Do I Need A Privacy Policy For My App?

Priya is about to launch a small wellbeing app in New Zealand. Users create a profile, track their mood each day, receive push reminders, and pay $9.99 a month for premium content. She has only a few hundred beta users, so it feels too early to worry about legal documents.

Then her developer asks for the app's privacy policy before submitting it to the app stores. Her analytics tool also wants her to confirm she has told users what data is being collected.

If that sounds familiar, you're not behind. A small app can still collect a lot of personal information, sometimes more than a traditional website. The key is to be clear with users from day one, especially where your app uses permissions, analytics, push notifications or overseas software providers.

Do I Need A Privacy Policy For A Small App In New Zealand?

Yes, if your app collects personal information, you should have a privacy policy before launch. Under the Privacy Act 2020, New Zealand businesses need to handle personal information in line with the Information Privacy Principles, often called the IPPs.

Personal information is information about an identifiable person. For an app, that can include obvious details like a name and email address, but it can also include technical or behavioural data if it can be linked to a user.

Your app might collect personal information if it uses:

• account sign-ups, profiles or login details
• email addresses, phone numbers or social login information
• payment records or subscription details
• location data, contact lists, photos, camera access or microphone access
• health, fitness, wellbeing or habit-tracking information
• device IDs, IP addresses, cookies, SDKs or advertising identifiers
• analytics that track how individual users move through the app
• push notification tokens linked to a user or device

The Privacy Act doesn't use the exact phrase "every app must have a privacy policy". But it does require you to be open about why you collect personal information, what you'll do with it, who you may share it with, and how people can access and correct it. A privacy policy is the practical document that does that job.

You may also need a privacy policy because app stores, payment platforms, advertising networks and analytics providers require one. Even if your app is still small, those platform requirements can stop your launch if you haven't got the document ready.

What Should A Mobile App Privacy Policy Cover?

A mobile app privacy policy should explain what personal information your app collects, why you collect it, how you use it, who you share it with, and what choices users have. It should be written for your real app, not copied from a generic website policy.

For most New Zealand apps, a useful privacy policy will cover:

• Who you are: your business name, contact details and, if relevant, your NZBN.
• What you collect: account data, app usage data, device data, payment-related data, support messages and any sensitive information.
• How you collect it: directly from users, through app permissions, through SDKs, through cookies or similar technologies, and through third-party integrations.
• Why you collect it: to provide the app, process payments, send reminders, improve features, prevent fraud, personalise content or meet legal obligations.
• Who you share it with: hosting providers, analytics tools, payment processors, email platforms, customer support tools and other service providers.
• Overseas disclosures: where data may be stored or accessed outside New Zealand.
• User rights: how users can ask to access or correct their personal information.
• Security: the practical steps you take to protect data.
• Retention: how long you keep data and what happens when an account is closed.
• Contact details: how users can raise privacy questions or complaints.

Say your app lets users upload progress photos for a fitness programme. Your policy shouldn't just say you collect "personal information". It should explain that users can upload photos, that those photos are stored to provide the feature, and whether they're shared with any coach, trainer, cloud provider or AI tool.

Plain language matters here. A privacy policy that users can actually understand is more useful than a long document packed with legal phrases.

Do App Permissions, Analytics And Push Notifications Need Special Wording?

Yes, app-specific features usually need special wording because they can collect information users don't always expect. Your privacy policy should match what your app actually does in the background.

App Permissions

If your app asks for permissions, tell users why. This includes access to:

• location
• camera or photos
• microphone
• contacts
• calendar
• Bluetooth or nearby devices
• health or fitness data

For example, if a delivery app collects precise location data while the app is open, say that. If it tracks location in the background, that needs to be even clearer because users may not expect it.

Analytics And Crash Reporting

Analytics can be very helpful, but they often collect device and usage data. Your policy should explain that you use analytics to understand how users interact with the app, fix bugs, improve performance and measure feature use.

If analytics data is linked to a user account, say so. If you only use aggregated data that doesn't identify users, you can explain that too.

Push Notifications

Push notifications can involve device tokens, user preferences and behavioural triggers. If you send reminders, marketing messages or abandoned sign-up prompts, be upfront about it.

You should also make it easy for users to manage their notification settings. If you send marketing messages, check whether you also need to comply with the Unsolicited Electronic Messages Act 2007. Consent, sender identification and unsubscribe rules can apply to commercial electronic messages.

What Does The Privacy Act 2020 Mean For App Data?

The Privacy Act 2020 means you need to be careful and transparent when collecting, using, storing and sharing app user data. For app founders, a few IPPs tend to matter most.

Collect only what you need. If your app doesn't genuinely need a date of birth, home address or contact list, don't collect it. Collecting extra data can increase your risk without improving the product.

Tell users what you're doing. IPP 3 requires you to tell people certain things when you collect personal information, including why you're collecting it, who will receive it, whether collection is compulsory or voluntary, and their access and correction rights. Your privacy policy helps, but you may also need just-in-time notices in the app for sensitive or surprising collection.

From 1 May 2026, IPP 3A also applies where your app collects personal information from another source rather than directly from the person. This can matter for social login, integrations, contact import, referral flows, connected services and third-party data sources. You may need to take reasonable steps to tell the person the fact of collection, the purpose, intended recipients, the collecting or holding agency's details, any legal authority, and access and correction rights, unless an exception applies.

Use information for the purpose you collected it for. If users gave you their email address for account security, don't quietly add them to unrelated marketing lists. If you want to use data for a new purpose, you may need fresh notice or consent.

Keep information secure. Security doesn't need to be perfect, but it should be sensible for the type of data you hold and reflected in an information security policy. Strong passwords, access controls, encryption, secure hosting, staff permissions and deletion processes all matter.

Have a plan for privacy breaches. If a privacy breach is likely to cause serious harm, you may need to notify the Office of the Privacy Commissioner and affected people. New Zealand doesn't have a statutory 72-hour deadline like some overseas regimes. However, the Office of the Privacy Commissioner expects agencies to notify it ideally within 72 hours after becoming aware of a notifiable breach, even if they're still investigating. Affected people must also be told as soon as practicable unless an exception applies.

If your app collects children's data, health data, precise location data or highly personal information, get tailored advice early on privacy wording. The more sensitive the data, the more care you need around consent, wording, security and retention.

Can I Use Overseas Providers For My App Data?

Yes, you can use overseas providers, but you need to think carefully about overseas disclosure under the Privacy Act 2020. Many apps use overseas tools for hosting, analytics, payments, customer support, email, AI features or error reporting.

Under IPP 12, if you disclose personal information to an overseas person or organisation, you usually need to make sure there are appropriate privacy protections in place. In simple terms, you should know where user data is going and what protections apply.

Common overseas providers for apps include:

• cloud hosting and database services
• app analytics and attribution tools
• payment processors and subscription platforms
• email marketing and customer support software
• push notification services
• AI, moderation or personalisation tools

Before you connect a provider, ask:

• What personal information will this tool receive?
• Where is the data stored or accessed from?
• Does the provider use subcontractors?
• Does the provider have privacy and security terms you can rely on?
• Can you delete, export or restrict the data if needed?
• Does your privacy policy tell users about this type of sharing?

Back to Priya's wellbeing app. Her app uses a US-based analytics tool, an Australian email platform and a global cloud hosting provider. Her privacy policy needs to explain that personal information may be stored or processed outside New Zealand, and her business should keep copies of the relevant provider terms in case she needs to show what protections apply.

If your app sends personal information to an overseas AI tool, be especially careful. Some AI providers use submitted data to train or improve their services unless you opt out, choose the right business settings or set an AI governance policy. Your policy and provider terms should match what is actually happening.

Do I Also Need App Terms And Conditions?

Yes, you usually need app terms and conditions as well as a privacy policy. They do different jobs, and your app will be better protected if both documents work together.

Your privacy policy deals with personal information. Your app terms and conditions deal with the rules for using the app, payments, subscriptions, acceptable use, intellectual property, disclaimers, account suspension and liability.

For a New Zealand app, your terms should also be consistent with the Fair Trading Act 1986 and Consumer Guarantees Act 1993. You shouldn't make misleading claims about what the app does, and you can't simply contract out of consumer guarantees when supplying to consumers. If you supply mainly to businesses, different settings may apply, but your terms still need careful drafting.

An app terms document often covers:

• who can use the app and any age restrictions
• account registration and security
• subscription fees, renewals, free trials, payment privacy issues and cancellation rules
• acceptable use, including banned content or behaviour
• ownership of your app, code, branding and content
• user-generated content, including what licence users give you
• app availability, maintenance and feature changes
• limits on your responsibility, where legally allowed
• rules for ending or suspending accounts

If you're building a marketplace, social platform, booking app, fintech product or health-related app, your terms will need more than a basic template. Templates can be a useful starting point, but they often miss the exact flow of data, payments and user content in your product.

Privacy Policy For App NZ: What Should I Put In My First Draft?

Your first draft should map your real data flows before you start writing legal wording. A polished privacy policy that doesn't match your app can create more problems than it solves.

Here is a practical outline you can fill in with your app details. Treat it as a drafting checklist, not a finished legal document. A lawyer should tailor it before you rely on it.

1. Business Details: write your legal business name, trading name, NZBN if you have one, and privacy contact email.
2. Types Of Information Collected: list account details, profile data, device data, usage data, payment-related data, support messages and any sensitive information.
3. How Information Is Collected: explain sign-up forms, app permissions, cookies or SDKs, integrations, customer support, third-party platforms, and any direct or indirect collection.
4. Why You Collect It: connect each data type to a purpose, such as providing the app, personalising content, processing payments or improving performance.
5. Analytics And Tracking: name the categories of analytics, crash reporting, attribution or advertising tools you use and what they help you do.
6. Push Notifications And Marketing: explain reminder messages, service updates, promotional messages and how users can change preferences.
7. Sharing With Providers: list the types of service providers who may receive data, including hosting, payments, email, support and development tools.
8. Overseas Storage Or Access: say whether information may be processed outside New Zealand and what protections you rely on.
9. Security And Retention: describe sensible safeguards and how long you keep account, usage and support data.
10. Access, Correction And Complaints: tell users how they can contact you to access or correct information, or raise a privacy concern.

Once you've drafted it, test the policy against your actual app screens. If a user taps "allow location", "connect contacts" or "start free trial", the privacy policy and any on-screen notices should support what the user sees.

Keep records of your data map, provider list and policy versions. If you update your analytics stack or add a new feature later, review the policy before launch rather than after users complain.

Key Takeaways

• A small New Zealand app should have a privacy policy if it collects personal information, even if you're still in beta.
• App privacy policies need to cover app-specific data like permissions, analytics, crash reporting, push notifications and device identifiers.
• The Privacy Act 2020 requires clear handling of personal information, including direct and indirect collection notice, security, access and correction rights, and overseas disclosure rules.
• If you use overseas tools for hosting, payments, analytics, AI or support, check what data they receive and reflect that in your policy.
• Your app terms and conditions are separate from your privacy policy and should cover user rules, payments, intellectual property and liability.
• A tailored document is usually safer than a generic template because app data flows can be surprisingly specific.

If you'd like help with your app privacy policy, app terms and conditions, data collection notices or overseas provider wording, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.