Is a Read-Only GET Request Without User Data Considered ‘No Data Collection’?

Question

ODev OP

Created 1w

Replies 3

Boosts 0

Participants 3

Hi everyone,

My iOS app performs only a GET request to an external server to receive a JSON with configuration data (e.g., app settings). It does not send any personal data — it's a read-only request used only to adjust app behavior.

Since the app only performs a GET request to the server and does not send any data from the user, no data is collected or stored.

In App Store Connect > App Privacy, is it correct to select: "No, we do not collect data from this app"?

Just want to confirm this is acceptable before submitting. Thanks!

Boost

Answer 1

jcovin293 OP

1w

I would assume that that is fine. I think that as long as the JSON data received from the GET request contains no personal information, you're fine. Additionally, as far as I can tell from your original post, you are not sending any POST requests that are giving app data to the server. If you are, this might be a different question. Also, I would think that the phrasing "we do not collect data from this app" referes more to analytics that user settings and preferences.

0

Answer 2

ODev OP

1w

I do not perform any POST requests and do not collect or send any user data. The app only performs GET requests to fetch a JSON file that I uploaded to a hosting site for app functionality. Is it correct to select "No, we do not collect data from this app"?

I want to be completely sure before submitting.

0

Answer 3

DTS Engineer OP

Apple

5d

I don’t work for App Review, and thus can’t provide definitive answers about their policy, but I do have a comment on this:

Since the app only performs a GET request to the server and does not send any data from the user, no data is collected or stored.

That’s not necessarily true. It’s possible for a read-only request to result in potentially privacy-sensitive data being stored on the server. Even if you ignore folks doing this maliciously [1], it’s possible to do this accidentally. The server might, for example, store the IP address of the client, the user agent string, and so on in its own internal logging.

So, I encourage you to look at the server side of this equation to confirm that it works the way that you think it works.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] For example, you can export an arbitrary string an a custom HTTP header.

0