`apps/mobile/store-assets/privacy-label.md`

45 lines
# App Privacy label — Celebrity Signatures (draft, TK-10258)

App Store Connect → app 6798448971 → App Privacy. Answer these to match what the
NATIVE binary actually does (cross-checked against the code — see notes). Draft only.

## Does this app collect data? → YES (minimal)
The native app collects data ONLY when a user chooses to create an account.

### Data types collected
| Data type | Collected? | Linked to identity? | Used for tracking? | Purpose |
|---|---|---|---|---|
| **Email Address** | Yes | Yes | No | App Functionality (account sign-in) |
| **Name** | Yes (optional) | Yes | No | App Functionality (account personalization) |
| Everything else | No | — | — | — |

- **Password** is not a declarable "data type" in the label (it's an auth credential); it is
  transmitted over HTTPS and stored hashed (scrypt) server-side — not collected for the label.
- Purchases: the mural print checkout happens on the **website** in a WebView (physical goods);
  payment is handled by Stripe on celebsignatures.com, so **the app does not collect payment info**.

## Tracking → NONE
- **Not** used to track you. No ATT prompt required.
- Cross-check / evidence: `ui/no-track.ts` is injected into the only WebView before content
  loads and stubs + blocks AdSense, Google Analytics, gtag, DoubleClick, and (hardened)
  Facebook/mixpanel/segment/amplitude/hotjar/matomo. The native screens make plain `fetch()`
  calls to `celebsignatures.com/api/*` only — no analytics/ads SDKs are linked in the app.
- The public *website* keeps AdSense/GA; the *app binary* is clean. Declare accordingly.

## Data NOT collected (declare "Not Collected")
- Location, Contacts, Health, Financial info, Browsing history, Search history,
  Identifiers (IDFA), Usage Data, Diagnostics, Photos, Audio, User Content.
  (The signature-UPLOAD feature is web-only; the native app has no upload screen.)

## Account deletion (Guideline 5.1.1(v)) — SATISFIED
- In-app: Account tab → "Delete my account" (confirm dialog) → `POST /api/auth/delete`.
- Verified live: `curl -X POST https://celebsignatures.com/api/auth/delete` → 401 "not signed in"
  (endpoint exists; deletes user + sessions + saves + uploads when authed).

## Reviewer note (for the App Review "Notes" field)
"Account creation is optional — the entire gallery, game, and murals browse work without
signing in, so a reviewer can exercise the app anonymously. To test account features, create
an account with any email; delete it via Account → Delete my account. The app performs no ad
or analytics tracking (ad/analytics scripts are stripped from the in-app web view). Mural
checkout is a physical printed product, fulfilled via the website."