# Google Play Data Safety Evidence Worksheet

## Status and use

This is an evidence worksheet, not a declaration that Play Console has been updated. Every answer is
an assessment to confirm against the final signed AAB or other release artifact, its merged manifest,
the release runtime dependency report, current SDK disclosures, and the exact Play Console questions.
If the final artifact or provider guidance differs, update this worksheet and the public privacy source
before submitting. Effective policy date: 2026-08-02.

## Proposed Console answers

| Play Data Safety question | Proposed answer | Implemented evidence and qualification |
| --- | --- | --- |
| Does the app collect or share required user data types? | Yes — assess Purchase history plus Device or other IDs, App info and performance, and diagnostics | Pro verification sends a Play purchase token off-device; ML Kit may send metrics described below. Confirm final SDK behavior and Play's current taxonomy. |
| Is all collected user data encrypted in transit? | Yes | App-to-verifier routes use HTTPS; remote app traffic uses the user's encrypted Tailscale connection; ML Kit states its metrics use HTTPS. Confirm the final endpoints and network-security configuration. |
| Can users request deletion? | Yes | Local reset controls remove scoped app data. Requests concerning the minimal server purchase record go to coderemote@makecdev.com; anti-reuse or legally required records may remain for the stated period. The app creates no MakeCdev membership account. |
| Is data sold? | No | The Developer does not sell personal or purchase data. |
| Is data used for advertising? | No | The Developer operates no advertising, cross-app tracking, or first-party ad profile. Included ML Kit metrics are assessed for diagnostics and usage analytics, not advertising. |
| Is data shared? | Assess as no under the service-provider exception | Google Play and Google Cloud process purchase verification on the Developer's behalf, while ML Kit sends its own disclosed metrics to Google. Reconfirm Google's current definition, every SDK term, and the final artifact before selecting this answer. |

Developer-processed data is not sold, and no advertising purpose is used.

## Data-type evidence

| Data type | Collected / shared assessment | Purpose | Processing, retention, and deletion |
| --- | --- | --- | --- |
| Purchase history | Collected; sharing assessment requires final Console confirmation | App functionality (activate or restore Pro) and fraud prevention / security | The Android app sends the raw purchase token transiently over HTTPS for verification. The raw token is not stored. Firestore retains a SHA-256 token hash, product ID, purchase state, verification timestamps, and invalidation data. An active purchase record remains while the purchase is valid; an invalidated record remains 180 days after invalidation and is then deleted unless law requires otherwise. Deletion requests: coderemote@makecdev.com. |
| Device or other IDs | Collected assessment | App functionality, fraud prevention / security, and diagnostics | The verifier receives an installation public-key thumbprint to bind the entitlement. ML Kit may collect device or installation-scoped identifiers. The entitlement binding remains while needed for the purchase; ML Kit retention follows Google's applicable terms and must be reconfirmed. |
| App info and performance | Collected assessment through ML Kit | Diagnostics and usage analytics | ML Kit may send device and app information, performance metrics, API configuration, input/output sizes, feature versions, and event types over HTTPS. Confirm the final ML Kit disclosure and Console purpose choices. |
| Diagnostics | Collected assessment through ML Kit and safe service logs | Diagnostics, fraud prevention / security | ML Kit may send error codes. Developer logs exclude authorization headers, bodies, raw purchase tokens, and Google error payloads; production logs and duplicate-execution records are retained 7 days. |
| Prompts, responses, files, images, and speech | Not collected by a Developer central relay | App functionality on the user's devices and selected providers | Production remote traffic goes directly between the user's Android device and Windows PC through Tailscale. Codex/OpenAI, Tailscale, and an optional Web Speech provider apply their own processing. Reassess if the final mobile artifact adds an SDK or route. |

Google Play processes the purchase, payment, and purchase status. Cloud Run verifies purchase state
and issues the installation-bound entitlement. Firestore stores the minimal purchase record. Pub/Sub
delivers real-time developer notifications; delivery receipts are retained 30 days. Internal Pub/Sub
RTDN and Scheduler routes are OIDC-authenticated. The public verification route instead validates the
purchase token and installation binding and applies rate limits by client IP and token hash.

## Shipped Android SDK inventory to reconcile

The following inventory comes from the committed Android Gradle inputs and npm lockfile. It must be
replaced or confirmed with the Task 4 final artifact dependency and manifest reports before Console
entry. AndroidX/Kotlin and other transitive runtime libraries in that report must also be reviewed;
absence from this concise data-handling inventory is not an assertion that they are absent.

| Shipped SDK / component | Version evidence | Data Safety relevance |
| --- | --- | --- |
| Google Play Billing Library 9.1.0 | `apps/pwa/android/app/build.gradle` | Purchase and purchase-token flow; purchase history assessment |
| Capacitor Android 8.0.0 | root npm lockfile and Android project | Native bridge and WebView container |
| Capacitor App 8.0.0 | root npm lockfile | App lifecycle and metadata |
| Capacitor Barcode Scanner 3.1.0 | root npm lockfile | Pulls camera/QR dependencies listed below |
| Capacitor Browser 8.0.0 | root npm lockfile | External browser handoff |
| Capacitor Local Notifications 8.0.0 | root npm lockfile | On-device notifications and permission |
| Capacitor Network 8.0.0 | root npm lockfile | Network status |
| Capacitor Status Bar 8.0.0 | root npm lockfile | UI integration |
| Google ML Kit barcode scanning 17.3.0 | barcode-scanner Gradle dependency | QR images/results stay on-device; disclosed metrics may leave the device |
| ionbarcode-android 2.1.0 | barcode-scanner Gradle dependency | Scanner implementation; reconfirm its transitive graph |
| ZXing 3.5.3 | barcode-scanner Gradle dependency | On-device barcode parsing |
| AndroidX Camera 1.5.1 | barcode-scanner Gradle dependencies | Camera capture for QR scanning |

The final artifact review must also enumerate Capacitor Core, AndroidX AppCompat, CoordinatorLayout,
Core Splashscreen, Activity, Compose Material, Kotlin coroutines, and every other resolved runtime
component and compare it with its current privacy guidance.

## Retention and deletion cross-check

- Raw purchase token: transient for a verification request; never retained.
- Active purchase record: retained while the purchase remains valid.
- Invalidated purchase record: retained 180 days to prevent reuse, then deleted unless law requires otherwise.
- Pub/Sub delivery receipt: retained 30 days.
- Production logs and duplicate-execution records: retained 7 days without sensitive request data.
- Local abandoned uploads: 24 hours; completed/failed session cache: 30 days; usage history: up to 31 days.
- Local reset scopes and exclusions are published at https://coderemotemanager.makecdev.com/delete-account.

## Final artifact / Console confirmation

Before submission, record reviewer, date, AAB version and digest in the private release evidence (not
in this public repository), then confirm:

- resolved release dependencies, merged permissions, exported components, network endpoints, and SDK initialization;
- Billing purchase/restore behavior and the verifier request/retention path;
- current Google Play, Cloud Run, Firestore, Pub/Sub, ML Kit, Capacitor, and transitive SDK disclosures;
- Data collection, sharing/service-provider exceptions, purposes, optionality, encryption, and deletion answers;
- consistency with `distribution/PRIVACY.txt`, `distribution/TERMS.txt`, the public website, and Store Listing.
