AppPage.net

Free · Google Play & App Store · Privacy manifest · No sign-up

Data safety & privacy label generator

Pick the SDKs and features in your app. Get the answers for Google Play’s Data safety form and the App Store’s App Privacy questions, a ready iOS privacy manifest, and check them against your live listing.

1. SDKs in your app

Third-party code that sends data off the device. “Guide” opens the SDK’s own disclosure page.

2. What your app sends to your server

Only data that leaves the device counts. Data processed only on the phone doesn’t need to be declared.

3. Security

Encryption Is all data sent over HTTPS (encrypted in transit)?
Deletion Can users ask you to delete their data?

4. iOS privacy manifest

APIs your own code uses that Apple asks a reason for. SDKs declare their own.

5. Your answers

These answers are a starting point based on each SDK’s documented defaults. You’re responsible for what you declare: check each SDK’s guide, especially if you changed its settings.

How to fill in the Data safety form and App Privacy labels

  1. Tick the SDKs your app includes: ads, analytics, crash reporting, sign-in, payments.
  2. Tick what your app itself sends to your server: accounts, location, photos, messages and so on.
  3. Answer the two security questions and add your account deletion link.
  4. For iOS, pick the required reason APIs your own code uses.
  5. Copy the answers into Play Console (Policy and programs → App content → Data safety) and App Store Connect (App Privacy), and add the downloaded PrivacyInfo.xcprivacy to your Xcode project.
  6. Optionally paste your store link to see what your listing declares today and what’s missing.

Google Play: collected vs shared

  • Collected: the data leaves the device, to your servers or to an SDK.
  • Shared: the data goes to a third party, such as an ad network. Sending data to a service provider that processes it for you (hosting, crash reporting, analytics under your control) isn’t sharing.
  • Optional: users can use the app without giving it, for example a feature behind a permission they can refuse.

App Store: linked and tracking

  • Linked to the user: tied to an account, user ID or other identity.
  • Used for tracking: combined with other companies’ data for targeted ads or ad measurement. Ad SDKs usually mean yes, and the app then needs the App Tracking Transparency prompt.

iOS privacy manifest (PrivacyInfo.xcprivacy)

Since May 2024 Apple asks every app to declare, in a PrivacyInfo.xcprivacy file, the data it collects, whether it tracks and why it calls certain APIs. Uploads that use those APIs without a reason are rejected with ITMS-91053.

  • Required reason APIs: UserDefaults, file timestamps, system boot time, disk space and active keyboards. Pick the reason that matches how your code uses each one; almost every app uses UserDefaults.
  • Tracking: if anything in the app tracks, set it to yes and list the domains your own code tracks through. iOS blocks connections to those domains until the user allows tracking.
  • SDKs: recent versions of Firebase, AdMob, RevenueCat and other common SDKs include their own manifest. Xcode merges them all into the privacy report of your archive.

Common mistakes

  • Leaving out data your SDKs collect. Google Play compares declarations with what the app actually sends and can reject the update.
  • Saying “Data Not Collected” on the App Store while using an ad or analytics SDK.
  • Forgetting the account deletion link that Google Play requires for apps with accounts.

Next steps

Both stores also need a privacy policy that matches these answers. Make one with the privacy policy generator, and check the rest of your listing with the ASO audit.