Collecting even a single email address counts as collecting personal data. Accepting members without a privacy policy creates legal exposure and will almost certainly fail app store review. It needs to exist before your first user, not after launch.
What is the minimum it must contain?
- What you collect: list the actual fields such as email, name, and payment details.
- Why you collect it: state the purpose for each field.
- How long you keep it and when it is destroyed.
- Who else processes it: name the third-party services you use.
- How a user requests deletion: contact point and process.
Do you also need account deletion?
Yes. A service you can join but not leave is a problem. App stores will not approve a product without account deletion, and handling deletion requests manually stops scaling the moment you have real users. Building it as a feature from the start is far cheaper.
Once you handle data, backups follow. Check that automatic backups are enabled and, more importantly, that a restore actually works. A backup you have never restored is a guess, not a safeguard.