Spun out of #139's play-policy-insights pilot audit (full context: #139 research record, detail in docs/PRD-android-skills.md once PR #141 merges). Three verified findings share one root tension: the onboarding claim "Open source · 100% on your phone" (strings.xml, onboarding_body) conflicts with Firebase telemetry that uploads off-device.
Findings
- User file names can reach Crashlytics. On the API 26–29 import fallback (
ACTION_OPEN_DOCUMENT), VideoImporter's duration-probe failure path sends the picked URI's lastPathSegment to ReverseCrashlytics.reportMediaRetrieverFailure, which records it as the source_label custom key. On that path the segment is a real file path/name (e.g. primary:Movies/MyVideo.mp4). The drafted Data Safety form (docs/play-store/data-safety.md) declares "Files — NOT collected", which this contradicts. The modern Photo Picker path yields only an opaque media ID, so exposure is conditional — but the contradiction with the form is unconditional as long as the key ships.
- Firebase Analytics auto-events (
first_open, session_start, engagement) upload in the background with no in-app disclosure or consent gate. The Data Safety draft declares them correctly; the gap is in-app.
- Crashlytics non-fatals (stack traces + custom keys from
VideoImporter / VideoStorageRepositoryImpl failure paths) upload on next launch, same disclosure gap. All keyed to the pseudonymous Firebase installation ID — no account identity involved.
Remediation options
- Finding 1 (smallest, do regardless): drop the
source_label key, or reduce it to a non-identifying token (hash, or just the URI authority). Two-line change; removes the Data Safety contradiction outright.
- Findings 2–3, option A — consent gate: ship
firebase_crashlytics_collection_enabled=false / analytics equivalent in the manifest, add a disclosure step to onboarding, enable collection only on acceptance.
- Findings 2–3, option B — honest copy + opt-out: reword the onboarding line (e.g. "Your videos never leave your phone" — true, and the stronger claim anyway), add a settings toggle wired to
setAnalyticsCollectionEnabled / setCrashlyticsCollectionEnabled, and note the telemetry in the listing's privacy policy. docs/play-store/data-safety.md already flags the opt-out as an open decision.
Acceptance criteria
🤖 Generated with Claude Code
https://claude.ai/code/session_01UYnJd1K9tbrjaj8DZCStev
Spun out of #139's play-policy-insights pilot audit (full context: #139 research record, detail in
docs/PRD-android-skills.mdonce PR #141 merges). Three verified findings share one root tension: the onboarding claim "Open source · 100% on your phone" (strings.xml,onboarding_body) conflicts with Firebase telemetry that uploads off-device.Findings
ACTION_OPEN_DOCUMENT),VideoImporter's duration-probe failure path sends the picked URI'slastPathSegmenttoReverseCrashlytics.reportMediaRetrieverFailure, which records it as thesource_labelcustom key. On that path the segment is a real file path/name (e.g.primary:Movies/MyVideo.mp4). The drafted Data Safety form (docs/play-store/data-safety.md) declares "Files — NOT collected", which this contradicts. The modern Photo Picker path yields only an opaque media ID, so exposure is conditional — but the contradiction with the form is unconditional as long as the key ships.first_open,session_start, engagement) upload in the background with no in-app disclosure or consent gate. The Data Safety draft declares them correctly; the gap is in-app.VideoImporter/VideoStorageRepositoryImplfailure paths) upload on next launch, same disclosure gap. All keyed to the pseudonymous Firebase installation ID — no account identity involved.Remediation options
source_labelkey, or reduce it to a non-identifying token (hash, or just the URI authority). Two-line change; removes the Data Safety contradiction outright.firebase_crashlytics_collection_enabled=false/ analytics equivalent in the manifest, add a disclosure step to onboarding, enable collection only on acceptance.setAnalyticsCollectionEnabled/setCrashlyticsCollectionEnabled, and note the telemetry in the listing's privacy policy.docs/play-store/data-safety.mdalready flags the opt-out as an open decision.Acceptance criteria
source_labelno longer carries user file names on any import pathdocs/play-store/data-safety.mdreconciled with shipped behaviorPYTHONUTF8=1) and confirm findings 1–3 clear🤖 Generated with Claude Code
https://claude.ai/code/session_01UYnJd1K9tbrjaj8DZCStev