Data retention periods are disclosed in the privacy policy
Why it matters
GDPR Art.13(2)(a) requires disclosure of 'the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period.' Without a retention disclosure, every EU user your app collects data from is covered by an incomplete privacy notice — a regulatory gap that multiplies with each new user. Beyond GDPR, App Store Connect and Google Play Console both require a live, accessible privacy policy URL before you can submit — an incomplete policy causes submission failure even if it exists.
Severity rationale
Low because absent retention disclosure is a regulatory gap that creates legal risk at scale but does not enable direct data exfiltration or account compromise.
Remediation
Add specific retention periods to your privacy policy for each data type your app collects. Concrete language:
- 'Account data is retained until you delete your account, after which it is permanently deleted within 30 days.'
- 'Crash reports are retained for 90 days.'
- 'Analytics data is retained for 24 months.'
For GDPR, include retention periods in the 'Data We Collect' section, one per data category. Verify the privacy policy URL is live and resolves before submission — App Store Connect → App Information → Privacy Policy URL validation checks the URL. Cross-reference the stated timeframes against your actual deletion implementation to ensure they are consistent.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13(2)(a) — Period for which personal data will be stored must be disclosed
- gdpr · Art. 5(1)(e) — Storage limitation
- ccpa · §1798.100 — Right to know about personal information collected, including retention periods
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated