Most app founders come to us a few weeks before launch, usually because Apple or Google has asked for a privacy policy link and they have realised they do not have one. By that stage the app is built, the developer has been paid, and the documents that would have protected them most are the ones that should have been signed at the start.
This article explains which legal documents a mobile app is likely to need in Australia, what the app stores require, and the mistakes we see most often when reviewing app terms.
Key takeaways
- Apple and Google both require a privacy policy for every app they list, even where Australian privacy law may not strictly require one.
- Terms and Conditions set the rules between you and your users, but they cannot override the consumer guarantees in the Australian Consumer Law.
- An End User Licence Agreement (EULA) is often optional on the App Store, because Apple applies its standard EULA if you do not supply your own.
- A Software Development Agreement decides who owns the code. Without one, the developer may own it, not you.
- Privacy law is changing. New transparency rules for automated decisions start on 10 December 2026, and a Children’s Online Privacy Code is due by the same date.
The short answer
Most apps need at least a privacy policy and terms and conditions. Whether you also need a separate EULA, a development agreement or extra privacy steps depends on how the app is built, who uses it and how it makes money.
Use this guide to help understand what document you might need:
Document | Who usually needs it | Why |
Privacy Policy | Every app listed on the App Store or Google Play | Required by both app stores, and by the Privacy Act for businesses it covers |
Terms and Conditions | Apps with accounts, payments, subscriptions or user content | Sets the rules of use and limits your liability where the law allows |
EULA | Apps with unusual licensing needs, or apps outside the App Store | Apple’s standard EULA may be enough for simple apps |
Software Development Agreement | Anyone paying a developer or agency to build the app | Decides who owns the code and what happens if the build goes wrong |
Subscription or payment terms | Apps with in-app purchases or recurring billing | Covers renewals, cancellations and refunds in a way that is consistent with consumer law |
A simple calculator app with no accounts and no data collection may need very little beyond a short privacy policy. A marketplace, health or social app is more likely to need all of the above, plus tailored privacy work.
What each document does, and where people get it wrong
Privacy Policy
A Privacy Policy explains what personal information your app collects, why, where it is stored, who it is shared with and how users can access or correct it.
A common misunderstanding is that every business is legally required to have one under the Privacy Act 1988. In fact, many businesses with an annual turnover of $3 million or less are currently exempt from the Australian Privacy Principles. That exemption has exceptions, including health service providers and businesses that trade in personal information, which many apps do without realising it (for example, by sharing user data with advertising networks for a benefit).
In practice, the exemption rarely matters for apps. Apple requires every app to include a privacy policy link in App Store Connect and within the app, and Google Play requires a privacy policy from all developers. If you want to be in the stores, you need one.
The bigger risk we see is a privacy policy that does not match what the app does. Third-party SDKs for analytics, crash reporting and advertising often collect data the founder does not know about. A policy that says “we do not share your data” while an ad SDK sends device identifiers offshore is more likely to create risk than having no policy at all, because it may be misleading.
Terms and Conditions
Terms and Conditions (sometimes called Terms of Use) set the rules for using the app. They usually cover account rules, acceptable use, ownership of content users upload, payments, suspension and termination, and limits on your liability.
The practical reality is that Australian law limits what these terms can do. Under the Australian Consumer Law, consumer guarantees cannot be excluded, so a “no refunds under any circumstances” clause may itself be misleading. Since 9 November 2023, using an unfair term in a standard form consumer or small business contract can attract penalties of up to $50 million or more for a company. Most app terms are standard form contracts, so this regime is likely to apply.
How users accept the terms also matters. A link buried in a footer is weaker than a sign-up screen where the user actively agrees before creating an account.
End User Licence Agreement (EULA)
A EULA grants the user a licence to use the app software, rather than selling it to them. It usually covers the scope of the licence, restrictions on copying or reverse engineering, intellectual property ownership, warranties and termination.
Many founders do not realise that Apple applies its standard Licensed Application EULA to any app that does not supply a custom one. For a straightforward app, that may be sufficient, and your Terms and Conditions can deal with the service side. A custom EULA is more likely to be worthwhile where the app is sold to businesses, distributed outside the app stores, or includes licensed content or technology with its own restrictions.
Software Development Agreement
This is the contract between you and the developer or agency building the app. It should cover scope, milestones, acceptance testing, payment, warranties, support after launch, confidentiality and, most importantly, ownership of the source code.
Under Australian copyright law, the person who writes the code is generally the first owner of it unless a written agreement says otherwise. Paying for the app does not, on its own, transfer ownership. We regularly see founders who cannot move to a new developer, raise capital or sell the business because a former contractor still owns key parts of the code. A clear assignment of intellectual property, plus a handover obligation for source code and credentials, is usually far cheaper to agree at the start than to negotiate after a dispute.
Australian laws that may apply to your app
Which laws apply depends on what your app does. These are the ones we most often consider when reviewing an Australian app:
Law or rule | When it is likely to matter |
Privacy Act 1988 and the Australian Privacy Principles | Businesses over $3 million turnover, and smaller businesses caught by an exception (such as health services or trading in personal information) |
Statutory tort for serious invasions of privacy | Any app, regardless of turnover. Individuals may sue for serious misuse of their personal information (in force since June 2025) |
Automated decision-making transparency | From 10 December 2026, privacy policies covered by the APPs need to explain when personal information is used in automated decisions that significantly affect individuals |
Children’s Online Privacy Code | Apps likely to be accessed by children. The OAIC must register the Code by 10 December 2026 |
Social media minimum age | Platforms declared age-restricted must take reasonable steps to stop under-16s holding accounts (since 10 December 2025) |
Australian Consumer Law | Any app sold to or used by consumers, including consumer guarantees, misleading conduct and unfair contract terms |
Spam Act 2003 | Apps that send marketing emails, SMS or similar messages, which generally need consent and an unsubscribe option |
You may see the Telecommunications Consumer Protections Code listed in other app checklists. That Code applies to telecommunications carriage service providers, so for most app businesses it is unlikely to be relevant.
An example from practice
A founder engaged an offshore freelancer to build a booking app. There was no written agreement, only a quote and a series of messages. The app launched with a privacy policy copied from another business.
Eighteen months later, the founder wanted to bring in an investor. The investor’s due diligence asked two questions: who owns the code, and does the privacy policy reflect what the app actually collects?
Neither answer was clear. The founder had to negotiate an IP assignment from the freelancer after the fact, and the privacy policy had to be rewritten once an audit showed the app shared location data with a third-party analytics provider. The investment went ahead, but later and at a higher cost than if the documents had been in place from day one.
Common mistakes we see
- Copying another app’s terms: They may refer to the wrong laws, the wrong features, or a business model you do not have, and they may contain terms that are unfair under Australian law.
- Treating the documents as a launch checklist item: Terms and privacy policies usually need updating when you add payments, new SDKs, AI features or a new market.
- Signing the developer’s standard contract without review: Agency contracts often license the code to you rather than assign it, or keep ownership until final payment.
- Ignoring overseas users: If your app is available in the EU, UK or US, other privacy laws may apply alongside Australian law.
What to do next
If you are about to engage a developer, start with the Software Development Agreement, as it is the hardest document to fix later. If the app is already built, an audit of what data it collects (including through third-party SDKs) is usually the best starting point for an accurate privacy policy and terms.
This article is general information, and the documents your app needs will depend on its features, users and business model. If you would like tailored advice, our technology lawyers can review your existing documents or prepare them from scratch. Contact Prosper Law to book a consultation.
Frequently Asked Questions (FAQs)
Do I need a privacy policy if my app does not collect any personal information?
If you list your app on the App Store or Google Play, you will need one regardless, as both stores require it. It can be short, but it should be accurate. Many apps collect more than the owner realises, such as device identifiers collected by analytics tools.
What is the difference between Terms and Conditions and an EULA?
A EULA deals with the licence to use the software itself. Terms and Conditions deal with the wider relationship, such as accounts, payments, user content and conduct. Some apps combine them into one document.
Can I use a generic template for my app’s legal documents?
A template may be a starting point for a very simple app, but it is unlikely to reflect your features, your data flows or Australian consumer law. The risk is not usually the template itself, but the parts of it that do not match how your app works.
Who owns my app's code if I paid a developer to build it?
Not necessarily you. Unless there is a written agreement assigning the intellectual property, the developer may retain ownership of the code and grant you only a licence to use it.
How often should I update my app’s legal documents?
We generally suggest a review at least once a year, and whenever you add a significant feature, a new third-party integration, payments, or a new market. With the privacy changes commencing on 10 December 2026, many apps are likely to need a review this year.
What happens if my app does not comply with Australian privacy law?
The consequences depend on the breach and the business. They may include OAIC investigations, infringement notices, civil penalties, claims by individuals under the statutory privacy tort, removal from app stores, and reputational damage.
Last updated: October 2026.
About the Author
Farrah Motley
Contact an Australian Business Lawyer Today.
Contact us for a free consultation
