Theoretically in the developer's privacy policy. In practice, nowhere.