App Privacy Policy: Apple and Google Rules for Lebanon

Apple rejected 400,000 app submissions for privacy violations in 2024, according to the Apple Newsroom. That is about one in five of the 1.9 million submissions it turned away that year. For a Lebanese business building its first app, the privacy policy is not paperwork to add after launch. It is a release gate on both stores, and it has to match what the code actually does.

Below is what Apple and Google check, what Lebanese law adds, and how to get a policy written without guessing.

Is a privacy policy necessary?

Yes: every app on the App Store or Google Play needs a privacy policy, even one that collects nothing. Apple's guideline 5.1.1(i) requires a link in App Store Connect and inside the app. Google Play says apps that collect no user data must still complete the Data safety form and link a policy.

Google's own search results blur this. Search the question from Beirut and the AI Overview says Google asks for a policy only when an app handles personal or sensitive data. The Play Console help page says otherwise, and the help page is what the review team applies.

What do Apple and Google check before an app goes live?

Both stores check a working policy link, a data disclosure form, and an account deletion path for apps with logins. Apple calls the form App Privacy details; Google calls it the Data safety section. Apple says you must also disclose data your third-party partners collect, and update the answers whenever your practices change.

Source: Apple App Review Guidelines, Apple Newsroom, Google Play Data safety, Google Play account deletion, read 2026-10-18

Apple enforces this at scale. Its reviewers handled more than 7.7 million submissions in 2024, and privacy alone accounted for 400,000 rejections, per the same Apple report. Google takes the same line on accuracy. Its Data safety help says developers are responsible for their answers and that misrepresented declarations lead to enforcement.

Does Lebanon have a data protection law for apps?

Yes: Law No. 81 of 2018 on Electronic Transactions and Personal Data covers personal data that Lebanese businesses collect, through apps included. DLA Piper's country summary lists it as Lebanon's data protection law. It routes processing requests through the Ministry of Economy and Trade instead of an independent regulator.

Enforcement is the weak part. Euro-Med Monitor reported that about six years after the law passed, the ministry had still not issued the procedures for submitting processing requests. It also found that organizations breaking the law were not held accountable. So the rulebook a Lebanese app meets in practice is the one Apple and Google apply at every release.

That does not make the law safe to ignore, and Gulf or European customers bring their own rules. Our overview of data privacy for Lebanese businesses covers GDPR exposure. If the app also launches in the UAE, read what a mobile app costs in Dubai before you budget.

What must an app privacy policy include?

Apple requires three parts: the data collected and its uses, third-party protection, and how users withdraw consent or request deletion. That list sits in guideline 5.1.1(i). Google's User Data policy asks for the same disclosures, including who the data is shared with, both on the store listing and inside the app.

For a typical Lebanese business app, that turns into five plain sections:

• Who you are. The legal company name, a Beirut or Lebanon address, and a contact email that someone reads.
• What you collect. Name, phone number, location, order history, photos, and anything the app stores on your server.
• Who receives it. The payment gateway, such as Areeba, the delivery partner, such as Toters, analytics, ad platforms and the push service.
• How long you keep it. Orders and invoices often have a legal retention reason, so say so.
• How to delete it. Where the in-app button is, and the web link that works without the app.

Publish it in every language the app ships in. A bilingual Arabic and English app with an English-only policy leaves half its users unable to read what they agreed to.

Do apps have to let users delete their account?

Yes, if the app lets people create an account, both stores require a way to delete it. Apple wants deletion started inside the app, and deactivation alone does not count. Google Play wants an in-app path plus a web link that still works after the app is uninstalled.

This part is a build task. Someone has to design the screen, the confirmation step and the server job that removes the record. Apple's deletion guidance says apps outside regulated fields should not force a phone call, an email or a chat to finish deletion. A flow that says message us on WhatsApp to close your account will not pass.

Guest accounts count too, per Apple, and Google expects service providers to delete their copy.

On Voxire builds with logins, the delete-account flow sits inside the MVP scope rather than in a later phase. Building it with the account system is cheaper than adding it after a rejection email.

Do third-party SDKs count as your data collection?

Yes: every SDK in your app counts as your data collection, whether or not the data reaches your own server. Google Play says Data safety answers must cover data sent off the device by libraries and SDKs. Apple tells developers they are responsible for all the code an SDK adds to the app.

A typical business app ships with the same handful: Firebase for crash reports and push, the Facebook SDK for ad attribution, Google Sign-In and a payment SDK. Apple's list of SDKs that need a privacy manifest names FirebaseCrashlytics, FirebaseMessaging, FBSDKCoreKit, GoogleSignIn, OneSignal and Flutter itself.

The owner rarely knows this list. The developer does. So the Data safety answers should come from whoever wrote the build file, with the owner checking the business side: what you sell, who sees the orders, and how long you keep them. Our checklist of what to check before you sign with app developers covers how to get that commitment in the contract.

At Voxire we give every client an SDK inventory before submission: each library, what it collects, and which store question it answers. The privacy policy and both store forms are written from that one sheet, so they cannot drift apart.

How do I make a privacy policy for my app?

Start from the app's real data and SDK list, then turn it into a policy with a generator or a lawyer. Generators run from free to about 14 USD a month, per Termly and iubenda pricing. A lawyer adds a judgment on Lebanese and export-market obligations that a template cannot make.

Source: Termly pricing, iubenda pricing, read 2026-10-18

Can you write your own? Yes. Neither store requires a lawyer or a paid tool. What they require is accuracy, and Apple puts the job of keeping answers current on you. A generator only knows what you tell it.

Host the policy on your own domain, not in a shared document or an Instagram highlight. Company enrollment already demands a real website, as our walkthrough of opening store accounts from Lebanon explains. Put the policy, store forms and deletion flow into the plan from the first week; our app build timeline for Lebanon shows where store review lands.

What should you actually do this week?

Ask your developer for a written list of every SDK in the app, then build the policy from it. That one list feeds the policy, Apple's App Privacy details and Google's Data safety form. The steps below take an owner a few hours, and they take the privacy surprises out of launch week.

• Get the SDK inventory in writing, with what each library collects.
• List every data type you keep and every company you share it with: gateway, delivery partner, ad platforms.
• Pick a route from the table above and publish the policy on your own domain, in Arabic and English.
• Confirm the app has an in-app delete option and a web deletion link, as Google Play requires.
• Name one person who updates the store answers whenever an SDK changes, as Apple expects.

If you are still scoping the build, Voxire's mobile app development MVPs start from $8,000. For ranges by app type, read mobile app development cost in Lebanon.

Sources

• Apple Newsroom: The App Store prevented more than $9 billion in fraudulent transactions, read 2026-10-18
• Apple: App Review Guidelines, read 2026-10-18
• Apple: App privacy details on the App Store, read 2026-10-18
• Apple: Offering account deletion in your app, read 2026-10-18
• Apple: Third-party SDK requirements, read 2026-10-18
• Google Play Console Help: Data safety section, read 2026-10-18
• Google Play Console Help: Account deletion requirements, read 2026-10-18
• Google Play Console Help: User Data policy, read 2026-10-18
• DLA Piper: Data protection laws in Lebanon, read 2026-10-18
• Euro-Med Monitor: Lebanon data protection law fails to protect privacy, read 2026-10-18
• Termly: Pricing, read 2026-10-18
• iubenda: Pricing, read 2026-10-18

Ready to ship an app that passes privacy review the first time?

We build the delete-account flow, keep the SDK inventory, and fill in the store privacy forms with you, so the policy matches the code. Tell us what your app collects and where it will launch, and we will map what each store will ask for.

→ Mobile App Development     → Get a Free Quote     → Chat on WhatsApp