How to Complete the Google Play Data Safety Form for a TWA

Understanding Data Safety Requirements for Hybrid Android Apps

Google Play requires all developers to complete a Data Safety questionnaire for every published application. This form informs users about what data is collected, how it is processed, and whether it is shared with third parties. For developers publishing a Progressive Web App (PWA) using a Trusted Web Activity (TWA), navigating this form can be confusing.

Because a TWA is essentially a native wrapper that displays your web application inside a secure custom tab, you must declare data practices for both the native Android package and the web application loaded inside it. Google treats the entire experience as a single unified application. This guide provides a step-by-step breakdown of how to accurately complete the Data Safety questionnaire for your TWA-based Android app to prevent app store rejections.

The Web vs Native Scope of Data Collection

When completing the Data Safety form, you must evaluate all data collected or processed through the app. This includes data collected directly by native code in the wrapper and data collected by the web application loaded inside the TWA. A common mistake is assuming that web-based data collection is exempt because it occurs within a browser engine. This is incorrect. Any data entered into your PWA or collected via web-based analytics tools counts as data collected by your application.

You must disclose data if it is collected and transmitted off the user's device, or if it is processed locally and stored on-device in a non-ephemeral manner. For example, if your web application saves the user's session in LocalStorage or IndexedDB, this is local processing. However, if that session token is transmitted to your backend server to authenticate the user, this constitutes data collection.

Categorising Your TWA Data Practices

To fill out the form accurately, you must audit your web application for specific data types. Most standard SaaS tools, e-commerce platforms, and content apps collect data across several distinct categories. Below are the most common categories for TWA apps and how to handle them.

User Authentication and Personal Information

If your PWA contains a login system, registration form, or checkout page, you are collecting personal information. This typically includes name, email address, user IDs, phone numbers, or physical addresses. In the questionnaire, you must mark these fields as collected. If you do not share this information with external third parties for marketing or tracking, you must declare that the data is not shared.

Financial and Transaction Info

If your TWA processes payments, either directly or through a third-party gateway like Stripe, BrainTree, or PayPal, you must declare the collection of financial information. This includes payment cards, bank account details, or transaction history. Even if the payment form is hosted on a secure iframe or handled externally, the action occurs within the user journey initiated inside your app, meaning it must be declared.

App Performance, Diagnostics, and Analytics

Almost all modern web apps use analytical tools like Google Analytics, Mixpanel, or Hotjar. These services track user interactions, page views, and device details. In the Data Safety form, you must check the boxes for Analytics and Diagnostics. This includes declaring that you collect device identifiers, crash logs, and performance metrics.

Common Web Technologies and Data Safety Declarations

Answering the Core Security and Privacy Questions

In addition to categorising data, the Data Safety form asks several procedural questions regarding your security practices and data management policies. For a TWA, these questions should be answered in accordance with both your web server security configuration and your privacy policy.

The first critical question asks if your app encrypts data in transit. Because TWAs require a valid HTTPS connection and verified Digital Asset Links to function, your app naturally encrypts all traffic in transit. You should answer yes to this question, as all communications between the client device and your web servers are secured using Transport Layer Security (TLS).

The second critical question asks if you provide a mechanism for users to request that their data be deleted. Google Play strictly enforces a policy requiring apps that support account creation to also support account deletion. Inside your TWA, you must provide a way for users to delete their account and associated data. You must also provide a web-based URL in the Google Play Console where users can request account deletion without needing the app installed.

Avoiding Common Pitfalls that Lead to App Rejections

Many TWA developers face app rejections because of discrepancies between their declared Data Safety form and their app's actual behaviour. Google employs automated static and dynamic analysis to scan your application binary and runtime traffic for undeclared SDKs or tracking mechanisms.

One major pitfall is failing to declare native dependencies. If you have modified your TWA wrapper to include native Android libraries, such as Firebase Analytics or Push Notification SDKs, these libraries may collect data automatically. Ensure you check the documentation for any native dependencies you include in your wrapper and match their data-sharing declarations with your own.

Another common cause of rejection is an outdated or missing Privacy Policy. Google requires a publicly accessible URL for your Privacy Policy. This policy must explicitly detail the collection of data, the usage of cookies, and the third-party integrations running within your web app. Ensure that the information inside your privacy policy matches the selections made inside the Data Safety questionnaire.

Reviewing and Publishing Your Selections

Once you have filled out all sections of the Data Safety questionnaire, Google Play Console will generate a summary preview. Review this preview carefully to ensure it aligns with your public-facing privacy documentation. Once submitted, these details will display on your app's store listing, helping build user trust and keeping your application compliant with Google Play policy guidelines.