vjrj
fd6b9d5f0d
- fastlane: Appfile/Fastfile/Gemfile with deploy_play lane (AAB -> Play internal track) - CI: tag-gated build:android (signed AAB/APK from CI secrets) + deploy:play jobs - F-Droid: fdroiddata build recipe at docs/fdroid/org.comunes.tane.yml - Play compliance: Data Safety / content-rating answer sheet (docs/legal/internal) - docs/release.md: automated tag-triggered flow, dedicated tane-upload keystore - pubspec: description now mentions the market, not just the inventory
84 lines
4.9 KiB
Markdown
84 lines
4.9 KiB
Markdown
# Google Play compliance answer sheet (internal)
|
||
|
||
Draft answers for the Play Console questionnaires. Transcribe into the console;
|
||
this file is the single source of truth so the answers stay consistent across
|
||
releases. Grounded in [`../privacy-policy.md`](../privacy-policy.md) and
|
||
[`../../design/security-privacy.md`](../../design/security-privacy.md).
|
||
|
||
Package: `org.comunes.tane` · Publisher: Asociación Comunes · Contact: info@comunes.org
|
||
Privacy policy URL: https://tane.comunes.org/legal/privacy
|
||
|
||
---
|
||
|
||
## 1. Data Safety form
|
||
|
||
**Core principle:** Tane has **no accounts and no Tane server**. Anything a user
|
||
records stays on-device, encrypted (SQLCipher). Data only leaves the device by an
|
||
explicit user action (publishing an offer, filling a public profile, sending a
|
||
message, or syncing to the user's own second device), and then it travels through
|
||
community-run relays, not through us. So under Play's definitions we *collect*
|
||
nothing for ourselves; we *share* only the specific things the user chooses to
|
||
publish, all for **App functionality** — never for analytics, ads, or sale.
|
||
|
||
### Does your app collect or share any user data? → **Yes**
|
||
(Because user-initiated publishing sends data to third-party relays.)
|
||
|
||
### Data types — declare as **Shared**, purpose **App functionality**, **optional** (user-initiated)
|
||
|
||
| Play data type | Declare? | Notes |
|
||
|---|---|---|
|
||
| Location → Approximate location | Shared | Only a coarse ~2–80 km area, only if the user sets a sharing zone for an offer. Never precise. Never collected for us. |
|
||
| Personal info → Name | Shared | Only the display name the user chooses to put in a public profile. Optional. |
|
||
| Personal info → Other info (bio) | Shared | Optional public profile bio. |
|
||
| Photos and videos → Photos | Shared | Only photos the user attaches to a public offer or profile. |
|
||
| Messages → Other in-app messages | Shared | Direct messages, **end-to-end encrypted**; relays carry only encrypted envelopes. Declare as shared for transparency; mark encrypted in transit. |
|
||
| App activity / App info & performance | No | No analytics, no crash reporting, no diagnostics sent anywhere. |
|
||
| Financial, Health, Contacts (device), Calendar, Browsing history, Files, Device IDs | No | Not accessed or transmitted. |
|
||
|
||
Note on "Collected vs Shared": Play defines *collection* as leaving the device to
|
||
the developer. We receive nothing, so nothing is "Collected by us." The items above
|
||
are *Shared* (to third-party relays / other users). If the console forces a
|
||
"Collected" tick for a shared type, pair it with the encryption + optional answers below.
|
||
|
||
### Security practices
|
||
- **Is all user data encrypted in transit?** → **Yes.** Relay connections use TLS;
|
||
direct messages are additionally end-to-end encrypted; device-to-device sync is encrypted.
|
||
- **Data stored on device** is encrypted at rest (SQLCipher) — mention in the listing, though Play's form focuses on transit.
|
||
- **Can users request data deletion?** → **Yes.** Everything local can be deleted in-app
|
||
instantly; published offers can be withdrawn, which asks relays to delete. Relays we
|
||
don't operate may retain copies (stated honestly in the privacy policy).
|
||
- **Data is NOT sold.** **Data is NOT used for advertising or marketing.**
|
||
- **Independent security review?** → No (self-declared; source is public/AGPL and auditable).
|
||
|
||
---
|
||
|
||
## 2. Content rating (IARC questionnaire)
|
||
|
||
- Category: **Utility / Reference / Productivity** (not a game).
|
||
- Violence, sexual content, gambling, drugs: **None.**
|
||
- **User-generated content / communication:** **Yes** — the market has public offers,
|
||
user profiles, and direct messaging. Declare in-app UGC and user-to-user communication.
|
||
- Expected outcome: **Everyone / PEGI 3–style**, with the UGC/communication flags set.
|
||
|
||
## 3. Target audience & content
|
||
|
||
- Target age: **not directed at children.** Age band spans adults; the phrase "10–99"
|
||
is a usability aim (simple enough for a 10-year-old, legible for a 99-year-old), **not**
|
||
a claim of child audience. In the console pick the **adult / 18+** or "not for children"
|
||
target so Families policy does not apply to the market/messaging features.
|
||
- The seed **inventory** alone is harmless for any age, but the **market and messaging**
|
||
are social features and are declared not directed at children (see privacy policy §8).
|
||
|
||
## 4. UGC policy (Play's user-generated content requirements)
|
||
|
||
The market ships the mitigations Play looks for; keep them working:
|
||
- **Community rules acceptance** gate on entering the market.
|
||
- **Report** content/users and **block** users, in-app.
|
||
- A stated content policy: [`../community-rules.md`](../community-rules.md).
|
||
|
||
## 5. Ads & privacy
|
||
|
||
- **Contains ads?** → **No.**
|
||
- **Data deletion URL / contact:** info@comunes.org (and in-app deletion).
|
||
- **Government app?** → No. **Financial features?** → No (optional Ğ1 price is a plain
|
||
number shown in a listing, no in-app payments, no Play Billing).
|