The data safety form is one of the most misunderstood parts of Google Play. It looks like a compliance checkbox. It is actually a public statement about what your app does with user data.
If the form says one thing and the app does another, that is a policy problem.
What the form covers
Google Play asks about:
- what data your app collects or shares;
- whether the data is required or optional;
- why the data is collected;
- whether it is encrypted in transit;
- whether users can request deletion;
- whether the data is shared with third parties;
- whether the app follows the Families policy.
The exact questions can change. Answer for the current version of your app and its SDKs.
Who counts as “collecting” data?
Collection includes data transmitted off the device, not just data stored locally. Third-party SDKs count too. Analytics, crash reporting, ads, authentication, and push notifications can all involve data collection.
A common mistake is to describe only your own code and forget the SDKs.
How to answer accurately
Inventory your data
List:
- account information (name, email, user ID);
- contact information;
- location;
- financial information;
- health and fitness;
- messages;
- photos and videos;
- audio;
- files and documents;
- calendar;
- contacts;
- app activity;
- app information and performance;
- device or other IDs.
Then map each item to where it goes.
Check your SDKs
Read the privacy documentation for every SDK. Analytics and ads SDKs often collect device identifiers, approximate location, or app activity.
Match your privacy policy
Your privacy policy and data safety answers should tell the same story. If the policy says you do not collect data but the app has an analytics SDK, fix one of them.
Be specific about sharing
If data is sent to a third-party service, that may count as sharing. Do not mark “no sharing” just because you do not sell data.
Encryption in transit
If data is sent over HTTPS, it is generally encrypted in transit. If you use a custom protocol or send data in the clear, review it.
Deletion requests
If users can create an account, Google may require a way to request deletion. Provide a clear path and make sure it works.
What happens if the form is wrong?
Google can reject the app, request changes, or take policy action. The form is public. A mismatch can also undermine user trust.
A practical workflow
- List every SDK and data flow.
- Ask each SDK vendor what they collect.
- Write the privacy policy.
- Complete the data safety form.
- Test the app with a fresh account.
- Review the form again before every major release.
Do not copy another app's answers
It is tempting to copy a similar app's data safety form. Do not. Your SDKs, account system, and data flows are different.
The short version
- The data safety form is a public statement.
- Include third-party SDKs.
- Match the form to the app and the privacy policy.
- Provide a real deletion path if required.
- Review it whenever the app changes.
Next: content rating questionnaire or privacy policy requirements.
Our team’s note
If this answered the question but your situation still feels messy, send us the screenshot or the rejection email. Some things are easier to solve in a two-minute conversation than another article.