Google keep complain about SDKBOX violation of User Data

Services 3rd-Party
#1

Hi,

@nite @slackmoehrle

I received this email from Google.

10-Day Notification of Google Play Developer Term Violation

Hello Google Play Developer,

We detected that the app(s) listed at the end of this email contain a version of SDKBox that collects personally identifiable information (PII) without disclosure. Apps like this may be considered in violation of our User Data policy.

Action required: Your app(s) may be removed from Google Play if the issue is not resolved within 10 days of receiving this message. If the affected version is inactive, future submissions will be rejected if you attempt to publish without first resolving the issue.

You can resolve this issue by:

adding a privacy policy URL to your app listing and within the app, notifying the user that their PII is collected; or
removing any such functionality from your app. You may need to contact your SDK provider for an updated, policy compliant version to include in your app.
After resolving the issue, you’ll need to sign in to your Developer Console and submit the updated version of your app.

We’re here to help

If you feel we have sent this warning in error, you can contact our developer support team.

Regards,

The Google Play Team

Affected app(s) and version(s):

https://play.google.com/store/apps/details?id=com.zinitt.FitnessWorkoutTimer
https://play.google.com/store/apps/details?id=com.zinitt.MoneyExpenseManager

Both using smae SDKBOX

SDKBOX Inc. v1.0.0.13
 installed packages:
     v2.2.2.12 googleplayservices
     v2.2.2.12 iap

However, i do provide our own privacy policy URL in the app listing and within the app.
So i have contacted them as this is an error warning.

But the issue is why Google keep complain about SDKBOX?
What does SDKBOX hidden collecting and doing?

It is very troublesome and the second time of same issue.

Last issue :

Thank you.

Email from Google Play about SDKBOX v2.2.2.10 PII violation version
SDKBox collects personally identifiable information (PII) without disclosure
#2

Just received the same email:

Hello Google Play Developer,

We detected that the app(s) listed at the end of this email contain a version of SDKBox that collects personally identifiable information (PII) without disclosure. Apps like this may be considered in violation of our User Data policy.

Action required: Your app(s) may be removed from Google Play if the issue is not resolved within 10 days of receiving this message. If the affected version is inactive, future submissions will be rejected if you attempt to publish without first resolving the issue.

You can resolve this issue by:

adding a privacy policy URL to your app listing and within the app, notifying the user that their PII is collected; or
removing any such functionality from your app. You may need to contact your SDK provider for an updated, policy compliant version to include in your app.

I’m using an older version of sdkbox though.

Any clue?

#3

I will let @nite talk with us about this. I do know that SDKBOX does collect info. They have a privacy policy here: http://www.sdkbox.com/privacy

#4

We removed all potential information that potentially violates google’s policy since their privacy policy update. Since 2.2.2.12

We also submit an test app before release to check if it contains anything violates google’s policy, can you try updating SDKBOX to the latest version?

It’s possible that some of your user haven’t upgrade to the latest version of your app and are still using the old version that will cause this issue.

#5

Google updated their privacy policy since google IO 2016, we have to update SDKBOX to make sure it’s within their privacy policy.

#6

@slackmoehrle @nite

Thank you for your reply.

My apps are using this version and Google report affected version include this version.

v2.2.2.12 googleplayservices
v2.2.2.12 iap

Do i still need to update SDKBOX?

#7

After some investigation, we found out that this issue was fixed in 2.2.2.12 version however got reintroduced to 2.2.3 version due to an incorrect merge. We’ll release a new version 2.2.4 today to address this issue.

In your case, I checked your app, I think it’s using 2.2.3 and that’s why it encounter this issue.

#8

@nite

You checked my app but is v2.2.3?

I use this command in my project folder to check version and show me the above result v2.2.2.12

SDKBOX info

Am i using the wrong command to check or the v2.2.2.12 is actually v2.2.3?

I check my other project which use SDKBOX

v2.2.1.7 iap
v1.5.3.3 iap

Both version are fine.

I have got this mail from the google what should i do?[SDKBOX]
#9

Yes, I downloaded your app and check the package.
Anyway, we released 2.2.4 that should fix this issue please update and resubmit your app to google, really sorry about the incovinance.

#10

@nite

I use SDKBOX update on my project folder.

Why it auto update to version 2.2.3.5 but not 2.2.4?

#11

You might want to delete the cache

rm -rf ~/.sdkbox/cache
#12

@nite

So v2.2.4.14 is the correct version?

#13

Yes 2.2.4.14 is the correct version

#14

@nite

Ok thanks.

I will update the app with the new SDKBOX version.

#15

@nite After this fix, do we game devs still need to have a privacy policy URL for the game? (even if we are not asking for any PII from the user)

#16

Yes, you’ll still need a privacy policy URL for the google play store submission

#17

@nite we don’t collect any PII in our app. Does sdkbox collect any such PII that we need to disclose?

#18

We worked with Google to make sure SDKBOX is complaint with their policy and you shouldn’t need to disclose in regarding PII when using SDKBOX.

#19

Since we are not collecting any PII and sdkbox is already compliant, it is not necessary to add the privacy url.

Thanks @nite

#20

Hello,

I’m trying to update but I can’t do it.

Copyright (c) 2015 SDKBOX Inc. v1.0.0.15
 2.2.5.3 2.2.3.5
 updating flurryanalytics v2.2.3.5 -> v2.2.5.3
 [Errno 2] No such file or directory: 'n/a'
 Installation failed :(
 failed to update package flurryanalytics
 2.2.5.3 2.2.3.5
 updating googleplayservices v2.2.3.5 -> v2.2.5.3
 [Errno 2] No such file or directory: 'n/a'
 Installation failed :(
 failed to update package googleplayservices
 2.2.5.3 2.2.3.5
 updating iap v2.2.3.5 -> v2.2.5.3
 [Errno 2] No such file or directory: 'n/a'
 Installation failed :(
 failed to update package iap
 all packages are up to date.

Please help! How can I manually update?