Google Data Safety

I have some questions about the answers I should give in the new Data safety section in Google Play.

More specifically in relation to Crash Reporting, Analytics and Unity Ads.

If I use those 3 things in my app, what would be the yes/no answers to the following questions:-

Does your app collect or share any of the required user data types?
Is all of the user data collected by your app encrypted in transit?
Do you provide a way for users to request that their data is deleted?

I already know the answer to question 3 is no, as I haven't put anything in my app that does it, but is there anything in place at the Unity end that would facilitate the deletion of individual users data stored by the above 3 services (if any).

Thanks.

 

"Is all of the user data collected by your app encrypted in transit?" I couldn't find the answer to this in any of the above links ?

I assume some of the things Google wants to know, are already answered in http://documentation.cloud.unity3d.com/en/collections/2654776-apple-privacy-surveys - would it be an idea to create a similar resource geared towards the Google Play Data safety section maybe ?

edit:
In my case I can see that my app collects:
Purchase history, Approximate location, Diagnostics, Other performance data, Device or other identifiers.

In all cases Goggle asks the follow up question:

"Is this data collected, shared, or both?
Select all that apply. Some types of data collection and sharing are exempt.
Collected
This data is transmitted off the user's device, either to you (the developer) or a third party. This includes data that is processed ephemerally, or stored for longer.
Shared
This data is transferred to a third party, either on or off the user's device"

From the Apple Nutritional pages I can see that data is collected, but I can't see if it is shared with a third party (or myself for that matter) ?

 

This may help also https://forum.unity.com/threads/google-app-data-security-form.1189495

 

Thank you, so data is encrypted while in transit, and data that is collected will in some (all?) cases also be shared.

Edit: wow.. Google wants much more information than Apple asks for. If I state that Purchase history is both collected and shared, they also want to know:

Is this data processed ephemerally?
Is this data required for your app, or can users choose whether it's collected?
Why is this user data collected?
Why is this user data shared?

Some of this I can probably figure out by reading some of the previous links, but I think it would be extremely useful to a lot of developers if Unity made it as easy to answer these questions, as you did with the questions Apple wanted to know.

 

I agree, I'm still struggling to decide how to answer some of the questions.

Particularly the one Is there a way for users to delete their stored data. I can see how they are given the option to opt out when first shown a Unity ad, but what happens if they initially accept and then later decide to opt out. Is any already stored data deleted automatically at that point?

 

Please see the link I shared above, it describes how users can delete their data at any time with the Data Privacy Button.

 

My apologies, I was of the understanding that the Data Privacy Button couldn't be used if Unity Ads was installed. I'll look into how to implement it.

 

I believe "didn't need to be used" would be more accurate. I have not personally tested with Ads

 

Do we need to add 'Shared' to data collection types such as 'Approximate Location', 'Diagnostics' or 'Device or other identifiers'?

According to Unity's Privacy Policy I would say yes, as it says "Unity has collected some or all of the following information about your device", but I am not sure if it is shared with Unity or just 'sent by' Unity (so just collected for the app's developers?). We develop apps for kids and I wanted to make sure before submitting the info, as each data types we add or say 'shared' could have a critical impact on our downloads.

Thanks!

 

Yes, if you are using Unity ads, then stuff like this

Is sold to Unity partners.

 

Can you provide the source for this, I've been unable to locate it in Unity's privacy policy.

 

https://unity3d.com/legal/do-not-sell-my-personal-information

 

Hello,
I am almost finished with completing my Data Safety Form on Google Play but still have one doubt.
We are using Unity Analitycs and Diagnostics in our games.
Therefore, data we collect is:
Approximate location, Personal identifiers, Device or other identifiers, Purchase history. Page views and taps in app, Crash logs, Diagnostics, Other app performance data.
Thats what I got from Unity "Apple nutritionl labels for Unity Analytics and Crash Diagnostics". All of the data is Collected and Shared, isn't processed ephemerally and is used for the purpose of Analytics.

However, in Unity Privacy Policy (https://unity3d.com/legal/privacy-policy?_ga=2.263732044.1552872805.1643181170-1385320101.1578991247), there is a part "Information that you or others actively provide" and there are data types like Name, Age or date of birth, Gender, Username, Profile photo etc.

Should we somehow include data mentioned in this part of privacy policy in a Data Safety Form? If yes, are they collected and shared as other data is?
Also please correct me if I'm wrong on the data I understood is collected and shared by Analytics and Diagnostics.

Thanks in advance for any responses.

 

i need help too, why unity don't provide us android privacy survey like apple one !

 

This data is not collected unless you are explicitly sending it to us, perhaps in an Analytics custom event. You can confirm exactly what is being sent by using Charles Proxy https://support.unity.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity

 

@JeffDUnity3D could you please help me with google Data Safety im only using unity ads

and why unity don't provide us i guide about the new policy for google android like apple privacy survey
https://unityads.unity3d.com/help/i...46.667277386.1643206122-1275434775.1640287376

i try follow and compare data but its too much and need unity attention

 

I will help as much as I can. It's my understanding we are working on this documentation. The store policies are a moving target, and it's hard to keep up. In the meantime, be sure to read this entire forum thread.

 

This may help https://docs.unity.com/ugs-overview/GoogleDataSafety.html and https://docs.unity.com/ugs-overview/Resources/IAP_Google_data_safety.pdf

 

This is great! Thank you!

 

Hi, just a quick question: am I correct to assume that for Unity Ads under "Is this data required for your app, or can users choose whether it's collected?" I can safely select "Users can choose whether this data is collected"?

 

That is my understanding

 

Thanks for sharing the updated docs.

I have created an OSS documentation for all SDKs here: https://github.com/Privado-Inc/SDK-Privacy-Report

In case you use SDKs other than Unity, do check it out.

 

Thanks so much for putting this together!
Not all hero's wear capes

 

Is this something I can upload on to the google play data safety. I really don't under this stuff. Xbox one (only, still can't figure series x or s) is so much easier. I'm using unity free 2019.4.33f. Also using the unity ads from unity service. My game is free there are no purchases just unity ads. The things Udemy doesn't teach. I did click no in google play data safety however after research if I read it right unity ads do use data. I'm lost.

 

Please describe your issue. Are you trying to submit your app to the Google Play store?

 

Thank you for replying. I took a black tutorial outdated from udemy. Once that was finished I used YouTube videos for unity ads. It brought me to unity dashboard I did the code for the game IDs. Tested my game on phone with unity5 mobile app. Also tested in build on my phone. Played for a few days notice it was making currency in unity dashboard service. Im ready to put my game on google. I did a bunch of question title description age rating even covid question on the google service. I didn't link anything with unity and google service I assume unity ads will do that stuff. Now I'm stuck on the data safety questions. The YouTube video I watch the guy clicked no and went to a site that has a privacy policy so I copied the URL and paste it to the data safety after I clicked no. Something tells me it's the wrong answer. Because of unity ads. I don't know how to complete that question.

 

Yes I'm trying to publish on google play

 

Did you read the documents linked above? They should help. Regardless, answer the questions the best you can to continue.

 

ok thank you

 

Hello!
How Should I fill the Data Safety questions on Google play store if my unity app has no ads, IAP ,Analytics , multiplayer?

Have a great day!

 

Then you should not be collecting any information. Which question are you stuck on?

 

"Does your app collect or share any of the required user data types?"

Should I answer No then?
Thank you!

 

As long as you don't have any other assets that might be sending data then correct, you would say No. One good way to confirm exactly what your app may be sending is by using Charles Proxy or Fiddler to see all the network requests coming from your game when running on a device. https://support.unity.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity

 

Thanks!!! Finally I can answer these Data Safety questions calmly

 

Hello again!
I filled the Data safety for all of my apps (That don't have in them ads, IAP ,Analytics , multiplayer) and one of them got this message:

Issue found: Invalid Data safety section


We reviewed your app's Data safety section in Play Console and found discrepancies between it and how the app collects and shares user data. All apps are required to complete an accurate Data safety section that discloses their data collection and sharing practices - this is a requirement even if your app does not collect any user data.

We detected user data transmitted off device that you have not disclosed in your app's Data safety section as user data collected.

Issue details

We found an issue in the following area(s):

• SPLIT_BUNDLE 3: Policy Declaration - Data Safety Section: Device Or Other IDs Data Type - Device Or Other IDs (some common examples may include Advertising ID, Android ID, IMEI, BSSID)

To clarify, I answered No on the first question ("Does your app collect or share any of the required user data types?") as you told me that I can do.

So why did it happen and how can I fix it?


Have a nice day.

 

What is different about this app vs the others that passed? Did you use Charles Proxy to confirm that nothing is being sent? If so, you can use this capture file in your appeal to Google.

 

There is no different between them. I have 5 apps of this kind: one approved with no problems, this app, and 3 more that yet to be approved.
there is no different between the app that was approved with no problems and this app.

Thank you for replying

 

You might want to mention what you just said in your appeal to Google also But again, be sure first.

 

Hi

I'm currently filling the Data Safety for my last app which has Unity ads, IAP and Google play services (like leaderboards and achievements). I saw that you attached a link to a page which tells how to fill it if you have Ads or so, and I have a question:

What if I have both Ads and IAP? What do I need to fill? for example in the first question on the Data Types section ("Does the SDK collect the user’s approximate location?") the page that shows how to answer if you integrate Unity Ads in your app says to answer Yes, but the page that shows how to answer if you integrate IAP says No. So do i need to fill Yes?

And does Google Play Services impact the way I need to answer those question or do I only need to fill the questions based on the pages that talk about IAP and Unity Ads?

And I also wanted to ask how can I make a good privacy policy for this app, now that to finish the Data Safety you have to add one? I made for my other apps (which don't contain Ads, IAP etc) but I don't know how to make one for this app. paying for a lawyer to make one isn't an option for me..

Thank you very much for replying to my questions it is really helpful!

Have an awesome day

 

We do not capture location. Use Charles Proxy to confirm exactly what your game is sending.

 

Hello!
I listened to your advice and used Charles Proxy. I found out that my app is actually connecting to https://config.uca.cloud.unity3d.com/. I don't know why this is happening. I don't use Analytics. I made this app using Unity 2019.1.10f1 Personal. I also disabled HW statistics. How can I solve it? my app is need to be fixed due to 1 July.

Have a great day!

 

Please share your Charles capture, we should be able to see which service is making the call. Keep in mind that Unity 2019.1 is not supported, and 2019 in general will soon follow.

 

is that okay?

 

No, note the red X's. we would need to see the request contents. And the capture file itself, not a screenshot. Ensure to follow the directions https://support.unity.com/hc/en-us/articles/115002917683-Using-Charles-Proxy-with-Unity . You can also try this code https://docs.unity3d.com/ScriptReference/Analytics.Analytics-enabled.html

 

Im sorry, I don't really understand how to use this program. how can I send the capture file itself? is it in the request tab? by the way I actually did follow the tutorial you mentioned

 

Did you add the charlesproxy. unitypackage to your project? Like most apps, you choose File/Save. Please show a screenshot of your SSL Settings. And/or add the mentioned code, see if it helps.

 

I get this error when trying to upload the actual capture

 

Change the extension. But if it still has the red X's, no need to upload.

 

Hi Guys! I'll hijack this thread a bit: I have dozens of apps that use IAPs, unityads, analytics, chartboost, applovin - what is the safest way of answering these and the next questions?thanks in advance!