By platform

EULA Generator for Android Apps

Written for the Play Console Data safety form, the User Data policy and Play’s deletion requirements.

Play does not impose a default licence the way Apple does, so a distributed Android app with any meaningful restrictions needs its own EULA - including the open-source attributions that travel with the build.

Google Play requires a privacy policy link in the Play Console and inside the app, and it requires the Data safety section to describe the same collection accurately. Play’s User Data policy is enforced by automated and manual review, and mismatches result in rejection or removal.

Play also requires an account-deletion route: an in-app path plus a web-accessible URL that works without reinstalling the app. That web URL is a specific, checkable requirement that many teams miss.

Android SDK behaviour is the hard part. The Advertising ID, install referrer, and analytics and attribution SDKs each collect on their own account, and Play’s Data safety form asks about collection by third parties as well as by you.

What a EULA for an Android app has to cover

Licence grant and device scope, and that it is a licence rather than a sale
Restrictions on modification, redistribution and reverse engineering
Third-party and open-source component attributions shipped with the build
Update and telemetry behaviour, and what the client reports back
Termination and what happens to locally stored data

How an Android app actually moves personal data

Advertising ID and attribution

Collected by ads and attribution SDKs, subject to Play policy and to the user’s deletion of the identifier, which your code must honour.

Analytics and crash reporting

Firebase Analytics is on by default in many templates and collects automatically before you write a line of tracking.

Permissions-gated collection

Location, camera, microphone, contacts, storage and health, each requiring runtime consent and a matching disclosure.

Play Billing and subscriptions

Purchase tokens and subscription state, linked to the user account.

Push via FCM

Registration tokens tied to installs, with the token itself an identifier.

Sideloaded SDK telemetry

Bundled SDKs may collect diagnostic data you have not declared; Play’s Data safety form makes you answerable for it.

Third parties the draft will ask you about

Google (Play, Firebase, FCM) · AppsFlyer or Adjust · Amplitude or Mixpanel · Sentry · RevenueCat · AWS or Google Cloud

The rules that apply

Play User Data policy

Disclosure, consent and secure handling requirements for personal and sensitive user data, with a mandatory privacy policy link in the Console and in the app.

Data safety section

A declared inventory of data collected and shared, purposes, and whether collection is optional. It must match the app and the policy.

Account deletion requirement

Apps with account creation must offer in-app deletion and a publicly reachable web URL for deletion requests.

Advertising ID policy

Restrictions on use, a requirement to honour the user’s reset and opt-out, and a declaration in the Console.

Sensitive permissions

Location in the background, SMS, call log, photos and video, health and accessibility APIs each carry their own declaration and justification requirements.

What the generated EULA contains

Licence grant and its boundaries
Non-exclusive, revocable, per-device or per-seat - and explicitly a licence, not a sale.
Restrictions
Reverse engineering, redistribution, resale, and running the software as a service for third parties.
Ownership and third-party components
That the IP stays yours, plus the open-source components whose own licences travel with the build.
Updates, telemetry and support
What updates are automatic, what data the client reports back, and what support the licence entitles someone to.
Termination and what happens to data
The events that end the licence, and whether local data survives.
Warranty, liability and export control
As-is warranties where permitted, a defensible cap, and the export restrictions distribution platforms require you to pass through.

Getting through Play review

Audit the dependency tree
Every SDK, including transitive ones, and what each collects.
Write the policy first, then complete Data safety from it
It keeps the two consistent and gives you a reference when review queries a declaration.
Publish both deletion routes
In-app deletion and a public web URL, with the URL entered in the Console.
Add prominent in-context disclosures
Before requesting sensitive permissions, explaining the specific use.
Link the policy in the Console and inside the app
Both are required; the in-app link is regularly missing.

Where this usually goes wrong

Data safety declarations that miss third-party SDK collection

The form asks about collection by any party, not just your own servers.

No web deletion URL

Play requires a publicly reachable URL for deletion requests, separate from the in-app route.

Firebase Analytics collecting by default

Templates enable it, and teams declare "no analytics" without checking.

Advertising ID used after the user opted out

A Play policy violation with removal consequences.

Prominent disclosure missing for sensitive permissions

Play requires an in-context disclosure before the runtime prompt for several categories, distinct from the policy.

Frequently asked questions

Does Google Play require a privacy policy?

Yes. A link is required in the Play Console for all apps and inside the app itself where you access sensitive permissions or data, and the Data safety section must be consistent with it.

What is the Data safety section?

A declared inventory of what your app and its SDKs collect and share, why, and whether it is optional. It appears on your store listing and Play verifies it against app behaviour.

Do I need a web page for account deletion?

Yes. Play requires a publicly accessible URL where a user can request deletion without reinstalling, in addition to the in-app route.

Does Firebase Analytics count as collection?

Yes, and it is frequently enabled by default in project templates. If it is running, it belongs in the policy and in the Data safety declaration.

What is the difference between a EULA and terms of service?

A EULA licenses software that runs on the user’s own device. Terms of service govern a service you host and operate. Desktop apps, mobile apps and downloadable tools need a EULA; a web app usually needs terms.

Does my mobile app need its own EULA?

Apple applies its standard licensed application end user licence agreement unless you supply your own, and if you do, you must meet or exceed its minimum terms. Google Play expects a licence too. If you have custom restrictions, supply your own.

Do I need to list open-source components?

If you ship them, yes. Most permissive licences require attribution in the distributed product, and copyleft licences impose conditions that your own EULA cannot override.