What the Data safety section is
Since 2022, every app on Google Play shows a "Data safety" card on its listing: what it collects, what it shares, and whether the data is encrypted and deletable. The developer fills it in through a form in Play Console, and the answers are a policy commitment — declaring less than the app does is a listing violation, and reviewers compare the form with the privacy policy and with the SDKs and permissions found in the APK.
The form was written for native apps with SDKs. For an HTML app in a WebView the honest answers are usually simple, but the questions do not make them obvious. This helper translates.
The three cases
| Your app | Collects? | What to declare |
|---|---|---|
| Bundled HTML, no network, data in localStorage | No | Nothing. On-device storage is not collection. The form ends after the first question. |
| Live URL of your own site, no analytics or accounts | No (usually) | Ordinary server logs used for operation are exempt. Declare them if you use them for anything else. |
| Anything with analytics, ads, sign-in, uploads or push | Yes | Each SDK's data types, marked as shared where the SDK sends data to its own servers. The helper lists them. |
Collected versus shared
Google's definitions are specific. Collected means data leaves the device and reaches you or a service you use. Shared means it is passed to a third party — and an analytics or advertising SDK phoning its own servers is a third party, even though you added it. So a Firebase Analytics tag makes "App interactions" both collected and shared. Data that only reaches your own server is collected but not shared. Data that never leaves the phone is neither.
After the form
Play generates the public card from your answers. Keep three things in sync when the app changes: the form, the privacy policy, and the permissions you switch on in the builder. Adding push notifications later, for instance, adds a push token to all three.