17. Privacy

17.1

Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used



17.2

Apps that require users to share personal information, such as email address and date of birth, in order to function will be rejected



17.3

Apps may ask for date of birth (or use other age-gating mechanisms) only for the purpose of complying with applicable children's privacy statutes, but must include some useful functionality or entertainment value regardless of the user's age



17.4

Apps that collect, transmit, or have the capability to share personal information (e.g. name, address, email, location, photos, videos, drawings, the ability to chat, other personal data, or persistent identifiers used in combination with any of the above) from a minor must comply with applicable children's privacy statutes, and must include a privacy policy



17.5

Apps that include account registration or access a user’s existing account must include a privacy policy or they will be rejected

​

Location

4.1

Apps that do not notify and obtain user consent before collecting, transmitting, or using location data will be rejected



4.2

Apps that use location-based APIs for automatic or autonomous control of vehicles, aircraft, or other devices will be rejected



4.3

Apps that use location-based APIs for emergency services will be rejected



4.4

Location data can only be used when directly relevant to the features and services provided by the App to the user or to support approved advertising uses



So we're guessing this also require a Privacy Policy. ​