CRT
25bc761a53
- New: review-rejections, portfolio-originality, release-management, store-preflight, privacy-manifest, export-compliance, aso-basics, whats-new - Updated: explicit build numbers, first availability UI fallback, phased + manual release by default, IAP versions in review submissions (API 4.4.1, reported, verify), IAP description 45, privacy manifest cross-links, tool-neutral CLI instructions - docs/agents-core.md: shared rules for every agent
44 lines
3.7 KiB
Markdown
44 lines
3.7 KiB
Markdown
---
|
|
name: store-declarations
|
|
description: Answer the store compliance forms for a mobile game - Google Play Data safety (API CSV), App content declarations (ads, app access, content rating IARC, target audience, advertising ID, government/financial/health/news), App Store App Privacy nutrition labels, age rating, export compliance. Use when the user fills in data safety, privacy labels, content rating, target audience, ads or advertising ID declarations, or gets Data safety CSV import errors.
|
|
---
|
|
|
|
# Store declarations
|
|
|
|
Templates: `store/declarations.md` (Play App content + IARC answers), `store/app-privacy.md` (Apple labels), both
|
|
from `storebound init`. Data safety answers live in `dataSafety` of `storebound.config.ts`.
|
|
CLI: `storebound` (or `bunx storebound` in a project that has it, or `bun <toolchain>/cli/index.ts`).
|
|
|
|
## Order
|
|
1. **Inventory first.** List every SDK and server call: what leaves the device, who receives it, can the player turn
|
|
it off. The privacy policy (`privacy-policy` skill) must say the same; update it before the forms.
|
|
2. **Play Data safety (API).** Fill `dataSafety` (types not listed = not collected; `shared` = third party that is not
|
|
your service provider, e.g. ad networks; analytics vendors acting as processors are "collected" only).
|
|
`storebound play data-safety --dry --csv store/data-safety.csv` to review, then `storebound play data-safety`.
|
|
Then check the summary in Play Console > Policy and programs > App content > Data safety.
|
|
3. **Play App content (UI).** Policy and programs > App content, each card with `store/declarations.md`:
|
|
privacy policy, app access, ads, content rating (IARC questionnaire), target audience and content, news, COVID-19,
|
|
data safety, government apps, financial features, health, advertising ID.
|
|
4. **Apple age rating (API).** `storebound apple appinfo` (all NONE except your overrides, e.g. `advertising: true`).
|
|
5. **Apple App Privacy (UI only).** App Store Connect > the app > App Privacy > Get Started / Edit, from
|
|
`store/app-privacy.md`; per data type: purposes > linked to identity > used for tracking. Then **Publish**.
|
|
6. **Export compliance.** `export-compliance` skill (`ITSAppUsesNonExemptEncryption` in Info.plist, `apple encryption`).
|
|
7. **Privacy manifest (iOS).** `privacy-manifest` skill; keep it consistent with App Privacy.
|
|
|
|
## Typical F2P game with ads + IAP (no accounts)
|
|
Data safety: approximate location (IP country; shared, analytics + ads + fraud), app interactions (shared, analytics +
|
|
ads), other app activity (save backup, functionality), diagnostics (shared), device or other IDs (shared, ad id),
|
|
purchase history (if your server checks receipts). Encrypted in transit: yes. Deletion: yes, by email. Account
|
|
creation: none. IARC: everything No except digital purchases Yes; target audience 13+; ads Yes; advertising ID yes
|
|
(advertising, analytics, fraud prevention); sign-in details: no login needed.
|
|
|
|
## Gotchas
|
|
- The Data safety CSV import **replaces** the whole form.
|
|
- `PSL_SUPPORTED_ACCOUNT_CREATION_METHODS` (e.g. `PSL_ACM_NONE`) is required even though Google's older sample CSV
|
|
omits it: without it the import fails with "Response missing". storebound always writes it.
|
|
- "Optional" data is only allowed when the user can really choose for that data; otherwise required.
|
|
- Ads SDKs: read each network's own Play data safety guidance; adding a network can add data types.
|
|
- Target audience under 13 pulls the app into the Families policy (certified ad networks, no ad id): only if true.
|
|
- Apple: "linked to the user" is No when there are no accounts and nothing ties data to a name / email / phone.
|
|
- App Privacy saved but not published = not submitted.
|
|
- Keep store answers, the privacy policy and the in-app privacy settings consistent; reviewers compare them.
|