Privacy for AI apps: what to tell your users and Google Play

An app that sends user messages or photos to an AI service is sharing that data with a third party. Users deserve to know, and Google Play requires you to say so. The good news is that being clear about it is not hard.

This is general guidance, not legal advice. If your app handles health, financial or children's data, talk to a professional.

Start with an honest list

Before writing anything, list what actually leaves the phone:

• The text users type into the AI feature.
• Photos or audio they choose to analyze.
• Any IDs you attach, such as a user ID for rate limiting.
• Which provider receives it, and whether they keep it or use it for training.

Check your AI provider's API terms. Many business APIs do not train on API data by default, but you should confirm, and say what you found.

What to put in your privacy policy

Plain sentences beat legal fog. For example:

When you use the Ask feature, the text you type is sent to our
server and then to [provider] to generate an answer. We do not
store your messages after the answer is returned. [Provider]
processes the text under its own privacy policy and does not use
it to train models. Do not include personal information you do
not want to share.

Also explain how long you keep any logs, how users can ask for deletion, and how to contact you.

The Data safety form

In Play Console, declare the data types you collect or share. A typical AI chat feature involves "Messages" or "Other user-generated content", shared with a third party for app functionality. Mark whether data is encrypted in transit (it should be, with HTTPS) and whether users can request deletion.

Small design choices that help

• Tell users at the moment it matters. A one-line note under the chat box, like "Messages are processed by an AI service", is more useful than a policy nobody reads.
• Send less. Do not attach location, contacts or device IDs unless the feature needs them.
• Prefer on-device models for features that can run locally. Data that never leaves the phone needs no disclosure. See running AI on the phone.

Host your policy somewhere public

Google Play needs a public URL for your privacy policy. A simple page on your own site works. Link it in Play Console and inside the app's settings or about screen.