Privacy policy must be on the same domain — Google OAuth
This rejection is about where your policy lives and what it says. Hosting is the fast half; naming your Google data per scope is the half people miss.
A privacy policy on notion.so, docs.google.com, or a free-generator subdomain isn't on your app's domain, so Google rejects it — the same-domain rule doubles as an ownership check. Two more traps follow: the homepage link and the consent-screen URL must point to the same policy, and a generic template that never names Google data types gets rejected even when it's hosted correctly.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Host your privacy policy on the same domain as your homepage — a Notion page or Google Doc on another domain is rejected.”
“The policy link on your homepage and the policy URL on your consent screen must point to the same policy.”
“Your privacy policy must disclose how the app accesses, uses, stores, and shares Google user data specifically — named per scope.”
“Your homepage must describe what the app does and link to your privacy policy.”
Do these in order.
- 01
Host it on your own domain
Publish the policy at a path on your app's domain, e.g. yourdomain.com/privacy — not a Notion page, Google Doc, or generator-hosted URL.
- 02
Use one canonical URL everywhere
Put that exact URL in the consent screen's privacy-policy field and link the identical URL from your homepage. No www vs non-www split, no trailing-slash mismatch.
- 03
Name the Google data, per scope
For every scope you request, state what Google data it touches and how you access, use, store, and share it. Specific per-scope disclosure beats a thorough-but-generic template.
- 04
Make it reachable from the homepage
Link it visibly from the homepage — the footer is the conventional place. A reviewer must be able to reach the policy from your homepage without hunting for it.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Why was my Notion privacy policy rejected?
It isn't on your app's domain. Google requires the policy on the same domain as your homepage, which also proves you control that domain. Move it to yourdomain.com/privacy.
My policy is hosted correctly but still rejected — what now?
It probably doesn't name your Google data. The policy must disclose, per scope, what Google user data you access and how you use, store, and share it.