Privacy Policy for Apps that do not collect datas

Question

I am currently in the process of bringing an app to the iOS app store. It's just a small app I made in my free time. It is workout-related, so the app requires access to location and health data from the user. The data, however, is only stored on user devices. My app does not send this data anywhere (except for iCloud sync), no login is required, and I also do not implement any tracking frameworks except for the built-in Apple one that you have to agree to when setting up iOS.

Now the app store requires me to link to a privacy policy (probably because health data is potentially sensitive information). I searched for privacy policy generators online, but all I could find just seem to assume that you collect personal data. They include statements such as:

We collect several different types of information for various purposes to provide and improve our Service to you.

or

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

I am afraid this might confuse users, since I explicitly state on my app store description that the data is not stored on my servers. Should I keep this in the policy nonetheless to be on the safe side legally? Or can anyone point me into the right direction what I need to include in my policy if I actually do not collect personal user data?

Answer 1

You collect + use personal data (location data + health data) in your app, regardless of the method of storage: on your own servers, locally on user's device, and so on. The only difference is that you do not send the collected data anywhere else (except iCloud sync).

If you don't use the collected data, simply disclose it in your Privacy Policy. Disclose that the data you collect is not store outside the user's device (except for iCloud).

Ecquire has an example of Privacy Policy for "no collection of data":