Appearance
Keryx Play Data Safety, permissions, and FGS compliance
Approved: 25 August 2026
This document is the P1-08 compliance packet for Keryx for SafeCall on Google Play. It records Data Safety draft answers, permission and foreground-service posture, App content checklist items, and the reviewer-access plan.
It does not claim that a signed release AAB was inspected, that Play Console forms are filled or submitted, that perpetual dataSync FGS is already removed from source, or that a reviewer QR URL is live.
Purpose and non-goals
Purpose
- Approve Play Console answers and checklists that implementation and release evidence must satisfy.
- Align Data Safety with data classification, the privacy draft, and Android delivery architecture.
- Assign handoffs for signing, live policy URL, reviewer environment, and console submission.
Non-goals
- Building or signing a release AAB — see android-signing.md (#109 closed at policy + wiring level; Play Console paste remains #125).
- Filling or submitting Play Console forms (#125).
- Removing FGS from source (post-#96 implementation).
- Hosting a durable reviewer QR (#123).
- Completing the full dependency/license audit (#102; inventory approved in dependency-ownership.md; machine SBOM/CI remain #112).
Approved decisions
- Owner and approver: Thomas Minitsios, 25 August 2026.
- Data Safety posture: derive answers from P1-05 and the privacy draft. Do not answer “no data collected” or “no sharing” without matching the on-device history, config, lock-screen exposure, and client-deployer ntfy/FCM roles.
- Ads: no ads; no advertising ID use; no ads SDK.
- Analytics / crash SDK: none at launch (P0-05).
- Foreground service (launch target): no perpetual
dataSync/ boot FGS. Prefer a release AAB that does not declareFOREGROUND_SERVICE_DATA_SYNCor adataSyncservice unless a short, clearly eligible residual use remains. FGS demonstration video is required only if a residual declared FGS type remains in the submitted AAB (P1-03). - App access: free administrator companion; account-free install; configuration via SafeCall-generated QR on the administrator’s own device; reviewer path via durable static QR + isolated test ntfy (#123 / P0-03).
- Audience / rating: Business category; target age 18+ only; not designed for children or Families; expected IARC result Everyone; no health functionality; not a medical device (P0-02). Return to P0-02 if the questionnaire differs.
- Privacy policy URL:
{public_base}/keryx/privacyafter deploy per public-web-pages.md (P2-04). Do not submit a dead link.
Current gap baseline
| Surface | Current evidence | Packet target |
|---|---|---|
| App manifest permissions | CAMERA, INTERNET, WAKE_LOCK, FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, POST_NOTIFICATIONS | Keep camera / notifications / network; remove or minimize FGS/dataSync for launch |
| Vendored ntfy | dataSync FGS + RECEIVE_BOOT_COMPLETED boot/package-replace restart | Align to P1-03 FCM poll_request + authenticated poll; no perpetual FGS |
| Delivery design | P1-03 approved; code still has perpetual FGS | Implementation then match Play forms to the tested AAB |
| Data Safety | Runbook forbids “no collection”; no approved answer sheet | This packet |
| Privacy policy URL | Planned path only; not live | P2-04 packet then deploy |
| Reviewer QR | Required for review; not hosted | #123 |
| Signing | Release still debug-signed | #109 |
Evidence sources: keryx/android/app/src/main/AndroidManifest.xml, keryx/vendor/ntfy/android/src/main/AndroidManifest.xml, android-delivery-architecture.md, data-classification.md, legal/privacy.md, P0-02/P0-03 roadmap decisions.
Permission inventory (source today vs launch target)
| Permission / component | Present today | Launch target |
|---|---|---|
CAMERA | Yes (QR scan) | Keep — SafeCall QR only |
POST_NOTIFICATIONS | Yes | Keep — administrator alerts |
INTERNET | Yes | Keep — HTTPS ntfy subscribe/poll and FCM wakes |
WAKE_LOCK | Yes (plugin) | Keep only if still required by residual wake/poll path; do not claim always-on |
FOREGROUND_SERVICE / FOREGROUND_SERVICE_DATA_SYNC | Yes | Remove unless a short residual eligible FGS remains after P1-03 implementation |
dataSync NtfyForegroundService | Yes | Deprecate / remove perpetual service |
RECEIVE_BOOT_COMPLETED + boot restart of FGS | Yes | Do not restart perpetual FGS; boot behavior must match launch design |
| FCM / Play services | Not yet wired for launch design | Expected after P1-03 implementation + #119 |
Do not declare permissions that the submitted AAB no longer needs. Re-inspect the merged manifest of the signed release AAB before console answers (#109/#125).
Data Safety draft answers
Draft Google Play Data Safety answers derived from data classification and privacy draft. Re-verify against the signed AAB and #102 inventory before submission. Do not pre-answer “no collection.”
| Topic | Draft answer |
|---|---|
| Does the app collect or share user data? | Yes, disclose. Keryx processes provisioning config and alert history on device, and communicates with the client-deployed ntfy host (and FCM/upstream when configured). sourcectl does not operate a Keryx analytics backend. |
| Data types — app activity / messages | Alert title, body, tags, timestamps, topic metadata, and recovery JSON may be stored locally and shown in notifications. Bodies may include device names, MACs, or operational / location-like SafeCall content. |
| Data types — app info and performance | Local pause flag, tombstones, subscription state. No third-party analytics or crash SDK. |
| Data types — device or other IDs | No advertising ID. FCM/device tokens (when implemented) register with the client ntfy host for wakes — not with a sourcectl analytics service. Identifiers inside alert bodies are SafeCall-generated content, not Keryx tracking IDs. |
| Collected for | App functionality (provisioning, delivery, history). |
| Shared with | Client deployer of ntfy (and optional FCM/APNs upstream they configure) as transport processors. Not sold. Not used for advertising. |
| Tracking / advertising | No. Not used for advertising or cross-app tracking. No ads SDK. |
| Encryption in transit | Yes — HTTPS (TLS) to the ntfy host (P1-02). |
| Data deletion | Administrator can delete local history and Reset App; token revoke is offboarding on the ntfy host (P1-05 / P1-02). Disclose honestly on the form. |
| Lock screen | Full notification title and body may appear on a locked device — disclose consistently with the privacy draft. |
| Children | Not designed for children; target age 18+ only. |
| Security practices | Follow Play form prompts; align narrative with SharedPreferences launch storage and HTTPS transit (P1-05 / P1-02). |
Final checkbox mapping must be filled in Play Console from this draft plus the tested release AAB (#109/#125).
App content checklist
| Play App content area | Approved draft |
|---|---|
| Privacy policy | URL {public_base}/keryx/privacy after deploy (P2-04); until live, do not submit |
| Ads | No ads |
| App access | Free companion; no paid unlock; QR configures connectivity from SafeCall; provide reviewer instructions + durable QR (#123); do not ask reviewers to configure ntfy/topics manually (P0-03) |
| Target audience | 18+ only; not for children / Families |
| Content rating (IARC) | Complete questionnaire honestly; expected result Everyone; return to P0-02 if different |
| News / COVID / etc. | Not applicable unless questionnaire requires explicit “no” |
| Health apps | No health functionality; not a medical device (P0-02) |
| Permissions declaration | Match merged manifest of the launch AAB; justify camera and notifications; do not justify perpetual dataSync after removal |
| Data safety | Use draft table above |
| Foreground service | See next section |
Foreground-service declaration plan
- Preferred launch AAB: after P1-03 implementation, no perpetual
dataSyncFGS and noFOREGROUND_SERVICE_DATA_SYNCpermission → no FGS declaration text and no demonstration video required for that type. - If a residual short FGS remains in the submitted binary: declaration text and demo video must match the exact type, eligibility, and user-visible behavior; owned at submission under #125.
- Current source has no perpetual
dataSyncFGS. Re-inspect the signed AAB merged manifest before pasting Play FGS answers (#125).
Reviewer access plan
Play review must exercise the configured experience without client production data or manual ntfy setup.
| Requirement | Owner |
|---|---|
| Non-expiring static HTTPS page with SafeCall-style reviewer QR, friendly categories, and administrator instructions | #123 |
| Isolated HTTPS/authenticated test notification environment | #123 |
| Free-companion / QR-connectivity fact block (not an external purchase unlock) | P0-03 narrative; listing copy #105; #123 packaging |
| Hosts and URLs | Controlled records only — do not invent in this repository |
Until #123 is live, this packet records the plan only.
Evidence handoffs
| Evidence | Owner |
|---|---|
Remove/minimize perpetual FGS; wire FCM poll_request | Later implementation (post-#96) |
| Complete dependency / SDK inventory | #102 packet: dependency-ownership.md; machine SBOM/CI #112 |
| Production Android signing and release AAB | #109 — android-signing.md |
| Live privacy URL | public-web-pages.md (P2-04); HTTPS deploy |
| Durable reviewer QR + test ntfy | #123 |
| Play Console forms without unresolved warnings | #125 |
| Final safety / delivery-limitation claims | #103 packet: safety-claims.md |
| Physical-device delivery matrix | #117 |
Explicit non-claims
Closing #101 approves this packet. It does not:
- claim a signed release AAB was inspected;
- claim Play Console forms are filled or submitted;
- claim perpetual FGS is already removed from the Android tree;
- claim a reviewer QR URL is live;
- claim an IARC content-rating certificate was obtained.
Review record
- Status: approved as the P1-08 Play Data Safety compliance packet.
- Date: 25 August 2026.
- Approver: Thomas Minitsios under the P0-05 RACI.
- Depends on: data-classification.md, legal/privacy.md, android-delivery-architecture.md, P0-02/P0-03 store facts.
- Evidence sources: Android app and vendored ntfy manifests, P1-03/P1-05 approvals, publishing runbook Play checklist.