Likely to be questionedGoogle Play

Personal data does not travel over plain HTTP

What is checked This rule is decided by code from the built app and the listing: android.built.manifest.

Applies to every app

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• SDK Requirements: The developer is responsible for every SDK's behaviour and permissions. SDK access, use and sharing of user data must be disclosed like the app's own and limited to disclosed, policy-compliant purposes; SDK providers may not sell personal or sensitive data; such data must travel over modern encryption such as HTTPS; runtime permission requests must precede access. If an SDK collects sensitive data by default, evidence that the app meets prominent-disclosure-and-consent requirements must be provided within 2 weeks of Google's request (or any longer period Google gives). Persistent device identifiers may not be linked to other personal data or resettable IDs except for SIM-linked telephony or enterprise device-owner apps. Apps targeting children may only include Families self-certified SDKs. All SDK data collection must appear in the Data safety section, consistent with the privacy policy. SDKs may not download executable code from anywhere other than Google Play, update their own APK, load untrusted content into a JavaScript-enabled webview, download over insecure connections, or use foreground services without a valid use case declared in the manifest. SDKs may not request background location for undisclosed purposes or use review-evasion techniques.
• Mobile Unwanted Software: Software should deliver what it promises, disclose all its principal functions, explain any system changes and disclose any bundled software, and let users review and approve significant installation options. It should not misrepresent the device's state (fake infection or security warnings); it must not generate invalid ad traffic, impersonate another developer, company or app, or imply an affiliation it lacks. Personal data must be handled transparently, under the User Data policies, and over secure transport such as HTTPS. Apps must not ask or trick users into turning off device protections like Google Play Protect, must not trick users into installing them, should not interfere with other apps or device usability, should make uninstall clear, must not show ads that disrupt device use or appear outside the app without consent and attribution, should not mimic OS or other-app prompts, and must not suppress OS or other-app alerts.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google's clause is specific to fake security/infection warnings; Apple's covers any false device data. partial
• Google permits any SDK that is self-certified; Apple's default is exclusion with narrow exceptions. partial
• none on principle; Google names Play Protect specifically. same
• none on principle; Google states the rule specifically for SDKs and adds insecure-connection and foreground-service bans. same

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as google.no-cleartext-traffic and says what to do, who does it, where, and how it knows.