sdk-disclosure-rules
Skill1 starsChanged 7 months agoMITView on GitHub
Rules for disclosing third-party SDK data collection in privacy policies. Use when generating a privacy policy, auditing data disclosure, or determining what SDK data must be declared.
In this repository5 other files it gives its agents.
- AGENTS.mdAGENTS.md
- gdpr-complianceSkill
- github-pages-deploySkill
- permission-data-mapSkill
- play-data-safetySkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 35
Not declaring Firebase Analytics → violation
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Third-Party SDK Disclosure Rules
Rule 1 — Always disclose advertising SDKs
Any advertising SDK (AdMob, Facebook Audience Network, etc.) MUST be disclosed because:
- They collect advertising IDs
- They may share data with their ad networks
- Google Play requires this in the Data Safety form
- GDPR/CCPA may apply
Rule 2 — Disclose analytics SDKs
Firebase Analytics, Google Analytics, etc. must be disclosed.
- Describe as "anonymous usage data" if it truly is
- Note that data is processed by Google
Rule 3 — Disclose crash reporters
Crashlytics, Sentry, etc. must be disclosed.
- Clarify that no personal data is in crash logs (if true)
Rule 4 — Link to third-party policies
For each SDK disclosed, include a link to the third-party's privacy policy:
- Google: https://policies.google.com/privacy
- Facebook: https://www.facebook.com/privacy/explanation
- Unity: https://unity.com/legal/privacy-policy
Rule 5 — Data Safety form must match policy
Whatever you declare in Play Console's Data Safety form must be consistent with your privacy policy. Mismatch = policy warning or removal.
Common Data Safety form mistakes
- Declaring "no data collected" when AdMob is included → violation
- Not declaring Firebase Analytics → violation
- Claiming data is not shared when AdMob shares with Google → violation
Opt-out information
For advertising data, always include:
- How users can opt out of personalized ads (device settings → Google → Ads)
- Link to Google's ad settings: https://adssettings.google.com
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.