Privacy Policy for Apps that do not collect datas

Question

I am currently in the process of bringing an app to the iOS app store. It's just a small app I made in my free time. It is workout-related, so the app requires access to location and health data from the user. The data, however, is only stored on user devices. My app does not send this data anywhere (except for iCloud sync), no login is required, and I also do not implement any tracking frameworks except for the built-in Apple one that you have to agree to when setting up iOS.

Now the app store requires me to link to a privacy policy (probably because health data is potentially sensitive information). I searched for privacy policy generators online, but all I could find just seem to assume that you collect personal data. They include statements such as:

We collect several different types of information for various purposes to provide and improve our Service to you.

or

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

I am afraid this might confuse users, since I explicitly state on my app store description that the data is not stored on my servers. Should I keep this in the policy nonetheless to be on the safe side legally? Or can anyone point me into the right direction what I need to include in my policy if I actually do not collect personal user data?

Layne

Answer 1

You collect + use personal data (location data + health data) in your app, regardless of the method of storage: on your own servers, locally on user's device, and so on. The only difference is that you do not send the collected data anywhere else (except iCloud sync).

If you don't use the collected data, simply disclose it in your Privacy Policy. Disclose that the data you collect is not store outside the user's device (except for iCloud).

Ecquire has an example of Privacy Policy for "no collection of data":

Continent

From my understanding data privacy is to be respected when collecting, using, storing or transferring personal data. So that example of a privacy policy is only reflecting storing the data. But that is simply not sufficient. They will still collect & use it (or why should they collect it then?) and might also transfer it - who knows? I wouldn't use that as an example. This might leave people with the understanding, it would be enough and they just simply need to adapt it. Not sure about that. – Rollins

I don't feel that the above answer is sufficient for an app, because while you aren't collecting personal data yourself, you are still getting analytics data from Apple in App Connect. Some of the things you have access to are: crash reports, daily sessions, uninstall events, installs by region, etc. While the data isn't personal, it is still data that is collected and stored on a server that you have access to. I personally wouldn't use the accepted answer as my privacy policy in an iOS app. – Celebes

@PaulSchorey would be cool if you provide something better then. – Sharpe

@PaulSchorey if it's already in Google Play's policies which the users have already agreed to, shouldn't stating it be unnecessary? – Slob