Data safety

Google requires every app to disclose what data it collects and how it's handled through the Data safety form. You fill this out in Play Console before promoting a build to production.

#Where to find it

1. Go to play.google.com/console and open your app.
2. In the left sidebar, open Policy and programs then App content.
3. Find the Data safety card and click Start or Manage.

Play Console walks you through a series of questions about what data your app collects, how it's used, and who it's shared with. Answer based on what your Rails app actually stores, not what Android frameworks are capable of.

#Data types for a typical Rails app

Most Rails apps with user accounts collect a few standard data types. Here's what to declare and how to categorize each one.

#Personal info (email address)

Almost every Rails app collects an email address for authentication.

• Category: Personal info
• Data type: Email address
• Collected: Yes
• Shared: No (unless you send it to a third party)
• Optional: No
• Purposes: Account management

#Personal info (user ID)

If your app has user accounts, you store some form of user ID.

• Category: Personal info
• Data type: User IDs
• Collected: Yes
• Shared: No
• Optional: No
• Purposes: Account management

#Personal info (name)

Only declare this if your app collects the user's name during signup or in a profile.

• Category: Personal info
• Data type: Name
• Collected: Yes
• Shared: No
• Optional: Depends on your signup flow
• Purposes: Account management

#App activity (analytics)

If your app records how users interact with it, declare it. This includes server-side analytics like page views, feature usage, or event tracking.

• Category: App activity
• Data type: App interactions
• Collected: Yes
• Shared: Only if you send it to a third party
• Optional: No
• Purposes: Analytics

#What most Rails apps don't need to declare

Unless your app specifically collects these, skip them:

• Location
• Health and fitness
• Financial info
• Web browsing history
• Contacts
• Photos and videos (unless your app uploads them)
• Audio files
• Files and docs

#Data collection vs sharing

Google draws a sharp line between these two and the form asks about each separately.

Collection means your app sends data off the device to a server you control. Storing user records in your Rails database counts as collection. Almost every Rails app collects email and user IDs.

Sharing means transferring data to a third party. Sending data to your own server is not sharing. Sending it to Mixpanel, Google Analytics, Stripe, or any other vendor is. Be honest here, Play reviewers cross-check declarations against the SDKs in your AAB.

#Security practices

Play Console also asks about how you handle the data once you've collected it.

• Data is encrypted in transit. Yes if your app uses HTTPS, which it almost certainly does. Ruby Native apps enforce HTTPS by default in production.
• You provide a way for users to request data deletion. Yes if your app has an account-delete flow or you handle requests via email. Google strongly recommends an in-app option.
• Committed to Play's Families Policy. Only if your app is designed for or appeals to children. Most B2B and prosumer apps answer no.

#Privacy policy

Every app needs a privacy policy URL in Play Console. Add it under App content then Privacy Policy. Your existing website privacy policy usually works. Just make sure it mentions the Android app and covers push notification device tokens if you use them.

#Keeping the declaration up to date

The Data safety form is not a one-time thing. Any time you add a new data type (location, contacts, etc.) or a new third-party SDK (analytics, crash reporting, etc.), update the form before your next production release. Play can reject releases that don't match the declared data practices.

Your next step is to submit your app.