Privacy Policy URL
Get URL

How to add a Privacy Policy URL to a Slack app listing

By Paul Cranmer, Founder · Last verified October 2026 · Slack Marketplace · app landing page and submission

Slack reviews an app against its scopes, its landing page and its privacy policy together. The landing page has to be a public web page with a clear link to the policy, and the policy has to say what the app collects, how long it keeps it, how people get it deleted, and how to reach you. Broken policy or support links are a reason for delisting. This page walks the submission in order and shows where a hosted URL fits.

Who this is for

  • Developers submitting a Slack app to the Marketplace for the first time
  • Teams whose landing page or policy link failed review
  • Agents and bots that read channel content and need a precise data statement

Not for

  • Internal-only Slack apps that will never be listed (a policy is still good practice, but review does not apply)
  • A full guide to Slack's security review

What the platform requires

  • A public landing page built for the app (not a PDF, document or repository) with a clear link to your privacy policy.
  • The policy must state the data collected and how it is used, how long it is kept, and how individuals can request access, transfer or deletion.
  • A contact method: an email address or a web form. A postal address alone is not sufficient.
  • If the app receives Slack data it never uses (for example IDs in slash command payloads), the policy must say so.
  • A public support page with a contact method; broken support or policy links can lead to Slack contacting you and delisting the app.

Get a live URL first

A Slack app is on the free path: answer the wizard, name the app and the data it accesses, and you get a stable HTTPS policy URL to link from the landing page and the submission. Update the text when scopes change; the link stays the same.

Get the Slack app policy URL

Step-by-step: paste your privacy policy URL

  1. Create your hosted privacy policy URL first. Generate the policy with the app's name, the workspace data it accesses, retention and a deletion contact. Copy the live HTTPS URL.
  2. Link it from your app's landing page. Slack requires the landing page itself to carry a clear link to the policy. Put it in the footer and next to the install button so reviewers find it without scrolling.
  3. Open your app at api.slack.com/apps. Select the app, then go to Manage Distribution. Complete the distribution checklist (redirect URLs, scopes, a removed hard-coded token check) before you start the Marketplace submission.
  4. Fill the Marketplace submission with the same URLs. The submission asks for your landing page, support and privacy policy links. Use the hosted URL and the public support page; the links must open without a login.
  5. Match the policy to your scopes. Review compares what the policy says with the scopes you request and how the app uses them. If you ask for channel history, the policy must describe reading messages, retention and deletion.
  6. Submit, then keep the links alive. After listing, Slack may re-check at any time. Edit the policy behind the same URL whenever scopes or retention change, and never move the landing page without a redirect.

Field labels to look for

Landing page
Public web page for the app. Must include a clear privacy policy link; PDFs, docs and repos are not accepted.
Manage Distribution
Where the public distribution checklist and the Marketplace submission start, under your app at api.slack.com/apps.
Scope & data access
Separate from the policy: explain how the app uses each scope. Reviewers read both together.

Common reasons the form fails

  • Landing page with no visible privacy policy link, or a link to a PDF
  • Policy that never mentions retention or how to request deletion
  • Only a postal address as the contact method
  • Policy silent about data the app receives but does not use
  • Links that broke after a site redesign (grounds for delisting)

Agents and AI apps

Slack also forbids using Slack data to train language models and expects agent apps to store metadata rather than message content. If your app is an agent, say so plainly in the policy and in the scope explanations.

Get the Slack app policy URLLearn more

FAQ

Is a data deletion contact required?

Yes in practice. Slack wants the policy to say how individuals request access, transfer or deletion, and to give an email address or web form. A postal address alone does not pass.

Can several Slack apps share one policy URL?

Yes. Name each app on the page, or add a section per app that states exactly what that app accesses and keeps.

Does the policy need to list my OAuth scopes?

Not scope by scope. The policy describes the data and its use; the submission's scope explanations cover each scope. Reviewers check that the two agree.

Related

Sources