🛡️ Play Data Safety

Fill Google Play's Data safety form from your Android app's real code, not from memory.
An agent skill for Claude Code, Gemini CLI, Codex, Cursor, OpenCode and Antigravity.

It scans your Android project, asks you only what code can't reveal, and writes the CSV that
Play Console imports in one click.

• Free and open source (MIT). No account, no API key, no paid tool.
• No changes to your app. Nothing to add to Gradle. It runs your project's own Gradle from outside.
• Evidence for every answer. Each SDK entry cites the vendor's own Data safety page and the date it was checked.
• Needs only JDK 17+, which every Android developer already has.

⚠️ The output is a draft for you to confirm, not legal advice. Static analysis can't know what
your server stores, whether a field is optional, or how deletion works. That's why it asks.

🤔 Why

Every app on Google Play must complete the Data safety section: 10+ screens of forms, with seven
questions for each data type you declare, in a slow and annoying UI. Play Console lets you skip all
of that with Import from CSV, but the file is ~780 rows of machine IDs and Play rejects it over
the smallest formatting mistake.

I first built this for NowKit to generate the exact CSV Play accepts. I've
used it in all my apps, and students of the shipkaro weekend program
have used it for 30+ apps now live on Google Play. This repo is that tool, open sourced for every
Android developer.

📖 Read the full story: Stop filling the Google Play Data safety form manually

💻 Installation

Run this in your Android project:

npx skills add wajahatkarim3/play-data-safety-skill

That's it. It finds the AI coding agents you use (Claude Code, Gemini CLI, Codex, Cursor, OpenCode,
Antigravity and more) and installs the skill for each one. Add -g to install it once for all your
projects. You only need Node.js for this one command; the skill itself runs on the JDK.

Claude Code plugin (adds the /data-safety command too):

/plugin install play-data-safety --marketplace wajahatkarim3/play-data-safety-skill

Gemini CLI:

gemini skills install https://github.com/wajahatkarim3/play-data-safety-skill.git --path skills/play-data-safety

Agent Skills are still experimental in Gemini CLI, so you may need to enable them in its settings.

Manually, which also adds a /data-safety command for every agent:

git clone https://github.com/wajahatkarim3/play-data-safety-skill
cd your-android-app
/path/to/play-data-safety-skill/install.sh            # or --agent gemini, --global

❓ Usage

In your Android project, ask your agent:

Fill my Play data safety form

Your agent picks up the skill from that request. You can also call it directly: /play-data-safety
in Claude Code, or /data-safety if you installed the plugin or used install.sh. The agent will:

1. Scan the project: every library (including transitive ones, via ./gradlew dependencies),
   every permission in your manifests, and code that touches location, contacts, camera, audio,
   files, device IDs or the network.
2. Match libraries against the SDK table below, check each one is actually switched on, and show
   what it collects, with sources.
3. Ask only what it can't know: does this permission's data leave the device? What does your
   backend receive? Can users opt out of analytics? Where do they request deletion?
4. Write play-data-safety/play_data_safety.md (readable answers) and
   play-data-safety/play_data_safety.csv.
5. Tell you to import it: Play Console → Set up your app → Data safety → Import from CSV.

The CSV generator refuses to write a file it can't stand behind: unknown data type labels,
unanswered questions, a missing deletion URL, or a mismatch between the table and the CSV all stop it.

Without an agent

The scripts work on their own:

SKILL=/path/to/play-data-safety-skill/skills/play-data-safety
java $SKILL/scripts/Scan.java . --skill-dir $SKILL                   # writes play-data-safety/scan.md
# edit play-data-safety/play_data_safety.draft.md → play_data_safety.md
java $SKILL/scripts/DataSafetyCsv.java play-data-safety/play_data_safety.md \
     $SKILL/reference/play-data-safety-template.csv play-data-safety/play_data_safety.csv

In CI

Fail the build when a new SDK collects a data type your declaration doesn't list:

java $SKILL/scripts/Scan.java . --skill-dir $SKILL --check play-data-safety/play_data_safety.md

Exit code 4 means something is undeclared.

🚀 Ship the Rest of Your Android App with NowKit

This skill comes from NowKit, a production-ready Kotlin + Compose
starter kit driven by AI-agent commands. It does everything around the Data safety form too: auth,
payments and analytics setup, a privacy policy and terms generated from your code, a hosted landing
page, signing, screenshots, store listing, and a step-by-step guide through every Play Console screen
to production.

👉 kit.shipkaro.dev

🎓 Learn to Ship Your App Live with shipkaro weekend

Prefer to build it with people? shipkaro weekend is a live, hands-on cohort: three evenings on
Google Meet where you build an Android app with AI and submit it to Google Play, Data safety form
included. You arrive with an idea and leave with a Play Store submission.

👉 1dayapp.shipkaro.dev

📦 SDKs Covered

36 SDKs, each mapped to Play's data types with the vendor's own source:

• Google: Firebase (Analytics, Crashlytics, Performance, Messaging, Auth, Firestore, Remote Config), AdMob, Play Billing, Sign in with Google, Maps, Places, ML Kit
• Analytics & monitoring: PostHog, Sentry, Amplitude, Mixpanel, Segment, BugSnag, Datadog
• Engagement: Braze, CleverTap, Airship, OneSignal
• Ads & attribution: Meta (Facebook SDK, Audience Network), Unity Ads, AppLovin, ironSource, AppsFlyer, Adjust, Branch
• Payments & backend: RevenueCat, Adapty, Stripe, Supabase

36 SDKs.

A library that isn't listed is reported as unknown and the agent helps you check its docs.
Please contribute the entry back.

👨 Developed By

Wajahat Karim, Google Developer Expert for Android

👍 How to Contribute

The most valuable contribution is an SDK entry. Add skills/play-data-safety/sdks/<id>.json
following sdks/SCHEMA.md. Every data type needs a
sourceUrl from the vendor's own documentation and a checked date. PRs that update a stale entry
are just as welcome as new ones. Check your entry with:

java tools/ValidateSdks.java

1. Fork it
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request

📃 License

Copyright 2026 Wajahat Karim

Licensed under the MIT License. See the LICENSE file for details.

skills/play-data-safety/reference/play-data-safety-template.csv is Google Play Console's sample
Data safety import file, included so the generated CSV matches Play's schema.