Deploying app with Crashlytics to Apple Appstore - do I need a privacy policy?

Question

I am about to submit an app to the Apple AppStore built in Swift that uses Crashlytics to capture crash information. As users of Crashlytics know, some information about usage, duration, crashes, etc. is captured and stored on the Crashlytics servers. My application does not ask for, store or attempt to capture any user data.

My question is about the privacy policy for my application. Since I don't capture any user data, I want to state that in my privacy policy but I'm not sure that's factual since I am using Crashlytics. Any feedback on people that have used Crashlytics in their app and have an actual privacy policy?

Thanks

--Vinny

Answer 1

Quick answer: yes, you need that privacy policy. There are ways to get it done fast, too.

Longer answer:

Third parties (here Crashlytics)

When dealing with a third party service like this, often a quick look into their legal documents will help (for Crashlytics in this case as described in your question).

(...) At all times during the term of this Agreement, Developer shall maintain a privacy policy (a) that is readily accessible to users from its website or within its online service (as applicable), (b) that fully and accurately discloses to its users what information is collected about its users and (c) that states that such information is disclosed to and processed by third party providers like Crashlytics in the manner contemplated by the Services, including, without limitation, disclosure of the use of technology to track users’ activity and otherwise collect information from users. (...)

And

Developer shall at all times comply with all applicable laws, rules and regulations relating to data collection, privacy and security, including, without limitation, the Children’s Online Privacy Protection Act (“COPPA”). Crashlytics may, at its sole discretion from time to time during the Term of this Agreement, audit Developer Data to verify compliance.

Crashlytics is actually being unusually vocal about this topic.

The App Store

At the time of writing (and since iOS8) Apple requires privacy policies for 5 categories:

Kids Category, HomeKit, HealthKit, Apple Pay, and Keyboard Extentions. Also they require privacy policies for user registrations (more). I can't tell if any of the above for your app is true. Apple still says in their App Store Review Guidelines that you need to be compliant with all applicable laws. This brings us to the third and most important reason.

Privacy related regulations

All of the above is just there because of global privacy regulations, these companies would most likely not care otherwise. As soon as you work with User data you are mostly under an obligation to disclose these facts. It's personal data like names, addresses or the tracking of user behaviour. It's been written at length why analytics services need privacy policies. All of it is more important as soon as you share data and use third party services for it. Mostly the disclosure or some kind of consent is the condition for it's compliant usage.

If you are interested in reading more about the matter in the context of mobile apps I'd suggest any of these documents:

• ICO UK
• Ireland
• USA/California
• Canada
• Australia

Hope this helps.

(For proper disclosure: I do some work for iubenda, a tool that helps creating privacy policies for apps and websites)

Answer 2

Vinny, I think it's not mandatory (I've seen apps using Crashlytics wihtout a privacy policy), but it's recommended to have transparency in the communications with your users.

Crashlytics already has a privacy policy so you can just use that policy and add a statement informing that you are not collecting any sensitive information from the user, such as email or phone number.