Skip to content

ADR-0035: Public privacy policy for Play distribution

Context

AutoBudget requests sensitive permissions (notification listener access, precise device location, and — after opt-in — background location), so Google Play requires a privacy policy linked on the store listing and within the app that comprehensively discloses how the app collects, uses, and shares user data (Play Console "Prepare your app for review" / User data policy).

The previous docs/PLAY_POLICY.md held an internal ops document with a short embedded privacy "template" — not a standalone public policy on an active URL, and nothing linkable in-app.

Decision

  • Publish a standalone public policy at https://autobudget.zharif.my/privacy/ (built by the Zensical docs site and served by Cloudflare Pages), authored as docs/privacy.md in this repo. It covers what the app collects (notification text, optional location, attachments, user entries), that nothing is collected/uploaded/shared, how data is protected (SQLCipher + Keystore, allowBackup=false, app lock, masking), retention/on-device deletion, children, international transfer, and a contact address.
  • Link the policy inside the app: Settings → About gains a Privacy policy link (via BuildConfig.PRIVACY_POLICY_URL, defaulting to the public URL, overridable with -PprivacyPolicyUrl=). Opening the URL is delegated to the browser through LocalUriHandler, so no INTERNET permission is added and ADR-0015's offline-first claim is unchanged.
  • Keep docs/PLAY_POLICY.md as the internal Play-Console workbook (Data Safety form answers, sensitive-permission declarations, review strategy) and have it point to the public policy rather than embedding a template.
  • Play Console must set the store-listing "Privacy Policy" URL to https://autobudget.zharif.my/privacy/ and the Data Safety disclosure must stay consistent with docs/privacy.md.

Consequences

  • AutoBudget now meets Google Play's policy-link requirement for sensitive-permission apps, with the policy versioned in-repo and republished automatically with the docs site.
  • The in-app link adds no permissions and no network SDK; it just hands the URL to the OS browser.
  • The policy is an end-user-facing legal text: changes to data handling must keep docs/privacy.md, docs/PLAY_POLICY.md, the in-app link target, and the Play Data Safety form consistent.
  • The developer name/contact ("zharif zakaria", app-dev@zharif.my) and the "Last updated" date in docs/privacy.md must be kept current before any public release.

Rejected alternatives

  • No internal link, Play-listing link only — fails Play's requirement that sensitive-permission apps also link the policy within the app.
  • Host the policy off-repo (e.g. a third-party policy generator page) — loses in-repo versioning and the single-source-of-truth docs site; also harder to keep in sync with the app and the Data Safety form.