Nearly every app store and marketplace requires that you have a privacy policy if your app transmits data. Read more about requirements. Your app is not covered by the terms of service or privacy policies of the app stores.

For most apps, the bulk of data collection happens when ad networks and analytics companies do their thing. Those companies have their own privacy obligations, but you have the primary responsibility to let your users know what's going on. Even more importantly, you have a responsibility to work only with companies who collect and use data responsibly. The PrivacyChoice index gives you this info at a glance, and the PrivacyChoice Policymaker makes it easy to build third-party disclosure into your privacy policy.

The Federal Trade Commission has issued rules that may require parental permission for the collection of personal information from children under the age of 13. The FTC recently collected a $50,000 fine for a violation of these rules. You should understand whether these rules apply to your app, and make sure your privacy policy is clear.

Just because you can collect a kind of user data doesn't mean it is appropriate to do so. For instance, if your app doesn't use location info, there is no reason to collect it. By the same token, it's poor form to say that you collect more than you actually do, in order to preserve the right to do so someday. It's better to keep it real, and update your policy when you need to.

Not all data is equal when it comes to privacy. Information that can identify someone ' like their name or mail address ' is more sensitive than anonymous log files, but probably less sensitive than transaction information like credit card numbers. The best privacy practices take into account the sensitivity of information when deciding how to collect, store and share it. Transaction info and, in some cases, other registration info, may need to be encrypted. Your organization's internal permissions also need to treat sensitive data differently; not everyone should have access to personal or transaction info.

With storage being cheap, you may be tempted to be a data pack rat, saving every table and log file long after your last use. But you'll do better by your users if you only keep data as long as you truly need it. Don't let users worry that old information in your database could be disclosed accidentally or in legal process (a hassle for you, too). Set up a deletion policy for each kind of data and lighten your load.