`$app_details['privacy_policy_url']` should be escaped with `esc_url()`