Your customers lend you their phone. In return they expect you not to follow them everywhere.
In 2027 that expectation is also the rule: Apple asks for tracking permission, Google requires a data safety declaration, and India’s Digital Personal Data Protection Act (2023) expects consent before processing personal data. An app that ignores all three will be rejected, reported or abandoned.
1 · Consent before collection
Ask for each permission with a reason, at the moment the feature needs it — location when the user taps “track my order”, not on first open. One bundled consent for everything is not consent.
Keep a record: who consented, when, and for what purpose. A one-line timestamp in your server log is enough to answer an audit.
2 · The notice must match the app
The privacy notice is not a legal wall. It is a list a normal person can read:
- What you collect — name, phone, location, purchase history.
- Why — to deliver the order, to send updates, to prevent fraud.
- Who receives it — courier partner, payment company, analytics — by name.
- How long you keep it, and how to ask for deletion.
If the app shares data with an advertiser, say so. Hidden sharing is the fastest way to lose a store listing.
3 · Deletion and export from inside the app
Both stores now expect a path to delete the account from inside the app — no email to support required. Provide it one tap from the profile screen, and confirm deletion within a clear time.
Offer export too: a CSV of orders and addresses. A customer who can leave is a customer who can stay.
The privacy checklist
- Permission prompts tied to features, with reasons.
- Notice matching the app — collect, purpose, sharing, retention.
- Consent record stored per user.
- In-app deletion and export, tested before submission.
- Data safety and privacy labels consistent across stores.
Get these right and privacy stops being a compliance burden. It becomes the reason your app stays installed.
Sources
The official pages this guide is based on:
