# Google Play Data safety checklist

A blank copy of the questions in Google Play Console's Data safety form, to fill in for your app before you
submit. What each question means, and how to check it: https://www.puglieseweb.com/google-play-data-safety

Checked against Google Play Console on 14 November 2026. Google changes the form from time to time. This checklist
is a guide, not legal advice: where it and Google's help differ, Google's help is right
(https://support.google.com/googleplay/android-developer/answer/10787469).

Free from PuglieseWeb LTD. Copy it, change it and share it.

## Your app

| | |
|---|---|
| App name | |
| Package | |
| Filled in by, date | |
| Checked by | |

## Before you start

- **Collected**: the data leaves the phone, to your servers or anyone else's, an SDK's included.
- **Shared**: the data goes to another company, from the phone or from your servers. Passing it to a supplier that
  only processes it for you is not sharing, but it is still collecting.
- **Processed ephemerally**: kept in memory only for the one request, never stored, logs included.
- Declare what the app collects or shares, what its libraries and SDKs send, what your servers pass to another
  company, and what goes through a web page the app opens.

SDKs in this app (each one's own Data safety guidance read for the version used):

- [ ] ______
- [ ] ______

## Step 1, Overview

Nothing to answer.

## Step 2, Data collection and security

**Does your app collect or share any of the required user data types?**
- [ ] Yes
- [ ] No

**Is all of the user data collected by your app encrypted in transit?**
- [ ] Yes
- [ ] No

**Which of the following methods of account creation does your app support?** (all that apply)
- [ ] Username and password
- [ ] Username and other authentication
- [ ] Username, password and other authentication
- [ ] OAuth
- [ ] Other: ______
- [ ] My app does not allow users to create an account

**Delete account URL**

______ (opened signed out, on a phone: [ ])

**Do you provide a way for users to request that some or all of their data be deleted, without requiring them to delete their account?** (optional)
- [ ] Yes. Delete data URL: ______
- [ ] No
- [ ] No, but user data is automatically deleted within 90 days

**Additional badges** (optional)
- [ ] Independent security review
- [ ] UPI payments verified

## Step 3, Data types

Tick a type if any part of the app, an SDK or your server collects or shares it.

**Location**
- [ ] Approximate location
- [ ] Precise location

**Personal info**
- [ ] Name
- [ ] Email address
- [ ] User IDs
- [ ] Address
- [ ] Phone number
- [ ] Race and ethnicity
- [ ] Political or religious beliefs
- [ ] Sexual orientation
- [ ] Other info

**Financial info**
- [ ] User payment info
- [ ] Purchase history
- [ ] Credit score
- [ ] Other financial info

**Health and fitness**
- [ ] Health info
- [ ] Fitness info

**Messages**
- [ ] Emails
- [ ] SMS or MMS
- [ ] Other in-app messages

**Photos and videos**
- [ ] Photos
- [ ] Videos

**Audio files**
- [ ] Voice or sound recordings
- [ ] Music files
- [ ] Other audio files

**Files and docs**
- [ ] Files and docs

**Calendar**
- [ ] Calendar events

**Contacts**
- [ ] Contacts

**App activity**
- [ ] App interactions
- [ ] In-app search history
- [ ] Installed apps
- [ ] Other user-generated content
- [ ] Other actions

**Web browsing**
- [ ] Web browsing history

**App info and performance**
- [ ] Crash logs
- [ ] Diagnostics
- [ ] Other app performance data

**Device or other IDs**
- [ ] Device or other IDs

## Step 4, Data usage and handling

For each type ticked in step 3, the form asks:

1. Is this data collected, shared or both?
2. Is this data processed ephemerally?
3. Is this data required for your app, or can users choose whether it's collected?
4. Why is this user data collected?
5. Why is this user data shared?

Purposes: App functionality (AF), Analytics (AN), Developer communications (DC), Advertising or marketing (AM),
Fraud prevention, security and compliance (FP), Personalisation (PE), Account management (AC).

| Data type | Collected | Shared | Ephemeral | Required or users can choose | Collected for | Shared for | Who receives it |
|---|---|---|---|---|---|---|---|
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |

## Step 5, Preview

- [ ] Read as a customer would
- [ ] Matches the privacy policy
- [ ] Saved

## Common mistakes, checked

- [ ] Leaving out what SDKs send: crash reporting, analytics, ads and push all collect data.
- [ ] A delete-account link that opens the privacy policy, or only a screen inside the app.
- [ ] Sign in with Google or Apple offered, and OAuth not ticked.
- [ ] Data marked optional when the app cannot be used without it.
- [ ] Data marked ephemeral when it is written to a log or a database.
- [ ] Forgetting what your server passes on to another company.
- [ ] Forgetting what goes through a sign-in or payment page the app opens.
- [ ] Answers that disagree with the privacy policy.
- [ ] A new SDK or feature added, and the form not updated.