App Ops Desk · Issue #18
Privacy nutrition label drift
Your App Privacy answers are a product contract. SDKs, analytics, and “temporary” tracking flags quietly make them false. Solo founders find out during a busy submit.
One action this week: Calendar a 20-minute privacy drift check whenever you add or remove an SDK — and once before each App Store version submit.
What drifts
- Data types collected (device ID, contact info, usage data)
- Linked to user vs not
- Used for tracking vs not
- Purpose strings in Info.plist vs actual prompt timing
- Third-party SDK defaults you never re-read
Audit script
- Diff Package.resolved / Podfile.lock since last store version
- List new network hosts from docs or proxy notes
- Re-read each SDK’s data practices blurb
- Update store-facts doc the same day
- Align Info.plist purpose strings with real UX copy
Failure modes
- Copied another app’s privacy answers
- Added attribution SDK “just to test” and shipped it
- Purpose string still says “improve experience” for a hard-required permission
- Label claims no tracking while an SDK fingerprints
Bottom line
Privacy answers are release artifacts. Treat SDK changes like metadata changes — update store facts in the same PR.
Resources hub → Full library and jump-by-symptom links. Join the App Ops Desk waitlist Weekly release ops for people who ship alone.