Free tool · nothing stored
App Store and Google Play privacy labels, from your SDKs
Pick the SDKs in your app and the data it collects. You get the answers for Apple’s App Privacy details and Google Play’s Data safety form, every answer linked to the page it comes from, and your app’s own PrivacyInfo.xcprivacy file.
1. Where is the app?
2. Which SDKs does it use?
3. What does the app collect itself?
No SDK list covers this: your own sign-up form, uploads, messages and servers.
Your answers
App Store Connect: App Privacy
Data not collected.
Play Console: Data safety
No data collected or shared.
Encrypted in transit: you still need to answer this · Deletion requests: you still need to answer this
Every item is answered as not processed ephemerally: none of the cited sources describe it as handled only in memory.
What this tool cannot know
- Data your own servers collect beyond the list you ticked, and data in web views you control.
A starting point to check, not legal advice. You answer the store forms and stay responsible for them; check each answer against your app and the linked sources.
4. Your app's privacy manifest (PrivacyInfo.xcprivacy)
Apple: SDKs bring their own privacy manifests, and your app's file "doesn't need to cover data collected by third-party SDKs that your app links to." This file covers your own code: the data from step 3 and the APIs below.
Required-reason APIs your own code uses
App Store Connect refuses apps that use these APIs without a declared reason. Tick only reasons that match what your code does.
File timestamp APIs
creationDate, modificationDate, fileModificationDate, contentModificationDateKey, creationDateKey, getattrlist, getattrlistbulk, fgetattrlist, stat, fstat, fstatat, lstat, getattrlistat
System boot time APIs
systemUptime, mach_absolute_time()
Disk space APIs
volumeAvailableCapacityKey, volumeAvailableCapacityForImportantUsageKey, volumeAvailableCapacityForOpportunisticUsageKey, volumeTotalCapacityKey, systemFreeSize, systemSize, statfs, statvfs, fstatfs, fstatvfs, getattrlist, fgetattrlist, getattrlistat
Active keyboard APIs
activeInputModes
UserDefaults
UserDefaults
Valid by Apple's rules (TN3181). Check it once more with plutil -lint after adding it to Xcode.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>NSPrivacyTracking</key> <false/> <key>NSPrivacyCollectedDataTypes</key> <array> </array> </dict> </plist>
In Xcode, add the file to your app target's resources (Apple: File › New File › App Privacy File creates an empty one).
What each store asks
- Apple asks which data types you and your partners collect, what each is used for, whether it is linked to the user’s identity, and whether it is used for tracking: combined with other companies’ data for targeted ads or ad measurement, or shared with a data broker. Apple’s page
- Google asks which data types are collected and which are shared with third parties, whether each is processed ephemerally, optional or required, and why; then whether all data is encrypted in transit and whether users can ask for deletion. Google’s page
How SDK settings change your answers
- Google Analytics collects a user ID only if you set one; Google signals and Google Ads linking add advertising uses.
- Stripe’s card details count as payment info only when people enter them inside your app; Apple does not count payment info entered in a payment service you never see.
- Meta logs installs, launches and purchases automatically unless you turn automatic event logging off.
- AppsFlyer is a service provider to you, but sending its data to ad networks (postbacks, audiences) counts as sharing on Google Play.
Next
Questions
Do I have to declare data my SDKs collect?
Yes. Apple asks you to identify the data you and your third-party partners collect, and names analytics tools, advertising networks and third-party SDKs as partners. Google says SDK collection counts whether the data goes to you or to a third-party server.
Where do the answers come from?
From each SDK's own privacy manifest (the PrivacyInfo.xcprivacy file it ships for Apple), the vendor's own disclosure pages, and Apple's and Google's definitions. Every answer shows which one, with a link and the date we read it.
Why does an answer say “mapped by us”?
Many vendors list the data their SDK collects but leave the store category to you. Firebase, Google Analytics, Sentry, Meta, Mixpanel and Amplitude do. We map their list with the store's own definition, for example Google's note that a location inferred from an IP address must be disclosed.
What if a vendor's page and its privacy manifest disagree?
We take the more cautious answer and say so. Mixpanel's manifest declares no data while its App Store page lists what it collects by default; Meta's guidance says in-app purchases are logged automatically while its manifest does not list them.
Does my app need its own PrivacyInfo.xcprivacy?
If your own code collects data or uses one of Apple's required-reason APIs (such as UserDefaults or file timestamps), yes: App Store Connect refuses apps that use those APIs without a declared reason. Your SDKs' data belongs in their own manifests; Apple says your app's file doesn't need to cover it. The tool writes the app's file and checks it against Apple's validity rules.
Is this legal advice?
No. It is a starting point you check against your app. You submit the answers, and Apple and Google both say you are responsible for keeping them accurate.