Inventory the resolved release dependencies
Start with the release dependency tree and final artifact. Record the SDK, version, purpose, adapter relationships and initialization trigger. A library removed from one Gradle file may remain transitively included through another dependency.
Separate the app's own backend requests from vendor traffic. Both matter to Data Safety, but their controllers, purposes and retention can differ.
Trace collection through configuration
For each SDK, ask when it starts, whether consent changes its behavior, what identifiers it uses and whether custom payloads contain additional data. A crash-reporting SDK configured with a user's email creates a different disclosure question from a report containing no custom identity field.
| Evidence | What it establishes |
|---|---|
| Vendor disclosure | Documented SDK behavior and available controls |
| Resolved version | Which implementation the app contains |
| Initialization/configuration | Which behaviors are enabled and when |
| Runtime inspection | Evidence of observed traffic in tested scenarios |
| Backend/vendor settings | Retention and service-side processing choices |
No single row replaces the others. A short network capture also cannot prove that a delayed or rarely triggered flow never occurs.
Translate evidence into the form's definitions
Apply Google's definitions of collection, sharing, purposes and optionality. Do not assume a vendor is exempt because it is widely used. Equally, do not label every service-provider transfer as sharing without checking the documented exceptions.
Compare the final answers with the privacy policy and in-app disclosures. Save the source version and review date for the next SDK upgrade.
Use scanners as leads
APKLint's SDK and Data Safety tools can identify declared signals and structure questions. They cannot infer every remote setting or certify a legal classification. Treat an unknown library or unexplained permission as an investigation item, not an automatic violation.
Use the Play Data Safety definitions and the relevant vendor guide, such as Google Mobile Ads data disclosure. Revisit the inventory whenever mediation, analytics, authentication or remote features change.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
