If you process personal data in your app, you must do so with the utmost care and diligence, and ensure that your app complies with the applicable laws and regulations, including but not limited to the General Data Protection Regulation (GDPR) for the European Union, Personal Information Protection Law, Identification Method for Illegal Collection, and Provisions on the Cyber Protection of Children's Personal Information for the Chinese mainland, and Personal Data (Privacy) Ordinance for Hong Kong (China), Personal Data Protection Act for Singapore, as well as other applicable local privacy-relevant laws, as the case maybe.

The below requirements of AppGallery are not in any way meant to constitute instructions to you by Huawei based on data protection laws. Huawei, as the app market provider, has its own AppGallery requirements that are in addition to the applicable data protection laws your app is subject to.

Privacy policies

7.1 Your app must have an easy-to-find in-app link to your app's privacy policy containing consistent and transparent information to your end users about the processing of their personal data when using your app. You also need to submit a link to that privacy policy in AppGallery Connect to allow its display in the app information on AppGallery. Both links should be easy to access.

7.2 The privacy policy link provided by your app must redirect users to the app privacy policy that includes the purpose, method, and scope of personal data collection and use by your app (including entrusted third parties or embedded third-party code and plugins).

7.3 The privacy policy must include how users can exercise their data subject rights such as withdrawing their consent and/or requests for data deletion, checking or copying their personal data, as well as an effective channel for user privacy issue feedback. If your app provides an account system, you need to allow users to deregister their accounts at ease without any obstacles. The deregistration shall actually take effect.

7.4 Your app must comply with applicable laws and regulations of data processing when accessing, collecting, using, or disclosing any personal data and ensure that appropriate legal bases are in place for data processing in accordance with any applicable laws and regulations.

Obtaining user consent

7.5 When required by applicable laws or when consent is chosen as the legal basis, your app must clearly provide access to its privacy policy and inform users of relevant information in accordance with applicable laws prior to requesting such consent and the consent should be obtained before collecting or processing any of their personal data.

7.6 Your app must provide a simple and easy-to-understand way for users to withdraw their consent anytime.

7.7 If your app collects and uses personal data for personalized advertising and marketing, your app's privacy policy should inform users of this function, and an independent option must be provided for users to disable this function.

7.8 Your app must obtain users' explicit consent for processing of sensitive personal data, and inform users of the necessity of processing and the impact on their rights and interests.

Collection and use

7.9 User data collection and use must comply with the principle of minimization and should be limited to the minimum scope necessary for achieving the purpose of handling, in a way that has the least impact on personal rights and interests.

7.10 Your app must not collect and use personal data in a secretive manner, in a manner that exceeds the purpose for which it was collected, and/or in an unreasonable manner.

7.11 Your app must process users' data in a secure manner, by relying on, for instance, encryption technologies (such as HTTPS).

7.12 If your app discloses personal data, it must state the data to be disclosed, recipient of the data, and purpose of the disclosures in its privacy policy.

7.13 Your app must not sell any personal data.

7.14 You should ensure that any third party to which you disclose personal data must provide protective measures that comply with the stated requirements in your app's privacy policy.

7.15 Your app must not use sensitive personal data or any special category of data, such as call logs, SMS messages, biometric features, health data, or locations, for service improving, advertising, marketing, or other non-core service functions.

7.16 Permission requests and use must comply with the principle of minimization. Your app must not refuse to provide products or services on the basis that users do not provide consent or withdraw their consent.

7.17 Your app must not request the location permission for advertising or data analysis purposes only.

7.18 Your app must provide clear description about the functions and scenarios that request permissions. Do not induce or mislead users' authorization. The permissions requested by your app must comply with those claimed in your app's permission requests.

7.19 When your app is launched for the first time, avoid frequently displaying pop-ups for requesting sensitive permissions.

Open Advertising Identifier (OAID)

It is prohibited to force users to tap ads or submit personal data to get full access to in-app content for advertising purposes.

7.20 An OAID used within your app can only be used for advertising and user analysis.

7.21 An OAID must not be associated with personal identity information nor any permanent device identifier (for example, an SN, a MAC address, or an IMEI), without explicit consent from users.

7.22 Every time that your app uses an OAID, it must check whether Disable personalized ads or a similar function has been turned on by the user for the device. If so, your app is not allowed to collect and use user data that is based on the OAID.

7.23 After the OAID is reset, the new OAID for your app must not be associated with the previous OAID, or the data derived from it without explicit consent from users.

7.24 All third parties must comply with relevant OAID clauses, in order to share an OAID with your app.