LaunchLint Academy
The short answer
- The Data safety form explains which user data the published app collects or shares, why it is used, and which security and deletion practices apply. Even apps that collect no data must complete the form and link a privacy policy.
- package.json, app configuration, and Android permissions provide useful signals, not a finished declaration. Third-party SDKs, server-side processing, optional consent, and actual runtime transmission still require review.
- Create a record for every SDK and first-party endpoint, classify collected and shared under Google’s definitions, and reconcile Play Console whenever an SDK, purpose, backend, consent flow, or deletion process changes.
1. Which release and data the form covers
Google requires the form for published apps on closed, open, and production tracks; apps exclusively on internal testing are exempt. The declaration applies at package level and should represent actively distributed artifacts. Reviewing only the newest branch is not enough when older active versions contain a different SDK or data flow.
Collection generally means transmitting data off the device to the developer or another party. Processing that stays solely on-device can fall outside the definition. A permission entry therefore does not prove collection, while the absence of sensitive permissions does not prove that telemetry, IP addresses, identifiers, or app interactions are not transmitted.
3. Inventory Expo SDKs and native dependencies
Expo abstracts native projects without removing responsibility for embedded libraries. Analytics, crash, push, authentication, maps, ads, payments, and social login can have their own practices. Review direct dependencies, transitive native components, production configuration, optional modules, and whether an SDK initializes before consent.
Google makes developers responsible for third-party code and recommends understanding every SDK’s data, permissions, and purposes. Provider guidance and the Play SDK Index are starting points; your configuration decides which behavior is active.
{
"sdk": "example-analytics",
"enabledInProduction": true,
"dataTypes": ["Device identifiers", "App interactions"],
"transmittedOffDevice": true,
"purpose": ["Analytics"],
"requiredOrOptional": "optional after consent",
"encryptedInTransit": true,
"deletionPath": "privacy@example.com"
}Repository evidence:
- package.json and lockfile
- app.json or app.config plugins
- Manifest and permission signals
- Initialization and consent gates
- Endpoints, uploads, and first-party telemetry
- Deletion and opt-out flows
- Release-specific environment values
4. Answer purpose, optionality, encryption, and deletion
Choose only purposes actually used in your app, not every capability listed by an SDK vendor. Optional is defensible only when users can meaningfully avoid or disable collection. A toggle shown after an SDK already initialized does not undo the earlier transfer.
Encryption in transit can be declared only when it covers all relevant transmitted user data. Check legacy HTTP endpoints, uploads, WebViews, and SDKs. For deletion, distinguish the account, profile data, backups, legal retention, and copies held by third parties.
- Document purpose per type and recipient
- Test required versus optional in the real consent flow
- Confirm TLS for first- and third-party transfers
- State retention in the privacy policy
- Test in-app and web account deletion
- Explain subscriptions and legally retained records
5. Account deletion is Data safety evidence
If users can create accounts in the app, Google requires both an in-app deletion-request path and a web resource where they can request deletion of the account and associated data. The web URL is entered in Play Console and may be visible publicly; it must lead to a meaningful deletion resource rather than a generic homepage.
Test without a developer session: account identification, confirmation, processing time, status, and incomplete requests. Name any legitimately retained data and duration. Deactivating the profile or uninstalling the app is not an account-deletion request.
6. Validate the declaration against build and runtime
Static analysis prioritizes questions but cannot replace runtime observation. Build the intended production artifact, install it on a fresh device, and exercise first launch, consent, login, the core feature, uploads, purchase, push, and deletion. Record which services initialize and which network destinations appear.
Reconcile each data type across repository signal, observed transfer, backend processing, SDK documentation, privacy policy, and Play Console answer. Do not guess ambiguous cases; ask the SDK provider or backend owner and preserve the decision record.
Release gate:
- Production SDK inventory frozen
- Consent tested before optional SDK initialization
- Types and purposes reconciled
- Sharing exceptions documented
- Encryption and deletion tested
- Privacy policy updated
- Draft form peer-reviewed
- Owner and review date recorded
7. Maintain Data safety with every relevant release
Data safety is not a one-time launch document. New analytics, another auth provider, an ads SDK, additional uploads, or a changed backend purpose can alter the answers. Put the review in the definition of done and release checklist before broad rollout.
LaunchLint can find SDKs, plugins, permissions, endpoints, and deletion signals with file evidence, but it never executes user code or observes real transmissions. The Full Repo Scanner turns those signals into targeted questions and fix tasks; the final declaration still requires repository, runtime, backend, and store knowledge.
Frequently asked questions
Must an Expo app with no first-party collection complete Data safety?
Yes when published on relevant Play tracks. Apps declaring no collection still complete the form and link a privacy policy, and must verify that embedded SDKs do not transmit data.
Can package.json generate the form automatically?
No. Dependencies provide signals but do not know every runtime option, backend, purpose, consent rule, retention period, or deletion path.
Is transfer to a service provider always sharing?
Not necessarily. Google documents exceptions, including some service-provider relationships. Applicability depends on the actual purpose and relationship and should be documented.
When should the form be updated?
Whenever data types, purposes, recipients, SDKs, consent, security, or deletion practices change. Review it with every relevant release.