Blocks submissionBoth stores

The privacy policy names what is collected, who processes it, retention, deletion and consent withdrawal

The question Read the privacy policy text against the facts. Does it name every data type the app and its libraries collect, name the processors, state retention periods, describe in-app deletion, and describe how to withdraw consent?

A person or a model answers it from the app's texts and screens; the answer is kept only while the facts it saw are unchanged.

Applies to every app

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• App Review Guidelines: A privacy policy link is required in App Store Connect and inside the app; the policy must say what data is collected, how, and every use; confirm that any third party receiving user data (analytics, ad networks, SDKs, parent or related entities) gives equal protection; and explain retention, deletion, and how to withdraw consent or request deletion. Consent must be obtained for any data collection, even anonymous data; paid features may not depend on granting data access; users need an easy way to withdraw consent; purpose strings must fully describe data use. Collect only data the core function needs, prefer pickers and share sheets, never force or trick consent, and offer alternatives when a permission is declined. If the app has no significant account-based features it must work without login; if it supports account creation it must offer in-app account deletion; personal information may not be required except for core function or by law.
• User Data: Be transparent about all user data handling and comply with applicable privacy law; you are responsible for third-party SDKs and AI integrations in the app. Personal and sensitive data (including device location) must be limited to app functionality the user reasonably expects, transmitted with modern cryptography such as HTTPS, requested via runtime permissions, and never sold. Where collection may not be expected (for example background collection), show a prominent in-app disclosure in the normal flow (not only in a policy, not bundled with unrelated text) describing the data and its use, immediately before any consent or runtime permission request; consent must be a clear affirmative action obtained before collection, and backing out or auto-dismissing messages do not count. If Google asks, you must within 2 weeks show evidence that an SDK collecting data by default meets these rules. Persistent device identifiers may not be linked to other personal data or resettable IDs except for telephony or enterprise device management. Every app needs an accurate Data safety section consistent with its privacy policy, and a privacy policy linked in Play Console and in the app, at a public non-PDF URL, labelled as such, naming the developer or app with a contact, and covering data types, sharing, security, retention and deletion. Apps with account creation must offer account deletion in-app and via a web link entered in Play Console, deleting all associated data (freezing does not count), with any retention disclosed. App Set ID may not be used for ads. EU/UK/Swiss personal data from Google must be handled under the Data Privacy Framework terms, with immediate notice to Google if you cannot comply.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google adds the web-link requirement; Apple adds the ban on call/email/support-only flows and explicitly covers auto-created guest accounts. "Freezing does not count" (Google) equals "deactivating is insufficient" (Apple). partial
• Google's policy is far more detailed (web resource, Data safety deletion questions, TV/Wear/web exemptions, device-management exemption); Apple's 5.1.1 sentence is a pointer to apple.account-deletion. Apple has no exemption for enterprise device-management apps. partial
• Google names transport encryption; Apple says only "appropriate security measures". google-stricter
• Apple requires an on-screen or audible recording indicator; Google requires the disclosure dialog but no live indicator (except for stalkerware under the Malware policy). partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as both.privacy-policy-content and says what to do, who does it, where, and how it knows.