Data collection is minimized to what is necessary

GDPR Art.5(1)(c) requires data minimisation — collecting only what is strictly necessary for a specified purpose. Requesting contact list access in an app with no contact-sharing feature, or logging 40+ analytics event types for an app with a narrow feature set, is over-collection that creates unnecessary legal exposure without any product benefit. Excessive analytics events are a common attack surface for data leak scenarios: each event payload is another opportunity for inadvertent PII capture. Store reviewers also flag permission requests without a demonstrable feature need, resulting in rejection.

Audit each permission request and each analytics event against the feature that justifies it. Remove permissions and tracking events that cannot be tied to a user-facing feature.

Apply the progressive disclosure principle: collect additional data only when users engage with features that require it. Review the src/analytics/ or equivalent directory and list every distinct event tracked — if the list exceeds what your product team can act on, it is over-collection. For permissions, search for requestPermissionsAsync, requestCameraPermissionsAsync, and similar calls in src/ and verify each maps to a visible feature.