Third-Party SDK Disclosure Generator
Published September 5, 2026
Your app's privacy policy must disclose every third-party SDK that collects or processes user data. Google Play's Data Safety form, Apple's Privacy Nutrition Labels, and regulations like GDPR and CCPA all require you to name the services, explain what data they handle, and link to their privacy policies. Select the SDKs your app uses below, and this tool writes the disclosure paragraphs for you -- ready to copy straight into your privacy policy.
Select all that apply. Grouped by category.
Analytics
Advertising
Crash Reporting
Payments
Authentication
Push Notifications
Customer Support
Backend & Infrastructure
How to Use This Tool
Enter your app or company name, then select every third-party SDK your app integrates. The tool groups SDKs by function -- analytics, advertising, crash reporting, payments, authentication, push notifications, customer support, and backend infrastructure -- so you can work through each category without missing one. Hit "Generate Disclosure" to produce a ready-to-copy disclosure section that names each SDK, states what data it collects, explains the purpose, and links to the vendor's privacy policy. Below the disclosure text you will see a deduplicated table of every data category your selected SDKs handle, which tells you exactly what your "Data We Collect" section needs to cover. When you are ready to build the full policy document, generate a complete privacy policy for free with our generator.
Why Third-Party SDK Disclosure Matters
Every SDK you add to your app introduces a third-party data processor. Google Analytics collects device identifiers and usage events. Stripe processes payment card details. Crashlytics captures device state and stack traces at the moment of a crash. Each of these data flows must be disclosed in your privacy policy -- not as a vague reference to "third-party services," but with the specific SDK named, the data it handles identified, and the purpose stated.
This is not optional. Google Play requires you to declare every SDK that collects or shares user data in your Data Safety form, and the declaration must match what your privacy policy says. Apple requires a privacy manifest file (PrivacyInfo.xcprivacy) that lists the data collection practices of every third-party SDK in your build, and your App Store Privacy Nutrition Labels must be consistent with that manifest. Under GDPR Article 13, users must be informed of the categories of recipients of their personal data -- generic statements are no longer sufficient. CCPA requires disclosure of the categories of personal information collected and the categories of third parties to whom it is disclosed.
Getting the disclosure wrong has consequences. Google Play can reject your app update or suspend your listing if your Data Safety form contradicts your privacy policy. Apple's app review flags inconsistencies between your Nutrition Labels and your manifest. Regulators can fine you for incomplete disclosure -- and class-action lawsuits have targeted apps whose privacy policies failed to mention specific SDKs that were actively collecting user data.
The most common mistake is not malice but oversight. Developers add SDKs during development, update them across versions, and forget to update the privacy policy. This tool eliminates that gap by generating the disclosure text directly from your SDK selections, so the policy stays current every time you add or remove a service.
Frequently Asked Questions
Do I need to list every SDK in my privacy policy?
Yes, if the SDK collects, processes, or transmits user data. Both Google Play and the Apple App Store require you to disclose every third-party service that handles user data. GDPR and CCPA also require you to name the categories of third parties that receive personal information. SDKs that perform purely local operations with no data collection (such as a local image-processing library) do not need disclosure.
What data categories should I disclose for each SDK?
Each SDK collects different data types. Analytics SDKs typically collect device identifiers, usage data, and IP addresses. Advertising SDKs add advertising identifiers and may track browsing activity. Crash reporting SDKs collect device state, OS version, and stack traces. This tool maps each SDK to its specific data categories so you do not have to research them individually.
Is the generated disclosure text legally binding?
The generated text is a disclosure template based on each SDK's publicly documented data practices. It is not legal advice. Review the output for accuracy against your specific implementation, since your app may configure an SDK to collect more or less data than the default. For complex data practices or regulated industries, consult a privacy attorney.
How often should I update my SDK disclosures?
Update your privacy policy's SDK disclosures every time you add, remove, or update a third-party SDK. SDK updates can change what data is collected -- for example, a major version bump might add new telemetry. Run this tool again after any dependency change to regenerate the disclosure section and catch new data categories.
Does this tool cover all SDKs?
This tool covers the most widely used third-party SDKs across analytics, advertising, crash reporting, payments, authentication, push notifications, customer support, and backend infrastructure -- roughly 25 services. If your app uses an SDK not listed here, add a manual disclosure paragraph following the same pattern: name the service, state the data it collects, explain the purpose, and link to the vendor's privacy policy.
Can I use this for both iOS and Android apps?
Yes. The disclosure text is platform-neutral -- it describes what each SDK does with user data regardless of whether your app runs on iOS, Android, or both. The data categories and vendor privacy policy links apply across platforms. Platform-specific requirements like Apple's privacy manifest or Google's Data Safety form are separate compliance steps; the App Store Privacy Requirements Checker can help with those.