App store requirements are stricter than the law
Both stores block submission without a reachable privacy policy URL, and both ask you to declare data collection separately: Apple through Privacy Nutrition Labels in App Store Connect, Google through the Data Safety form in Play Console. Your policy and those declarations must agree — a mismatch is a frequent cause of review rejection and later removal.
Work from your SDK list. Analytics, crash reporting, ad mediation and attribution SDKs each collect something, and identifiers such as IDFA or the Android advertising ID count as personal data in the EU and California.
- Device identifiers and advertising IDs
- Permissions you request (location, camera, contacts) and why
- Crash and performance data
- Push notification tokens
- Children's data if your app could appeal to under-13s