Anthropic API and Apple Public Pages: disclose prompts, retention, and support

Trace the request before writing the policy

An app's AI feature can send more than the text a user types. Map the real request path from the iOS interface through your backend to Anthropic, then identify each content field your production code forwards. Depending on your design, this can include a prompt, selected conversation history, an uploaded image or document, an app-generated instruction, or a tool result. Describe only the inputs your app actually sends; Anthropic's API can process different features, but the availability of a feature does not prove your app uses it (Anthropic API documentation).

Inspect the production endpoint, prompt templates, file-handling path, and any tools that run around the model call. If the request contains only a fixed prompt and non-personal settings, do not say that chat transcripts are uploaded; if users can paste personal details, explain that free text may include them.

Separate the request and response from your own storage. A response may remain on screen, enter conversation history or server logs, or be forwarded to another provider; document the destinations that apply. Apple's policy asks you to explain collection, use, retention, deletion, and third-party handling (Apple App Review Guidelines).

Explain Anthropic's role without overpromising

Tell users that Anthropic processes the content your service submits for the AI feature. Explain if your backend sends prompts, attachments, account identifiers, or conversation context, and do not imply that the provider receives no personal data merely because the request comes from a server.

Be careful with statements about training and retention. Anthropic's commercial API documentation distinguishes the Claude API from consumer Claude products and says retained API data is not used for model training without express permission. It also describes conversation content as not retained by default, while specifying exceptions such as certain Covered Models that require 30-day retention; zero data retention is a separate arrangement and feature eligibility varies (Anthropic API data retention). Your policy should reflect your actual API product, model, account configuration, enabled features, and contract—not promise “zero retention” simply because your app calls the API.

If your product uses features such as Files API, batches, or agents, verify their feature-specific retention rather than assuming they follow the standard request path; Anthropic notes that ZDR eligibility is not universal (Anthropic API data retention). If you cannot verify the applicable arrangement, describe what your app controls and avoid a provider-wide deletion promise.

Make the Apple Public Pages concrete

Apple requires a privacy-policy link in App Store Connect metadata and an easily accessible link within the app. The policy should identify collected information, collection and use, retention and deletion, consent choices, and relevant third parties (Apple App Review Guidelines). Put the in-app link somewhere users can reach before making an AI request.

For an Anthropic-powered feature, write a short, readable section that answers these questions:

• What is sent? Name the categories your integration transmits, such as prompts, selected conversation context, files, and user identifiers if included.
• Why is it sent? State which AI feature the processing supports; distinguish that from your own analytics, safety review, or support logging.
• Who receives it? Identify Anthropic as the AI service provider and disclose any other recipient in the request path. Apple's guidelines specifically call out third-party AI and require clear disclosure and permission before sharing personal data with third parties (Apple App Review Guidelines).
• What do you keep? Explain whether your service stores prompts, responses, attachments, or conversation history, the applicable retention period or deletion process, and any logs that remain after a user deletes a conversation.
• How can users get help? Provide a working contact route for questions about AI processing, account records, or privacy requests.

Avoid an unconditional claim such as “Anthropic never stores your data.” The policy should say what you know about your specific arrangement, identify the cases or product features that change retention, and link users to Anthropic's privacy information and the API retention documentation. Those links add context; they do not replace your app's own explanation of its data flow.

Keep store metadata and support usable

The App Store privacy-policy URL is required for iOS apps; an optional privacy choices URL can help users manage their choices (Manage app privacy in App Store Connect). Use it for a real workflow, such as a request form or instructions for deleting stored AI conversations, not a generic marketing page.

Apple's Support URL must be a complete URL and lead to actual contact information, such as an email address, telephone number, or legal address (App Store Connect Support URL requirements). Make sure the linked page names the app or developer and lets a user report a problem without first being able to sign in. If support requests may include sensitive prompt content, tell users what reference information is useful and warn them not to send passwords, authentication codes, or unnecessary private material.

Store-page links and your in-app policy are separate from the App Privacy details entered in App Store Connect. Apple says the privacy details must include the app's practices and those of third-party partners whose code you integrate, and that the developer is responsible for keeping those answers current (Apple App Privacy details). Use the request inventory to review both the prose and the store answers, but do not copy generic AI data categories into either without checking the fields and purposes in your release build.

Release checklist

Before publishing, compare a production-like request payload with your policy, inspect whether your backend stores a copy, and verify the retention behavior for the Anthropic organization and features you use. Test the privacy URL, in-app link, Support URL, and any deletion or privacy-choice workflow without signing in. Repeat this review when you add uploads, conversation history, a new model, or a tool that handles content.

Where Declora fits

Declora's App Passport lets you confirm App Facts about Anthropic content and derive Apple Store Answers and Public Pages from the same source of truth. That helps keep the privacy policy, store disclosures, and app behavior aligned when an AI feature changes; review the generated wording against your production requests at declora.app. Declora is not a law firm, does not provide legal advice, and cannot guarantee App Store approval.

FAQ

Does using the Anthropic API mean my app sends every conversation to Anthropic?

No. Your app sends what its request code includes. Trace the production payload, including any selected history, uploaded files, prompt context, or tool results, and describe those actual categories rather than inferring them from the API dependency.

Can I say that prompts are never retained?

Only if the statement accurately describes your API arrangement and the features your app uses. Anthropic documents default API behavior, zero-data-retention arrangements, model-specific retention requirements, and feature-specific exceptions; confirm the current details for your organization and request path before describing retention (Anthropic API data retention).

Does the policy link in App Store Connect satisfy Apple's requirement?

Not by itself. Apple requires the policy link in App Store Connect metadata and an easily accessible link inside the app, and its Support URL must lead to actual contact information (Apple App Review Guidelines; Support URL requirements).