Where do I put my app's privacy policy and when do I display it?
Having a link to the privacy policy in the relevant field in iTunes Connect has been sufficient for me in the past. Obviously having a link in the app may allow users to find it more easily, however just the link in iTunes Connect seems sufficient based solely from personal experience.

Privacy Policy URL (optional)
A URL that links to your company’s privacy policy. Privacy policy URLs are required for all apps that offer auto-renewable or free subscriptions and for apps that are set to Made for Kids. Customers see this URL on their invoice and on the subscription confirmation email they receive. The URL can specify a localized site.
Include the entire URL, including the protocol.
Note that if your app is set to Made for Kids, you need to specify a Privacy policy URL for each localization provided for the app.

Source: iTunes Connect App Properties