Google Play Data safety checklist

The form, step by step

In Play Console: your app, then App content, then Data safety. Save a draft between steps.

1. Step 1, Overview

   Nothing to answer.

2. Step 2, Data collection and security

   1. Does your app collect or share any of the required user data types?

      Yes · No

      Yes for almost any app with sign-in, crash reporting, analytics or push. No only if nothing leaves the phone.

      Check: run the app through a proxy, or read the SDK list in your build.

   2. Is all of the user data collected by your app encrypted in transit?

      Yes · No

      Yes when every call, the SDKs' included, uses HTTPS.

      Check: search the code for http:// and confirm cleartext traffic is off in the Android network security config.

   3. Which of the following methods of account creation does your app support?

      Username and password · Username and other authentication · Username, password and other authentication · OAuth · Other · My app does not allow users to create an account

      A username includes an email address or phone number; other authentication includes one-time codes, passkeys and biometrics. Tick OAuth too if people can sign in with Google, Apple or another provider.

      Check: every sign-in button on the app's first screen and on any web page it opens.

   4. Delete account URL

      A web page, not only a screen inside the app, that names the app as the listing does, shows the steps to ask for deletion, and says what is deleted, what is kept and for how long.

      Check: open it signed out, on a phone.

   5. Do you provide a way for users to request that some or all of their data be deleted, without requiring them to delete their account?

      Yes · No · No, but user data is automatically deleted within 90 days

      Optional. Yes only if that way works today.

   6. Additional badges

      Independent security review · UPI payments verified

      Optional. An independent security review (MASA) is a paid assessment by a lab Google authorises; UPI payments verified is for finance apps in India only.

3. Step 3, Data types

   Tick a type if any part of the app, an SDK or your server collects or shares it. The form lists 38 types in 14 categories.

   • Location

     • Approximate location
     • Precise location

   • Personal info

     • Name
     • Email address
     • User IDs
     • Address
     • Phone number
     • Race and ethnicity
     • Political or religious beliefs
     • Sexual orientation
     • Other info

   • Financial info

     • User payment info
     • Purchase history
     • Credit score
     • Other financial info

   • Health and fitness

     • Health info
     • Fitness info

   • Messages

     • Emails
     • SMS or MMS
     • Other in-app messages

   • Photos and videos

     • Photos
     • Videos

   • Audio files

     • Voice or sound recordings
     • Music files
     • Other audio files

   • Files and docs

     • Files and docs

   • Calendar

     • Calendar events

   • Contacts

     • Contacts

   • App activity

     • App interactions
     • In-app search history
     • Installed apps
     • Other user-generated content
     • Other actions

   • Web browsing

     • Web browsing history

   • App info and performance

     • Crash logs
     • Diagnostics
     • Other app performance data

   • Device or other IDs

     • Device or other IDs

   What people type or say to a chat or an AI assistant is in-app messages or user-generated content, and recordings are voice recordings.

4. Step 4, Data usage and handling

   For each type ticked in step 3, the form asks:

   1. Is this data collected, shared or both?

      Collected · Shared

      Tick both when both are true.

   2. Is this data processed ephemerally?

      Yes · No

      Asked only for collected data. Yes only if it is never stored, logs included.

   3. Is this data required for your app, or can users choose whether it's collected?

      Data collection is required · Users can choose whether this data is collected

      "Users can choose" only if the app works without it.

   4. Why is this user data collected?

      Asked only for collected data. Tick every purpose below that applies.

   5. Why is this user data shared?

      Asked only for shared data. Tick every purpose below that applies.

   The seven purposes

   App functionality

   the features of the app, signing users in included.

   Analytics

   how people use the app and how it performs: feature use, crashes, bugs.

   Developer communications

   news and notifications about you or the app, such as a security update.

   Advertising or marketing

   showing or targeting ads or marketing, measuring them, or passing data to ad partners.

   Fraud prevention, security and compliance

   keeping accounts safe and meeting the law, such as watching failed sign-ins.

   Personalisation

   tailoring the app, such as recommendations.

   Account management

   creating accounts, signing in and verifying who someone is.

5. Step 5, Preview

   Read it as a customer would, then save.

What common SDKs usually send

Most SDK makers publish their own Data safety guidance: read it for the version you use, and for the options you turn on.