitor their behavior | The Article 13 and 14 list, lawful bases, rights |
| CCPA (as amended by the CPRA) | California residents | A for-profit business with annual revenue over $26,625,000, or that buys, sells or shares the data of 100,000+ residents or households, or earns half its revenue from selling or sharing it | Notice at collection, privacy policy, a "Do Not Sell or Share My Personal Information" link |
| CalOPPA | California residents | A commercial website or online service collects personally identifiable information | A conspicuously posted policy with an effective date and how you respond to Do Not Track |
| COPPA | Children under 13 in the US | Your service is directed to children, or you know you collect from them | A privacy notice, direct notice to parents and verifiable parental consent |
The CCPA revenue threshold is the inflation-adjusted figure in force since January 1, 2025 (CPPA). If none applies, the GDPR's list is still a sensible default: it is the most detailed, and it covers most of what the stores ask for.
Privacy policy vs terms and conditions vs EULA: what's the difference?
They are three different documents, and most products need at least two of them:
| Document | What it does | Legal nature | Required? |
|---|---|---|---|
| Privacy policy | Explains how you collect, use and share personal data | A notice; regulators hold you to what it says | Often by law, and by every app store |
| Terms and conditions | Sets the rules for using your service: accounts, payments, acceptable use, liability | A contract with your users | Rarely by law, but strongly advised |
| EULA | Licenses your software to the user and limits copying, reverse engineering and resale | A license agreement | Apple applies its standard EULA unless you supply your own |
Create the other two with the terms and conditions generator and the EULA generator.
How do I make sure my privacy policy matches what my product does?
A copied policy describes someone else's product. Reviewers and regulators compare your policy with what your product actually sends, so build it from an inventory:
- List every data flow: forms, accounts, server logs, analytics events, crash reports, payments, support email.
- List every SDK. Each analytics, advertising, crash-reporting or sign-in SDK sends data to its vendor. Name it and link its privacy policy.
- Give each flow a purpose and a retention period. "Crash reports, kept for 90 days, to fix bugs" is the level of detail that holds up.
- Check SDK defaults. Many collect device identifiers or IP addresses out of the box; read each vendor's data disclosure page.
The generator handles the structure and wording; your inventory makes it true. Treat the result as a strong template, not legal advice, and have a lawyer review it if you handle health, financial or children's data.
Frequently asked questions
Last updated by the Playxoft engineering team.