How to fill in the Data safety form and App Privacy labels
- Tick the SDKs your app includes: ads, analytics, crash reporting, sign-in, payments.
- Tick what your app itself sends to your server: accounts, location, photos, messages and so on.
- Answer the two security questions and add your account deletion link.
- Copy the answers into Play Console (Policy and programs → App content → Data safety) and App Store Connect (App Privacy).
- Optionally paste your store link to see what your listing declares today and what’s missing.
Google Play: collected vs shared
- Collected: the data leaves the device, to your servers or to an SDK.
- Shared: the data goes to a third party, such as an ad network. Sending data to a service provider that processes it for you (hosting, crash reporting, analytics under your control) isn’t sharing.
- Optional: users can use the app without giving it, for example a feature behind a permission they can refuse.
App Store: linked and tracking
- Linked to the user: tied to an account, user ID or other identity.
- Used for tracking: combined with other companies’ data for targeted ads or ad measurement. Ad SDKs usually mean yes, and the app then needs the App Tracking Transparency prompt.
Common mistakes
- Leaving out data your SDKs collect. Google Play compares declarations with what the app actually sends and can reject the update.
- Saying “Data Not Collected” on the App Store while using an ad or analytics SDK.
- Forgetting the account deletion link that Google Play requires for apps with accounts.
Next steps
Both stores also need a privacy policy that matches these answers. Make one with the privacy policy generator, and check the rest of your listing with the ASO audit.