Privacy and Security
We’re committed to protecting user privacy and providing a safe and secure environment for our users. Malicious apps that abuse or misuse any network, device, or personal data are strictly prohibited.
Sub Section:
User Data
User Data
You must be transparent in how you handle user data (e.g., information provided by a user, collected about a user, and collected about a user’s use of the app or device), including by disclosing the collection, use, and sharing of the data, and you must limit use of the data to the description in the disclosure. If your app handles personal or sensitive user data, there are additional requirements described below. This policy establishes Google Play’s minimum privacy requirements; you or your app may need to comply with additional restrictions or procedures if required by an applicable law.
expand_more
Personal and Sensitive Information
Privacy Policy & Secure Transmission
If your app handles personal or sensitive user data (including personally identifiable information, financial and payment information, authentication information, phonebook or contact data, microphone and camera sensor data, and sensitive device data) then your app must:
- Post a privacy policy in both the designated field in the Play Console and from within the Play distributed app itself.
- Handle the user data securely, including transmitting it using modern cryptography (for example, over HTTPS).
The privacy policy must, together with any in-app disclosures, comprehensively disclose how your app collects, uses and shares user data, including the types of parties with whom it’s shared.
Prominent Disclosure Requirement
If your app collects and transmits personal or sensitive user data unrelated to functionality described prominently in the app’s listing on Google Play or in the app interface, then prior to the collection and transmission, it must prominently highlight how the user data will be used and have the user provide affirmative consent for such use.
Here are some examples of common violations:
- An app that doesn’t treat a user’s inventory of installed apps as personal or sensitive user data and doesn’t comply with the Privacy Policy, Secure Transmission, and Prominent Disclosure requirements.
- An app that doesn’t treat a user’s phone or contact book data as personal or sensitive user data and doesn’t comply with the Privacy Policy, Secure Transmission, and Prominent Disclosure requirements.
expand_more
EU-U.S. Privacy Shield
Privacy Shield
If you access, use, or process personal information made available by Google that directly or indirectly identifies an individual and that originated in the European Union or Switzerland (“EU Personal Information”), then you must:
- comply with all applicable privacy, data security, and data protection laws, directives, regulations, and rules;
- access, use or process EU Personal Information only for purposes that are consistent with the consent obtained from the individual to whom the EU Personal Information relates;
- implement appropriate organizational and technical measures to protect EU Personal Information against loss, misuse, and unauthorized or unlawful access, disclosure, alteration and destruction; and
- provide the same level of protection as is required by the Privacy Shield Principles.
You must monitor your compliance with these conditions on a regular basis. If, at any time, you cannot meet these conditions (or if there is a significant risk that you will not be able to meet them), you must immediately notify us by email to data-protection-office@google.com and immediately either stop processing EU Personal Information or take reasonable and appropriate steps to restore an adequate level of protection.
expand_more
Additional Requirements
In addition to the requirements above, the table below describes requirements for specific activities.
| Activity | Requirement |
|---|---|
| If your app handles financial or payment information or government identification numbers | Then it must never publicly disclose any personal or sensitive user data related to financial or payment activities or any government identification numbers. |
| If your app handles non-public phonebook or contact information | We don't allow unauthorized publishing or disclosure of people's non-public contacts. |
| If your app contains anti-virus or security functionality, such as anti-virus, anti-malware, or security-related features | Then it must post a privacy policy that, together with any in-app disclosures, explain what user data your app collects and transmits, how it’s used, and the types of parties with whom it’s shared. |