Play Console · Data safety form

Two Left Feet Data Safety

Every data type the app and its SDKs actually touch, in the order the console asks for them. Derived by reading what the code sends, not from what the SDKs advertise — so check the two rows marked decide before submitting.

Package com.tentaculo.twoleftfeet Build versionCode 4 / 1.1 — not yet uploaded SDKs AdMob · AppMetrica · Play Billing · Firebase Auth + Firestore

Start here — the three questions above the table

Is all of the user data collected by your app encrypted in transit?

Yes

Firestore, Firebase Auth, AdMob and AppMetrica are all HTTPS, and the game itself is served from inside the APK over https://appassets.androidplatform.net.

Do you provide a way for users to request that their data is deleted?

Yes

Built in versionCode 4. Profile → DELETE ACCOUNT destroys the player document, every level that account published, its leaderboard rows and the login itself, in that order — data first, identity last, because the rules stop allowing anything the moment the account is gone. One thing still missing: Play also wants a public web URL for deletion requests from anyone who has uninstalled the app. That lives in App content → Data deletion, not in this form.

Has your data collection been independently validated?

Optional badge, needs a paid third-party audit. Leave it off.

Data types

Grouped by the console's own sections so you can work top to bottom. Shared means transferred to a third party — other players seeing a leaderboard name is not sharing in Play's sense, but it is worth knowing it happens.

Data type	Collected	Shared	Purposes to tick	Why — what in the app does it	Source
Personal info
Name	Yes	No	App functionality	The Google display name is copied into the save on first sign-in and written to the player document. It is also the name on the public 100 STEPS board.	Firebase
Email address	Yes	No	Account management	The game never reads it — but Google Sign-In hands it to Firebase Auth, which stores it against the account. Collected by the app's backend, so it is declared.	Firebase Auth
User IDs	Yes	Yes	App functionality · Analytics · Advertising	The Firebase uid keys every saved game and leaderboard row. AppMetrica and AdMob keep their own device-scoped profile ids.	All four
Photos	Decide	No	App functionality	The app stores the URL of the Google profile picture, not an image file, and draws it in the avatar bubble. Declaring it under Personal info → other is the safer reading; ask if you would rather stop storing it.	Firebase
Financial info
Purchase history	Yes	No	App functionality	Which of the four products the account owns. Play processes the payment; the app keeps only the entitlements — the no-ads flag and the gems it granted.	Play Billing
Location
Approximate location	Decide	Decide	Advertising or marketing	Nothing in the app asks for location — no permission, no geolocation call. But AdMob derives a coarse location from the IP address to target ads, and Google's own guidance says to declare it when serving personalised ads. Depends on what the consent form ends up allowing.	AdMob
App activity
In-app actions	Yes	Yes	Analytics · Advertising or marketing	Sessions and screen time via AppMetrica; ad impressions and taps via AdMob. No custom game events are reported yet.	AppMetrica · AdMob
Other user-generated content	Yes	No	App functionality	Levels players build and publish to Browse Levels, plus the name they type on their profile. Both are readable by every other player.	Firestore
App info and performance
Crash logs	Yes	Yes	Analytics	AppMetrica turns native crash reporting on by default — the emulator log confirms `native crash reporting enabled: true`. Easy to miss, because nothing in our code asked for it.	AppMetrica
Diagnostics	Yes	Yes	Analytics	Session length, app version and device model, sent with every report.	AppMetrica
Device or other identifiers
Device or other IDs	Yes	Yes	Analytics · Advertising or marketing	The advertising ID for AdMob, and AppMetrica's device identifiers — which are the whole point of an MMP, since attribution is matching an install to a campaign.	AdMob · AppMetrica
Everything else — leave unticked
Contacts, Calendar, SMS, Files, Audio, Health, Messages, Precise location, Payment info, Web browsing	No	No	—	The app holds five permissions and none of them reach any of this: internet, vibrate, billing, notifications, and boot-completed for the reminders.	—

Before you submit

One page to write, and it is not code

The in-app half is done — a player can erase themselves from the profile, and it really does erase, in the cloud as well as on the phone. What is left is the case Play cares about that the app cannot serve: somebody who already uninstalled. For them the console wants a public web page saying what the game stores and how to ask for it to go, with an address that reaches a person. The Google Group already on the consent screen, tentaculostudio@googlegroups.com, is a reasonable address. The URL goes in App content → Data deletion.

How this list was built

From the code, not the brochure. Every row traces to something specific: the cloudPush payload, the leaderboard write, the manifest's permission list, the AppMetrica activation log.
Two rows say “decide” because they are judgement calls rather than facts — the profile photo URL, and whether AdMob's IP-derived location counts. Both are safer declared than not.
Cross-check against each SDK's published disclosure. Google publishes one for AdMob and Yandex publishes one for AppMetrica; they are written for exactly this form and will list anything this misses.
It goes stale the moment the app changes. Adding custom AppMetrica events, or a new SDK, means coming back here first.
Deletion is not a checkbox, it is a promise. Google spot-checks it. If the declaration says data can be deleted, the route has to work — which is why the button deletes the published levels and the leaderboard rows too, and not just the wallet the player can see.

Prepared from the main branch at versionCode 4. The store currently serves versionCode 3, which has neither AppMetrica nor the delete button in it — so nothing in the analytics rows is collecting anything, and no player can yet erase themselves, until the next upload goes out. Submit the form for the build you are actually shipping.