App privacy

Apple requires every app to disclose what data it collects through privacy "nutrition labels." You fill these out in App Store Connect before your first submission.

#Where to find it

1. Go to appstoreconnect.apple.com and open your app.
2. Click App Privacy in the left sidebar.
3. Click Get Started or Edit next to Data Collection.

Apple will walk you through a series of questions about the data your app collects. Answer based on what your Rails app actually stores, not what iOS frameworks are capable of.

#Data types for a typical Rails app

Most Rails apps with user accounts collect a few standard data types. Here's what to declare and how to categorize each one.

#Contact info (email address)

Almost every Rails app collects an email address for authentication.

• Data type: Contact Info > Email Address
• Purpose: App Functionality
• Linked to identity: Yes

#Identifiers (user ID)

If your app has user accounts, you store some form of user ID.

• Data type: Identifiers > User ID
• Purpose: App Functionality
• Linked to identity: Yes

#Name (if collected)

Only declare this if your app collects the user's name during signup or in a profile.

• Data type: Contact Info > Name
• Purpose: App Functionality
• Linked to identity: Yes

#Usage data (analytics)

If your app records how users interact with it, declare it. This includes server-side analytics like page views, feature usage, or event tracking. See the next section for details.

• Data type: Usage Data > Product Interaction
• Purpose: Analytics
• Linked to identity: Depends on your setup (see below)

#What most Rails apps don't need to declare

Unless your app specifically collects these, skip them:

• Location data
• Health and fitness data
• Financial information
• Browsing history
• Contacts or address book
• Photos or videos (unless your app uploads them)

#Analytics and tracking

Apple's definitions here are specific and worth understanding.

"Collect" means data transmitted off the device and stored. Server-side analytics count if the data is retained, which it almost always is. If your Rails app logs page views, tracks events, or stores any usage metrics, you need to declare "Product Interaction" under Usage Data.

"Tracking" is narrower than you'd think. Apple defines tracking as linking user or device data with third-party data for targeted advertising or sharing with data brokers. Standard first-party analytics, where you record how users interact with your own app, are categorized as "analytics," not "tracking."

Ruby Native's MAU tracking uses anonymous device fingerprints to count monthly active users. This needs to be declared as Usage Data > Product Interaction, with the purpose set to Analytics and not linked to identity.

If you use third-party analytics like Google Analytics, Mixpanel, or Amplitude, check their documentation for additional data types you may need to declare.

#Privacy policy

Every app needs a privacy policy URL in App Store Connect. Add it under App Information > Privacy Policy URL. Your existing website privacy policy usually works. Just make sure it mentions the iOS app and covers push notification device tokens if you use them.

Your next step is to submit your app.