Dropbox API and Apples App privacy details on the App Store

[mwg]

Apple requires to provide app privacy details (see https://developer.apple.com/app-store/app-privacy-details/ )

While an iOS app uses dropbox to store/read a user's data, it can provide the details for this interaction.

But for how dropbox (company) handles said data is hard to denote in the privacy details.

Probably other devs already went on the journey to collect and provide the required info on app submission to Apple App Store.

It would be great to have some info/support from dropbox to advise on how answer the questions (which might be a subset of the dropbox iOS app privacy details).

Thanks for sharing any info.

Marcus

[Greg-DB]

We don't have documentation specifically for the official Dropbox iOS SDKs in particular with regard to the new Apple privacy detail requirements, but you can find Dropbox's privacy information in general here:

https://help.dropbox.com/accounts-billing/security/privacy-policy-faq

The official Dropbox SDKs don't do anything other than process API calls and app authorization flows but I'll ask the team write up some documentation for this specifically. The official Dropbox iOS SDKs are open source so they can be inspected if desired though:

• https://github.com/dropbox/dropbox-sdk-obj-c
• https://github.com/dropbox/SwiftyDropbox

[mwg]

@Greg-DB Thanks for the reply and outlook. It would be great to get some advise on this. I am also not sure, if there is a difference in the privacy notes, if the iOS app showing the authentication dialog as part of the app (as e.g. the objc SDK does if the Dropbox App is not installed) or if it uses external Safari redirection.

[Greg-DB]

Thanks for following up. This is open with the team as a request for detailed documentation for this for the SDKs in particular. I'll follow up here with any updates on that.

[MiNJ]

Thank you for addressing this. It's not only the SDKs themselves that matter here, but also what the servers do with that data. I'm sure that not only we, but all other App Store devs would appreciate it if you can provide an authoritative set of answers for Apple's data collection and tracking questions for apps that use a Dropbox SDK. This would obviously be limited to just the Dropbox interface part and may have to be extended for each individual app, but it would be a valuable baseline to start from.

Your link to Dropbox' general privacy policy is but a tiny step in that direction. This is basically telling tens of thousands of devs to all perform the same arduous task, filtering and interpreting the pages upon pages of legalese in your privacy policy into Apple's categories and terms, where your legal team could do that just once in an authoritative manner. It is also impossible for devs to discern if all the generic collection and tracking provisions detailed in the privacy policy even apply for SDK interfacing, or only when Dropbox' website or own app is being used.

At face value, it would seem that any app would have to declare the privacy provisions of the Dropbox official app as a bare minimum, which includes user tracking and other sensitive topics. That's a tough proposition for apps that strive to present themselves as respecting user privacy in the best possible way.

[Greg-DB]

@MiNJ Thanks for the feedback! I'll send this along with the request.

[dsmurfin]

Is there any update on this? It’s making use of the SDK in a shipping app almost impossible without risking providing incorrect information to customers.

[Greg-DB]

@dsmurfin Thanks for the note! I don't have an update on this yet. I'll check in with the team.

[dsmurfin]

@Greg-DB  Thanks for checking.

[mwg]

@Greg-DB to have some planning for my app release, could you probably check if and when such information would be provided. Looking forward to it.