Privacy Policy for Apps Using the OpenAI API

If your app sends user text, audio, or images to the OpenAI API, that content leaves your servers and is processed by a third party. App stores and regulators expect your privacy policy to say so clearly. This guide covers what to disclose and gives you sample wording you can adapt.

Create My Privacy Policy

Last updated July 8, 2026

Why this affects your privacy policy

When a user types a prompt, uploads a file, or speaks to your app, you typically forward that data to OpenAI to get a completion, transcription, or image back. That is a transfer of personal data to a processor — often across borders to the United States. Reviewers at Meta, Google Play, and Apple increasingly reject policies that use AI features but never mention the AI provider or what user content is sent to it.

Data typically processed

Data type	Details
Prompts & user input	Text, questions, or instructions the user submits, which are sent to the API to generate a response.
Uploaded files / images	Documents or images passed to vision or file endpoints.
Audio	Voice recordings sent to speech-to-text (Whisper) endpoints.
Generated output	The model response, which you may store or display back to the user.
Technical metadata	Request timing and usage data needed to operate and bill for the API.

What to disclose

That your app uses a third-party AI provider to process user input.
The categories of content sent to the provider (text, images, audio, etc.).
That data may be transferred to and processed in other countries, including the US.
Whether you store prompts and generated output, and for how long.
That you do not knowingly send sensitive data unless the user provides it, and how you handle that.
A link to the provider’s own privacy terms so users can read them.

Example wording

AI Processing. To provide certain features, we send the content you submit (such as your text prompts, uploaded images, or audio) to a third-party artificial intelligence provider that processes it on our behalf and returns a response. This content may be processed on servers located outside your country, including in the United States. We do not use your content to train third-party AI models, and we ask that you avoid submitting sensitive personal information. You can review the AI provider’s privacy practices in their published privacy documentation.

Sample language only — adapt it to your actual data practices.

Best practices

→ Set the API flag/agreement that excludes your traffic from model training where available.
→ Warn users in-product not to paste passwords, health data, or other sensitive info into prompts.
→ Minimize retention: store prompts/outputs only as long as the feature needs them.
→ If you fine-tune on user data, disclose that explicitly — it is a different use than inference.

Generate a policy that already covers OpenAI API and host it at a permanent URL.

Host Your Policy

Frequently asked questions

Do I have to name OpenAI specifically in my policy?

You must disclose that you use a third-party AI provider and what data you send. Naming the specific provider is a best practice and some app reviewers prefer it, but describing the category of recipient and linking to their terms also satisfies GDPR and CCPA disclosure requirements.

Does OpenAI train on the data I send through the API?

OpenAI states that API data is not used to train its models by default. Regardless, your privacy policy should describe how you handle the data, not just the provider.

Is a privacy policy required if my AI app collects "nothing"?

If you send user prompts to an external API, you are processing personal data even if you store nothing. A privacy policy is still required by app stores and most privacy laws.

Related guides

This guide is for general informational purposes only and is not legal advice. Your privacy policy should reflect your actual data practices and applicable legal requirements, which vary by jurisdiction and platform.

Create and host your privacy policy

Fill out a short form, get a permanent HTTPS URL for your app submission.

Create My Privacy Policy