GDPR for a mobile app, in plain terms
GDPR is long, and almost all of it is irrelevant to a small app. Six things are not.
What this is
GDPR is long, and almost all of it is irrelevant to a small app. Six things are not.
Step by step
- Have a legal ground for every purpose, and write it down.
- Collect what you need and nothing you do not.
- Name your processors, including where they run.
- Be able to export and delete a person's data.
- Answer a request within a month.
- Be able to show what someone consented to, and when.
One thing people miss
The sixth is the one that trips people: consent you cannot prove is consent you did not get.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
How long does this take?
Minutes, once the page it points at exists. The writing is the slow part, not the form.
Can I change it later?
Yes, and you should whenever the app changes. What you want to avoid is changing the URL, because everything that points at it breaks.