Blocks submissionGoogle Play

What each bundled SDK collects is disclosed as the app's own, and no SDK sells data

The question List the SDKs the binaries show. For each: what does it collect (the iOS privacy manifests say, for the ones that ship them), is that in the Data safety form, and do its terms forbid selling data? Name any SDK whose collection is not disclosed.

A person or a model answers it from the app's texts and screens; the answer is kept only while the facts it saw are unchanged.

Applies to every app

Checked from on a test track, submitted and in review, published

The rule, in our words

• SDK Requirements: The developer is responsible for every SDK's behaviour and permissions. SDK access, use and sharing of user data must be disclosed like the app's own and limited to disclosed, policy-compliant purposes; SDK providers may not sell personal or sensitive data; such data must travel over modern encryption such as HTTPS; runtime permission requests must precede access. If an SDK collects sensitive data by default, evidence that the app meets prominent-disclosure-and-consent requirements must be provided within 2 weeks of Google's request (or any longer period Google gives). Persistent device identifiers may not be linked to other personal data or resettable IDs except for SIM-linked telephony or enterprise device-owner apps. Apps targeting children may only include Families self-certified SDKs. All SDK data collection must appear in the Data safety section, consistent with the privacy policy. SDKs may not download executable code from anywhere other than Google Play, update their own APK, load untrusted content into a JavaScript-enabled webview, download over insecure connections, or use foreground services without a valid use case declared in the manifest. SDKs may not request background location for undisclosed purposes or use review-evasion techniques.
• Provide information for Google Play's Data safety section: Every app published on Google Play (except apps only on the internal testing track) must complete the Data safety form, even if it collects no data, and must have a privacy policy link first. The form must accurately and completely declare, for the app and every SDK or library in it, which data types are collected (sent off device) or shared with third parties, for what purposes, whether each type is optional or required, whether all collected data is encrypted in transit, and whether the developer provides a way to request deletion (or auto-deletes within 90 days). One global form covers every version and region, so anything present in any distributed version must be declared, and a data type is "required" if any version requires it. The declarations must stay accurate at all times; misrepresentation can lead to blocked updates or removal.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google permits any SDK that is self-certified; Apple's default is exclusion with narrow exceptions. partial
• Google requires a public declaration of in-transit encryption; Apple requires protection but no declaration. partial
• none on principle; Google states the rule specifically for SDKs and adds insecure-connection and foreground-service bans. same
• Google's disclosure is a structured form covering the app and every SDK (collected vs shared, purposes, optional vs required, encryption, deletion path or 90-day auto-delete) that must precede publishing on any track except internal testing; Apple's is a free-form policy (the structured equivalent is apple.hig.privacy / apple.privacy-manifest). partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as google.sdk-data-disclosed and says what to do, who does it, where, and how it knows.