Does your app need a privacy policy for the Microsoft Store?

When you need one

Microsoft's Store Policies, section 10.5, define personal information as anything that identifies a person or could be used to, or that's associated with such information. Policy 10.5.1 says that if your product accesses, collects or transmits personal information, or if the law requires it, you must have a privacy policy.

The same policy says products that inherently have access to personal information must always have one, and names Desktop Bridge and Win32 products. Desktop Bridge was Microsoft's name for packaging a classic desktop app for the Store while it keeps running with full trust, which is what MSIX does for desktop apps today. So an Electron, Python, Tauri, Flutter, WPF or C++ app packaged as MSIX needs one, and so does an app you list as an EXE or MSI.

Partner Center also checks your package. Microsoft says that if your package declares capabilities that could let it access, transmit or collect personal information, the privacy question is set to Yes and you have to enter a policy.

Where it goes in Partner Center

Open your submission and go to Properties›Privacy policy. Answer whether your app accesses, collects or transmits personal information. If you answer Yes, a privacy policy is required.

You can then do one of two things.

• Give the URL of a privacy policy on your own website.
• Paste the policy text directly into Partner Center, if you don't have a website.

The Store uses that policy in every market where your app is published. Microsoft doesn't provide a default policy, and your app isn't covered by Microsoft's own.

What it has to say

Policy 10.5.1 lists what the policy must tell users.

It must also follow the laws that apply to you, and Microsoft says you have to keep it up to date as you add features.

This outline puts those points under plain headings. Fill it in with what your app really does. It isn't legal advice, so check what the laws where you sell require.

Privacy policy for <App name>
Last updated: <date>

What the app collects
  <Each kind of personal information: account email, files the user opens,
  text typed into the app, crash reports, device or usage data. If it collects
  nothing, say so.>

How it's used
  <What each item is for.>

Where it's stored and how it's protected
  <On the user's PC only, or on your servers, and how it's secured.>

Who it's shared with
  <The kinds of companies that receive it, like a hosting provider, an
  analytics service or an AI model provider, and what each one gets.>

Your choices
  <How users turn things off, see their data and ask you to delete it.>

Contact
  <An email address for privacy questions.>

If your app sends data to an AI provider

An app that sends what the user types, or their files, to OpenAI, Anthropic, Google or another model provider is transmitting personal information. So the policy should say what's sent, that it goes to an AI model provider, and what happens to it there as far as you know. Policy 10.5.4 says personal information you collect, store or send must be protected with modern cryptography.

Apps that generate content with AI have their own Store rules on top of this, like the generative AI declaration on the Properties page. Our guide for apps built with AI covers them.

Related rules in section 10.5

• 10.5.2: before you publish a customer's personal information to an outside service or third party, you need their opt-in consent in the app and a way for them to withdraw it later.
• 10.5.5: highly sensitive information like health or financial data is only allowed if your app's function needs it, and only with the user's express consent.
• 10.5.7: if your app uses the device's location, it needs settings to turn that on and off.
• 10.5.8: follow the privacy laws about collecting information from children.

Privacy policies and StoreFast

You set the privacy policy in Partner Center with your first submission. When StoreFast publishes an update, the update starts as a copy of your last published submission, so the policy carries over unchanged. If your update starts collecting something new, change the policy in Partner Center as well.

For the rest of the first submission, see our submission checklist and the guide to publishing your first app.

Questions

Does my Microsoft Store app need a privacy policy?

If it accesses, collects or transmits personal information, yes. Microsoft's policy 10.5.1 also says Desktop Bridge and Win32 products must always have one, because they inherently have access to personal information. That covers most desktop apps, including Electron, Python, WPF and other apps packaged as MSIX, and EXE or MSI apps.

Do I need a website to host the privacy policy?

No. On the Properties page you can give a link to a policy on your own site, or paste the policy text into Partner Center. The Store uses it in every market where your app is published.

Does Microsoft give me a privacy policy to use?

No. Microsoft says it doesn't provide a default privacy policy, and your app isn't covered by any Microsoft privacy policy.

What happens if I leave it out?

If your package declares capabilities that could give access to personal information, Partner Center marks the question Yes and requires a policy before you can submit. If Microsoft decides later that your app needed one, the submission can fail certification.

Do I have to show the privacy policy inside the app too?

Microsoft requires the URL or text in Partner Center. It says you may also include or link to the policy in the app, which is optional.