In this guide
"Why does a flashlight app need my contacts?" is a fair question. A privacy review is a trust problem, and the public reply is where other users decide whether to believe you.
First, check that you are right
Before replying, open your app and list what it actually asks for and why. If a permission is not needed for a feature, the review may be correct, and the best reply is a fix. Only defend what you can explain.
Both stores expect a privacy policy you can link to. Apple's guideline 5.1.1(i) says apps must include a link to their privacy policy in the App Store Connect metadata and within the app. Google Play's User Data policy asks for a privacy policy link in the designated Play Console field and in the app, and every published app must complete the Data safety form, even if it collects no data. You alone are responsible for accurate declarations, including data handled by third-party libraries. Rules change, so check the current official pages. This is not legal advice.
What a good reply contains
- Thanks, without defensiveness. The question is legitimate.
- Plain language: which permission, which feature uses it, what happens to the data. One or two sentences.
- What you do not do, but only if it is true. Do not promise "we never share anything" unless you have checked every library in your app.
- A link to your privacy policy or the in-app explanation, and a private contact for questions.
Apple's guideline 5.6.1 asks that responses stay targeted to the user's comments with no personal information, spam or marketing. Do not ask the reviewer for details of their device or account in public.
Example reply: "Fair question, thank you. The camera permission is used only for scanning a code on the scan screen; images are not stored. Location is optional and only used for [feature]. You can read what we collect here: [link to policy]. If you have more questions, write to [support address]."
When the review is wrong
Correct it once, politely, with facts. Do not repeat the argument. If a permission prompt is confusing, fix the wording shown before the system dialog, because the reviewer is not the only one confused.
Reduce these reviews before they happen
- Ask for a permission at the moment it is needed, with one line saying why.
- Make the app work without optional permissions.
- Remove data collection you do not use.
- Ask testers whether any request surprised them. On AppReviewX that is part of private structured feedback; one feedback you write earns one credit, new accounts have 0 credits, and store ratings are never required.
Related
- Hub: App reviews and ratings guide
- Your rating dropped after an update
- What a low rating means for installs
- Templates: how to reply to app reviews
Get started and find confusing permission prompts before your users do.