Privacy policy for Android Apps

Talk about things that are not making games here. But you should also make games!

Moderators: Bob the Hamster, marionline, SDHawk

User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Privacy policy for Android Apps

Post by Bob the Hamster »

So it seems that Google play requires a privacy policy now. I had a crack at writing one that would suit my own OHRRPGCE Android Apps

http://hamsterrepublic.com/privacy/andr ... s_no_data/

Since it is so short, I'll quote it here entirely
Our Android Apps don't collect any personal information.

If our Apps request STORAGE permissions, this is only used for your saved games. We do't collect any information.

If any information about your android device is accidentally collected (for example in an app crash report) we won't keep it any longer than is needed to debug the crash, and we certianly won't share it with anyone.

If you have any questions, you can ask Bob@HamsterRepublic.com

This policy was last updated 2019-10-10
Does anyone have any thoughts on it? Have I missed any important points? I know that when people actually collect an keep personal data they actually have to pay lawyers to write these things, but I figure since I don't collect anything, this is good enough.

For the bit about crash reports I am specifically thinking about whatever built-in crash report features are in Google Play. If I remember correctly, the fancy crash reporter that TMC wrote is for the desktop versions only, not the Android Apps.
Last edited by Bob the Hamster on Fri Oct 11, 2019 1:16 am, edited 1 time in total.
ArtimusBena
Slime Knight
Posts: 251
Joined: Thu Nov 16, 2017 5:22 am

Post by ArtimusBena »

Some typos corrected and (perhaps useful) modifications for proper structure and language, given the legal nature of the message:
Official OHRRPGCE Android Apps do not collect any personal information. Basic data from your device hardware and/or software may be collected with a crash report upon prompted user permission. Such data will be used only for debugging the crash, and will not be shared.

If our Apps request STORAGE permissions, this is only used for your saved games.

If you have any questions, you can ask Bob@HamsterRepublic.com

This policy was last updated XXXX-XX-XX

EDIT: Of course, I suggest that crash reports on android also confirm user permission.
Last edited by ArtimusBena on Fri Oct 11, 2019 6:17 am, edited 1 time in total.
User avatar
Pepsi Ranger
Liquid Metal Slime
Posts: 1457
Joined: Thu Nov 22, 2007 6:25 am
Location: South Florida

Post by Pepsi Ranger »

You may also want to review GDPR Compliance rules, just in case they apply here. That's the European privacy law that all digital vendors and marketers are expected to follow. Not sure games on the OHR would need that, but I'm also not sure that they wouldn't.

It might be a good idea to review other popular Android apps for inspiration on what to write in the privacy statement as they've probably been vetted by lawyers.
Place Obligatory Signature Here
TMC
Metal King Slime
Posts: 4308
Joined: Sun Apr 10, 2011 9:19 am

Post by TMC »

We don't send any crash reports on android or (anywhere but Windows) yet. (There is however the "send email" script command (which is also an option in the F8 debug menu) which is intended for sending bug reports - it includes log files and saved games. But that works by opening an email app.) In future I would like to implement something on Unix, including maybe Android, so I guess we might as well future-proof the policy. Does Android actually have a built-in crash reporter? It doesn't appear to.

As Bena pointed out, crash reports currently prompt the user before uploading anything, and we should do the same on Android too.
I would assume GDPR applies if a crash report is submitted. Haven't thought about that.

I asked about crash report privacy before, but I don't think we agreed to anything. What's written in that privacy policy certainly isn't the current policy. We haven't deleted any reports, and I sent summaries of reports including file paths and partially obscured usernames to the mailing list. (The games played/edited and the computers reporting them is very useful information.) I could more thoroughly anonymise the public summaries in future but still want to keep the game names.

"we won't keep it any longer than is needed to debug the crash" -- I'm not sure we should commit to this... but it's not a time limit anyway. Many crashes will never be solved, or it could easily take 5 years to solve a crash. I don't really want to delete reports of unsolved crashes.
"we certianly won't share it with anyone" -- that's vague. "Anyone" is intended to mean non-developers? Since it is an open source project, anyone can be a developer. If someone wants to work on solving a crash, I will want to send reports to them.

On Android, any crash report probably would contain a lot less personal information than on Windows, e.g. no username.


Also I don't think the part about STORAGE permission is correct. If a game runs off internal storage, then I think it will write save games, temporary files and log files there too. I believe we only need the storage permission so that ohrrpgce-game's file browser can pick .rpg files on external storage. So if I'm right we should remove the storage permission when packaging a game, though it would be on by default for ohrrpgce-game.

In future when we add networking support to the engine we'd have less control, but the information accessible by scripts is very limited, so (at that point) we can still write something like "aside from crash reports, any network access only transfers game data, not any device or personal information".

How about (adjusting Bena's version):
OHRRPGCE Android Apps in do not collect any personal information or contact web servers with the following exception.
In case of an error you might be prompted for permission to send an error report which contains game data (such as saved games and logs) and basic data about your device. Such data will be used only for debugging the error, and will only be shared for that purpose after being anonymised.

If you have any questions, you can ask Bob@HamsterRepublic.com

This policy was last updated XXXX-XX-XX
Last edited by TMC on Sat Oct 12, 2019 4:56 am, edited 5 times in total.
ArtimusBena
Slime Knight
Posts: 251
Joined: Thu Nov 16, 2017 5:22 am

Post by ArtimusBena »

Firsthand knowledge of the engine's inner workings is what I was missing, thank you.

In that edit, just some grammatical notes:
OHRRPGCE Android Apps in do not collect any
Remove "in"
with the following exception.
A colon instead of a period sign, and a paragraph break.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

This is all very good feedback. I am glad we are talking about this :)

I agree that once networking is introduced, the possibilities for collecting information change dramatically-- but we will certainly never create a one-size-fits-all policy for all ohrrpgce games, I was just hoping to come up with something that was adequate for my own games on Google Play, and that could serve as a starting-point template for anyone who wants to customize their own privacy statement.

I like the idea of removing STORAGE permission from packaged android games. I'll look into doing that after I have solved the build issues
User avatar
Willy Elektrix
Liquid Metal Slime
Posts: 910
Joined: Sun Aug 15, 2010 11:30 pm

Post by Willy Elektrix »

Thanks for bringing this up and drafting a usable privacy policy! =) This is a big help to me.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

While fixing the broken android nightly build today (Yay! progress) I discovered that the current Android build does not have or request STORAGE permission at all. (or if it is being requested, it is being done in a way that doesn't work anymore?)

To play games you have to copy them to /sdcard/Android/data/com.hamsterrepublic.ohrrpgce.game/files/

It isn't even possible to browse outside that location.

And I am okay with that :)
Last edited by Bob the Hamster on Sat Oct 12, 2019 10:19 pm, edited 2 times in total.
ArtimusBena
Slime Knight
Posts: 251
Joined: Thu Nov 16, 2017 5:22 am

Post by ArtimusBena »

I'm actually frustrated with that fact. Not only do we have to get players to download a separate android player, but we make them dig through their system to find the proper folder to put the game in.

Janky install procedures are a huge deterrent.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

That is just when testing with the game player

Definitely the right way to distribute the game on Android is to package it as its own apk file.

Right now I usually do this packaging for people, and I am always happy to do this, but hopefully I can someday get it streamlined enough that people can do it for themselves via a web interface

(I'd also like to write up some detailed instructions for people who want to do it themselves, and are brave enough to install the OHRRPGCE source code, the sdl-android source code, the Android SDK and get them all running)

EDIT: splitting off the Android build discussion to this thread https://www.slimesalad.com/forum/viewtopic.php?p=135983 so as to keep this thread focused on Privacy Policies
Last edited by Bob the Hamster on Sun Oct 13, 2019 1:16 am, edited 1 time in total.
TMC
Metal King Slime
Posts: 4308
Joined: Sun Apr 10, 2011 9:19 am

Post by TMC »

Not requesting STORAGE permission ought to be fixed for the generic game player.
Well... actually there's no such permission, there's READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE. It's true that we need the write permission only if we want to put the .saves directory next to the .rpg. (Debug logs aren't put next to the .rpg on Android.)
Apparently apps have read/write access to their own dir on the sdcard on Android 4.4+ but need to request it on lower versions. (See sdl-android upsteam git commit 7f4b9162baf, which we haven't merged.)

Storage permissions changed in Android 6+. Now the app needs to both request the permission in its manifest and also ask at runtime. There are sdl-android upstream commits for this which we haven't merged. I mentioned it before.

Oh, I replied to the bit about people packaging their own .apks in the other thread.
Last edited by TMC on Mon Oct 14, 2019 12:51 pm, edited 2 times in total.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

Okay, I can safely say that my first draft was not adequate. They rejected it.
google play rejection wrote: Eligibility Issue
Privacy policy
You must provide a link to your app's privacy policy on your app's store listing page. This link must be maintained at all times while the app is available on Google Play, and it must link to a privacy policy that, among other things, accurately describes your app’s data collection and use. Please provide a link to a valid privacy policy in your app's store listing page in the Play Console. For more details, please refer to the Privacy policy section (#6) of the Families Policy Requirements.
Because this was related to the "Families Policy" I think that they only scrutinized the privacy pilicy so closely because I said my "Target Audience" for Crypt of Baconthulhu was ages 9 and above.

I'll use some of your suggestions, and try to revise a better version and try again.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

Okay, here is the new revision. it is mostly based on your suggestions.

I also added some w3.css magic to pretty it up a bit, and hopefully create the illusion of professionalism ;)

https://hamsterrepublic.com/privacy/and ... s_no_data/
Last edited by Bob the Hamster on Sat Nov 09, 2019 3:28 pm, edited 1 time in total.
User avatar
Bob the Hamster
Lord of the Slimes
Posts: 7658
Joined: Tue Oct 16, 2007 2:34 pm
Location: Hamster Republic (Ontario Enclave)
Contact:

Post by Bob the Hamster »

Yay! That latest version was accepted for Crypt of Baconthulhu with target audience including 9 and older. I did not attempt to enroll in "designed for families" but I'll try that later.

Thanks for the help!
User avatar
Willy Elektrix
Liquid Metal Slime
Posts: 910
Joined: Sun Aug 15, 2010 11:30 pm

Post by Willy Elektrix »

Bob the Hamster wrote:Yay! That latest version was accepted for Crypt of Baconthulhu with target audience including 9 and older. I did not attempt to enroll in "designed for families" but I'll try that later.

Thanks for the help!
Thanks for sharing your experiences here. This is helpful to me. I need to get this done for my apps, still!
Last edited by Willy Elektrix on Fri Nov 15, 2019 2:59 am, edited 1 time in total.
Post Reply