Ask only for what a feature needs, show only what a task needs, and say plainly where data goes.
Best practices
- Ask in context. Request a permission, such as the camera or location, only when a feature needs it, and explain why before the system asks.
- Show only what the task needs. Mask personal details in lists, such as the middle digits of a phone number, and reveal them where the task needs them.
- Prefer on-device processing, especially for intelligent features, and say clearly when data leaves the device.
- Never put personal data in addresses, links or anything that might be logged or shared.
- Make sharing explicit. Before sending, exporting or syncing personal data, say what goes where.
- Let people leave. Exporting and deleting their own data is easy to find and clearly explained.