App privacy details (privacy label)

You identify the data you and your third-party partners collect, including the practices of third-party code you integrate. Apple defines "collect" as transmitting data off the device in a way that lets you or partners access it for longer than needed to service the request in real time. Data collected only for app functionality still has to be declared.

For each data type you say whether it is linked to the user's identity. Data is often linked unless you de-identify it before collection, for example by stripping direct identifiers, and you must not try to link it back. You also name the purposes: Third-Party Advertising, Developer's Advertising or Marketing, Analytics, Product Personalization, App Functionality or Other Purposes.

The Privacy Policy link is required and must be a publicly accessible URL. The Privacy Choices link is optional. Guideline 5.1.1(i) also requires the policy link in the app, and the policy must identify what data is collected, how, and all uses, and explain retention and deletion.

You are responsible for keeping answers accurate. You may update them at any time and do not need to submit an app update to do so. That differs from fields tied to a version; see app version.

A hypothetical habit tracker without accounts that only stores data on the device may have little to declare. If it adds an analytics SDK, it must update the label to include the data that SDK collects, because third-party partners' practices count.

• Forgetting third-party SDKs.
• Letting the label drift after adding a feature.

Find the field in App Store Connect, and see how LocalASO handles your data in the privacy docs.