Your App is not compliant

[Clarinda Lephew]

I have received the following and have yet after several attempts to submit and updated policy still rejected. Can someone please be of assistance to the following message?

App Status: Rejected

Your app has been rejected and wasn't published due to the policy issue(s) listed below. If you submitted an update, the previous version of your app is still available on Google Play.

 

Issue found: APK REQUIRES PROMINENT DISCLOSURE​

Your app is not compliant with the User Data policy.

• Your app is uploading users' Contact List information without a prominent disclosure.

As per Google Play’s User Data policy, in cases where your app’s access, collection, use, or sharing of personal and sensitive user data may not be within the reasonable expectation of the user of the product or feature in question, you must provide an in-app disclosure of your data access, collection, use, and sharing and seek affirmative user consent.

Your use case requires a Prominent Disclosure in accordance with this policy.

The in-app Prominent Disclosure:

1. Must comprehensively disclose how your app collects, uses and shares user data.
   • To meet policy requirements, it’s recommended that you reference the following example language format for Prominent Disclosure when it’s required: “[This app] collects/transmits/syncs/stores [type of data] to enable [”feature”], [in what scenario].”
2. Must be within the app itself, displayed in the normal usage of the app and not require the user to navigate into a menu or settings.
3. Cannot only be placed in a privacy policy or terms of service.
4. Cannot be included with other disclosures unrelated to personal and sensitive user data collection.

Requests for user consent:

1. Must be clear and unambiguous.
2. Must require affirmative user action (for example, tap to accept, tick a check-box).
3. Must not interpret navigation away from the disclosure (including tapping away or pressing the back or home button) as consent.
4. Must not use auto-dismissing or expiring messages as a means of obtaining user consent.
5. Must be granted by the user before your app can begin to collect or access the personal and sensitive user data.

Issue details

We found an issue in the following area(s):

• Version code 1713805071

About the User Data policy

You must be transparent in how you handle user data (for example, information collected from or about a user, including device information). That means disclosing the access, collection, use, handling, and sharing of user data from your app, and limiting the use of the data to the policy compliant purposes disclosed.

 

Issue found: APP HAS A PRIVACY POLICY​ IN PLAY DEVELOPER CONSOLE BUT IT IS NOT ADEQUATE

Your app is not compliant with the User Data policy. Specifically,

• Your app is uploading users' Contact List information without posting an adequate privacy policy in the designated field in Play Developer Console.
• Privacy Policy link provided in the designated field in Play Developer Console does not direct to the Privacy Policy page.

Issue details

We found an issue in the following area(s):

• Version code 1713805071

About the User Data policy

You must be transparent in how you handle user data (for example, information collected from or about a user, including device information). That means disclosing the access, collection, use, handling, and sharing of user data from your app, and limiting the use of the data to the policy compliant purposes disclosed.

Action required: Submit an updated app for review

Here's what to do to help get your app on Google Play:

1. Make sure to read the applicable policies or requirements listed below:
   • User Data policy
2. Make appropriate changes to your app (if possible), and be sure to address the issue described above. You may also want to check your app's store listing for compliance, if applicable.
3. Address the issue mentioned above, deactivate the non-compliant version and upload a compliant version with an incremented version code.
   • In addition to your Production release, if you have other release types that you use for testing and/or quality assurance checks (for example, Internal test, Closed, Open), please make required changes and update those tracks as well.
   • Make sure that the non-compliant version is under the “Not included” section of the release.
4. Double check that your app is compliant with all other Developer Program Policies.
5. If you made changes to your app bundle, store listing, or APK, please sign in to your Play Console and submit the update(s).

Thanks

Clarinda

[Tony G]

> I have received the following and have yet after several attempts to

> submit and updated policy still rejected.

> Can someone please be of assistance to the following message?

The issues that Google cites are clear.

1. Your app is uploading users' Contact List information without a prominent disclosure.

1. Your app is uploading users' Contact List information without posting an adequate privacy policy in the designated field in Play Developer Console.
2. Privacy Policy link provided in the designated field in Play Developer Console does not direct to the Privacy Policy page.

You are only telling us one side of the equation. In this forum we know nothing about your app.

1. Do you in-fact access Contacts?
2. Do you in-fact save that data somewhere?
3. What exactly do you say in your Google Play app information about Contacts and privacy?
4. What exactly do you say in-app about this topic?

I'm sure that if you post that information that we will see a discrepancy between what prospects and users are being told, and what they must be told according to policy and best practices.

I'm guessing that if you start to respond to this that you will see for yourself how your policy statements (and link) are not adequate.

Get some help to craft a better policy statement. Ask someone who natively speaks English to help. Ask ChatGPT for help.

I hope that helps.

-- Tony (aka CaptainStarbuck)

[Clarinda Lephew]

Thank you for your reply. The app is for mobile banking. I also use it for my personal bank accounts as well. If it does access contacts, I do not know how or when or why. i have not seen any evidence of this. Our core is the one who configured the app, we the bank did not.  We do have a privacy policy that is the normal standard language that most banks use. The only data we would store is what is necessary for banking, such as deposits, transfers, loan payments and such. The only pop up that I ever see when accessing the app it about using my location. 

[Dave]

You are probably using this code or similar somewhere in the app somewhere - 

    var uri = "content://com.android.contacts/data";
    var columns = "display_name,data1";
    var select = "mimetype='vnd.android.cursor.item/phone_v2'";
    var rows = app.QueryContent( uri, columns, select, null, "display_name" );

Find this code and remove it... or if you have a legitimate reason to upload people's contacts, then explain clearly in your privacy policy and show a yes/no popup when you start the app to explain to the user why you are uploading their contacts and allow them to accept it (or not).  I would recommend that you don't upload people's contacts unless you have a VERY good reason for it as it is a serious privacy concern and the type of thing that malware apps do.

[Alan Hendry]

HI,

Droidscript reads your code looking for 

app.CreateContacts, "content://com.android.contacts",

app.GetUser, app.GetAccounts 

and adds Contacts as a required permission

Regards, ah