Google Play's Data safety form and Apple's App Privacy details ask the same basic question, which is what your app does with people's data, using different definitions. Both stores treat an inaccurate answer as a policy violation, and both hold you responsible for the code you did not write: the analytics, crash reporting, advertising and login libraries inside your app. The reliable way to get both right is one data inventory, mapped to each store's categories and updated with every release.
What each store asks
| Google Play: Data safety | App Store: App Privacy details | |
|---|---|---|
| Core question | Which data types are collected and which are shared | Which data types are collected, and for each, whether it is linked to the user and whether it is used for tracking |
| Purposes | Declared per data type, for collection and for sharing | Declared per data type |
| Security and control | Whether data is encrypted in transit and whether users can request deletion | Covered through the privacy policy and account deletion requirements |
| Related requirements | Privacy policy, prominent disclosure and consent, account deletion by web link and in-app | Privacy manifests, App Tracking Transparency permission for tracking, account deletion in-app |
The definitions that trip teams up
- Collected means leaving the device. Data processed only on the device and never sent to you or anyone else is not "collected" for either store's purposes.
- Shared has exceptions on Google Play. Transfers to a service provider processing data on your behalf, transfers for legal reasons and transfers the user initiates with clear disclosure are not "sharing" in the Data safety sense. They still count as collection.
- Tracking is Apple's special category. Linking data from your app with data from other companies' apps or websites for advertising, or sharing it with data brokers, is tracking and needs the user's permission through the App Tracking Transparency prompt.
- Linked to the user means connected to an identity, such as an account, device ID or email. Most data collected by apps with accounts is linked.
Your libraries are your disclosures
Every library that sends data counts: analytics, crash reporting, attribution, advertising, social login, customer support chat, payment and maps. For each one, read the developer's published data disclosure, check which features you have enabled, and record what it sends. A crash reporter that attaches device identifiers, or an advertising library that collects location, changes your answers even though your own code never touches that data.
On iOS, commonly used libraries must ship their own privacy manifests, and Xcode can generate a privacy report combining them. Use it as a cross-check, not as your answer: it shows declared API use, not everything a library transmits.
Third-party AI features
Sending user content to an external AI service is sharing personal data with a third party. Apple's guideline 5.1.2(i), revised in November 2025, requires clear disclosure and explicit permission before it happens, and Google Play's July 2026 update confirmed that its User Data policy applies to third-party AI integrations in the same way. Reflect the feature in both labels, in the privacy policy and in an in-app consent screen.
One inventory, mapped to both stores
| What the app handles | Google Play category | App Store category |
|---|---|---|
| Email address | Personal info: Email address | Contact Info: Email Address |
| Name | Personal info: Name | Contact Info: Name |
| Precise location | Location: Precise location | Location: Precise Location |
| Approximate location | Location: Approximate location | Location: Coarse Location |
| Photos the user uploads | Photos and videos: Photos | User Content: Photos or Videos |
| Chat messages | Messages: Other in-app messages | User Content: Emails or Text Messages |
| Purchase history | Financial info: Purchase history | Purchases: Purchase History |
| Crash logs | App info and performance: Crash logs | Diagnostics: Crash Data |
| Device or advertising identifier | Device or other IDs | Identifiers: Device ID |
| Screens viewed, taps, features used | App activity: App interactions | Usage Data: Product Interaction |
For each row, record the source (your code or which library), the purpose, where it is stored, who receives it and whether it is linked to the user. That record answers both forms, the privacy policy and most questions a reviewer or a client's legal team will ask.
Location precision
Both stores distinguish precise from approximate location, and Google Play published further guidance on those disclosures in July 2026. Declare precise location only if the app collects it, and consider whether a feature really needs it: approximate location is often enough for regional content, and it is a smaller disclosure.
Account deletion belongs in the labels too
If users can create an account, both stores require a deletion path inside the app. Google Play additionally requires a web link where users can request deletion without reinstalling the app, and asks about it in the Data safety form. Deleting the account must delete, or appropriately anonymise, the associated data, with any legally required retention explained.
Keeping the labels true
- Make the data inventory part of the codebase's documentation, owned by a named person.
- Review it whenever a library is added or upgraded, or a permission changes.
- Check both labels before each release that changes data handling, not once a year.
- Test with a network inspector: what the app sends in practice is what reviewers and researchers find.
- Keep the privacy policy, the in-app disclosures and both labels saying the same thing.
The rest of the submission sequence is in publishing on Google Play in 2026 and submitting to the App Store in 2026. Integrations that send data to outside services deserve the same scrutiny before they are built: third-party integrations: what to establish first.
Related Manboo Services
- Android App Development, including Play Console set-up, release tracks and policy declarations.
- iOS App Development, including App Store Connect, TestFlight and App Review preparation.
- Flutter App Development when one codebase must pass both stores' reviews.
- Software Maintenance for existing apps that need target API, SDK or policy updates.
- Request a scope review and estimate for a store launch or a rejected submission.