Hacker News Reader

Comment by makecheck | Hacker News Reader

They definitely need a special case for “no data collected”.

It should say something very direct like “This app does NOT collect any data.”. Instead, the App Store listing includes this extremely awkward set of phrases:

    “The developer, $DEVELOPER has indicated that the app’s privacy practices may include handling of data as described below:

    Data Not Collected

    The developer does not collect any data from this app.”

View on HN

They do, actually. If you look up the Halide camera app, you'll see a great example of this.

I think the original poster has seen an example of this, and they think apple could go further.

I certainly was surprised to see the sentence:

"Privacy practices may vary, for example, based on the features you use or your age."

I filled in the questions in app store connect recently, and since it is just a simple game without anything remotely privacy invading, I happily answered all the questions in the most "privacy respecting" way. To then see this sentence hinting that the privacy stuff might be different if people use unspecified features, or be particular ages... that is certainly a surprise.

It does say that, but it's also a very clear and bold "Data Not Collected"

See screenshot: https://share.barkerja.dev/4vgEhw.jpeg

My issue is the whole “privacy practices may include handling of data as described below”, which on first read always sounds like “great, this app is handling my data for some reason”, only to be followed by “no data collected”. It’s pointlessly verbose to get that point across.

That is the WORST type of privacy practice sentence. I've seen it so often.

"We may collect <x,y and z>, for example <most benign use possible>"

"We may collect your date of birth, for example to wish you a happy birthday!"

I think "for example" sentences should be disallowed.

That message comes from the rule where for non-core infrequently-used functionality, an app need not disclose the data collected if it is not used for advertise or tracking, it is clear and obvious what data you are collecting, and you clearly show the user id as a form field.

For example, if your feedback form allows users to optionally enter their email address so you can contact them to request more details if needed, you don't need to specify that you collect email addresses if you never otherwise collect email.

It is not clear if this would also apply if users can optionally upload a profile photo, but profile photos are not a core part of the app (e.g. not a tinder clone). If it does apply it would let you omit the scary sounding 'user photos' option from the privacy list.

Ha - thing is - data is collected by apple.

Apple will collect data on behalf of the app.

I suspect all this will become like a california prop 69 warning, where every building has one and you just go inside anyway unsure if you're walking into an asbestos factory or somewhere where they use bleach to clean the toilet.

Reply on news.ycombinator.com