Almost nobody qualifies for “Data Not Collected.”

There's a moment in every first submission where the store asks what data your app collects, and a checkbox offers the answer you want to give: none. You never wrote a line of code that uploads anything, so it feels true. Then you remember the crash reporter. The privacy questionnaire isn't asking about your intentions — it's asking about your binary, and your binary includes every SDK you ever added.

Two forms, one question

Apple's version is the App Privacy questionnaire in App Store Connect, required for every new app and update since December 8, 2020. Your answers render as the “nutrition label” on your listing, sorted into three buckets: Data Used to Track You, Data Linked to You, and Data Not Linked to You — or, if you declare nothing at all, the coveted “Data Not Collected” badge.

Google's version is the Data safety form in Play Console, mandatory for every app since July 20, 2022. Even an app that genuinely collects nothing must submit the form saying so — skip it and your updates stop publishing. It asks the same underlying questions with two additions: whether data is encrypted in transit, and whether users can request deletion.

Both forms make one thing your problem that feels like it shouldn't be: you answer for every third-party SDK in the app, not just your own code. Firebase's collection is your collection. The ad network's collection is your collection. “I didn't know the SDK did that” is not a state either store recognizes.

“Collect” doesn't mean what you think it means

Developers read “collect” as “my code sends user data to my server.” The stores define it as any data transmitted off the device and kept beyond what's needed to service the request — by anyone in the binary. Under that definition, the standard indie starter kit is a full page of declarations:

Crash reporting is Diagnostics — crash traces, device model, OS version — plus, in most SDKs, an installation identifier so crashes can be counted per device. Analytics is Usage Data plus Identifiers: screens viewed, taps, session length, tied to an app-instance ID. Sign-in is Contact Info — an email address is personal data everywhere on earth — plus a user ID, which is an Identifier that makes everything attached to it “linked to you.” In-app purchases are Purchase History. None of this ever touches your server, and all of it counts.

Which is why “Data Not Collected” is so rare in practice. It requires that literally nothing phones home: no analytics, no crash reporter, no accounts, no ads, no push. A fully offline utility can honestly claim it. Almost nothing else can.

Your dependency list is the questionnaire

The good news: the form looks like a legal document, but filling it out honestly is a mapping exercise from a file you already have. Open your Podfile.lock, build.gradle, or pubspec.yaml and go dependency by dependency.

Major vendors publish exactly what each SDK collects, for exactly this purpose. Firebase maintains per-product disclosure pages for both stores — Play data disclosure for Android and App Store data collection for iOS — that spell out, product by product, what's collected automatically versus what depends on how you use it. Crashlytics: crash traces and instance identifiers. Analytics: interactions and coarse device data. Auth: email addresses and phone numbers. RevenueCat, Sentry, OneSignal, and every serious ad network publish equivalents.

A useful heuristic falls out of this: if a vendor doesn't document what its SDK collects, assume the worst — and think hard about whether it belongs in your app at all. You're signing your name under its behavior.

The tracking question is the one that bites

Apple's scariest-looking bucket, Data Used to Track You, has a precise meaning: linking data about a user from your app with data from other companies' apps and sites for targeted advertising or ad measurement, or sharing it with a data broker. Analytics you use to improve your own app is not tracking. An ad network SDK serving personalized ads is — and declaring it also obligates you to show the AppTrackingTransparency prompt.

For a typical indie app with Firebase and no ads, the honest answer is boring: some data collected, some linked to identity if you have accounts, nothing used for tracking. Boring is fine. The mismatch reviewers actually act on is the app whose binary contains an ad SDK while its label claims no tracking.

The label stopped being an honor system

For a few years the only check on these forms was your conscience. That's ending. Since May 1, 2024, Apple requires privacy manifests: SDKs on its commonly-used list ship a PrivacyInfo.xcprivacy declaring what they collect, apps must declare approved reasons for touching certain APIs, and App Store Connect rejects uploads with missing declarations — the ITMS-91053 email. Xcode will aggregate every manifest in an archive into a privacy report, which means the gap between what your binary declares and what your label claims is now a document anyone can generate.

Google enforces from the other end: a Data safety form that contradicts observed behavior is a policy violation, and the penalty ladder runs from blocked updates to removal. And all three of your public statements — Apple label, Play Data safety section, privacy policy — sit a click apart. They should read like the same app wrote them, because regulators read them side by side too.

Declare it and move on

The instinct to chase “Data Not Collected” is understandable and mostly wasted. Users are habituated to labels that declare diagnostics and usage data — nearly every app they've ever installed does. An accurate, mildly boring label costs you approximately zero installs. An inaccurate one costs you a rejection at best, a removal at worst, and it's the easiest kind of violation to catch because you published the evidence yourself. ShotCanvas ships with Firebase in the binary and says so on both stores: identifiers, diagnostics, usage data, nothing used for tracking. Honesty is cheap. The alternative isn't.