Data collected on devices.
WHAT APPLICATIONS CAN ACCESS
Location Contacts Camera and microphone Storage Device identifiers Usage patterns
WHAT TO REQUEST
Only permissions the application actually needs.
WHY
Excessive requests reduce installation and increase scrutiny.
WHEN TO REQUEST THEM
At the moment they are needed, with an explanation.
WHY NOT AT INSTALLATION
Context makes the request understandable and more likely to be granted.
WHAT TO NEVER DO
Collect contacts or location without a clear purpose Continue collecting in the background without disclosure
WHAT TO DISCLOSE
What is collected, why, and with whom it is shared.
WHERE
In the store listing, and in the application.
WHAT THIRD-PARTY COMPONENTS DO
Collect data you may not know about.
WHY THAT MATTERS
You remain responsible for it.
WHAT TO AUDIT
Every library and service in the application, and what it sends.
HOW
Inspect the network traffic the application generates.
WHAT TO CHECK
Whether analytics or advertising components transmit identifiers.
WHAT TO PROVIDE
A way to delete the account and data from within the application.
WHY
Stores increasingly require it, and it is the right thing.
WHAT TO TEST
That deletion actually removes the data.
