Guideline 5.1.1(i): the missing privacy policy rejection fix

What App Store Guideline 5.1.1(i) says

Apple's Guideline 5.1.1(i) (Data Collection and Storage) requires all apps to include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. The policy must clearly and explicitly identify what data the app and its service collect, how it collects that data, and all uses of that data.

It must also confirm that any third party with access to user data, such as analytics tools, advertising networks, and third-party SDKs, provides the same or equal protection of that data, and it must explain data retention and deletion and how a user can revoke consent or request deletion.

The official text lives on the App Store Review Guidelines page.

Why apps get rejected under 5.1.1(i)

Common triggers:

• No privacy policy URL was entered in App Store Connect, or the link is broken.
• The policy is not reachable from inside the app, so the in-app requirement is not met.
• The policy exists but does not actually describe the data the app collects, or is too vague to identify it.
• The app uses a third-party SDK, such as an analytics, ads, or crash library, whose data collection is not disclosed in the policy.
• The App Privacy answers in App Store Connect contradict the policy or do not match the app's real behavior.

The common thread is a mismatch. Apple checks that the policy, the App Privacy labels, and what the app actually does all line up.

How to fix it

1. Add the link in both places. Enter a working privacy policy URL in App Store Connect and add an easily accessible link inside the app, for example in settings or an about screen.
2. List every data type you collect. State plainly what data the app and your backend collect, how it is collected, and what each use is. Avoid vague catch-all language.
3. Account for every SDK. List the third-party SDKs you bundle, such as analytics, ads, attribution, or crash reporting, and disclose what they collect. Undisclosed SDK data is a frequent cause.
4. Match your App Privacy answers. Reconcile the App Privacy details you entered in App Store Connect with the policy and the app's real behavior so nothing contradicts.
5. Cover retention, deletion, and consent. Explain how long you keep data, how a user requests deletion, and how they revoke consent, which the guideline requires.
6. Verify the link resolves to the live policy before resubmitting.

Remember that submitted is not approved. An accurate, reachable policy is what the rule asks for, but Apple checks it against the app on resubmission.

How AppFlight helps

AppFlight knows which integrations it wired into your app, including analytics through PostHog, crash reporting through Sentry, paywalls through RevenueCat or Superwall, and your Supabase backend, which is exactly the third-party data collection a 5.1.1(i) policy has to disclose. It handles the full submission flow, including the privacy and metadata steps, so the policy link and App Privacy details are part of the path it walks. When Apple returns a 5.1.1(i) rejection, AppFlight reads the rejection reason, works on the privacy policy and disclosure issue, and resubmits the build. AppFlight does not guarantee approval. Apple reviews every app and every resubmission, and the policy has to genuinely match your data use.