Platform-Specific Disclosures for iOS & Android
Last Updated: 02-09-2026
Effective For: OLelectronics.com Mobile Application (“App”)
Companion Document: This supplement works in conjunction with our main Privacy Policy and Terms of Service.
Jurisdiction: India (with global accessibility)
Compliance Framework: Digital Personal Data Protection Act, 2023 (India) | GDPR (EU) | Apple App Store Guidelines | Google Play Developer Policies

📋 TABLE OF CONTENTS

1. Introduction & Scope
2. Platform-Specific Data Collection
3. App Permissions: Purpose & Control
4. Tracking & Identifiers: ATT, AAID, and More
5. Third-Party SDKs & Data Sharing
6. Platform-Specific User Rights & Controls
7. Children’s Privacy on Mobile
8. App Security & Data Protection
9. Data Deletion: Uninstall & Account Removal
10. Platform Compliance Disclosures
11. Updates & Version History
12. Contact & Support
13. Appendix: Permission Reference Tables

1. INTRODUCTION & SCOPE

1.1 Purpose of This Supplement

This Mobile App Privacy Supplement (“Supplement”) provides platform-specific disclosures required by:

• 🍎 Apple: App Store Review Guidelines, Privacy Nutrition Labels, App Tracking Transparency (ATT)
• 🤖 Google: Play Developer Policies, Data Safety Section, Permissions Declaration
• 🇮🇳 India: Digital Personal Data Protection Act, 2023 (mobile-specific obligations)
• 🇪🇺 EU: GDPR requirements for mobile data processing

This document supplements our main Privacy Policy. Where conflicts exist, the stricter standard applies.

1.2 App Identity & Distribution

1.3 Data Processing Roles

• Data Fiduciary/Controller: OLelectronics.com (for all App processing)
• App Store Platforms: Apple/Google act as distribution intermediaries, not data controllers for your in-App activities
• In-App Purchases: Processed by our payment partners; Apple/Google facilitate but do not control transaction data

🔹 Important: Downloading the App from Apple App Store or Google Play Store constitutes acceptance of their respective terms in addition to our Terms of Service and Privacy Policy.

2. PLATFORM-SPECIFIC DATA COLLECTION

2.1 Data Collected by Platform Infrastructure

2.2 Data We Collect Directly In-App

2.3 Data NOT Collected by the App

🚫 We do not collect via the App:

• Call logs, SMS content, or contact lists (unless explicitly granted for a specific feature like “invite friends”)
• Background location without active user consent and clear purpose disclosure
• Biometric data (Face ID, Fingerprint) beyond platform-authenticated login flows
• Data from other apps installed on your device
• Clipboard contents or screenshot data

3. APP PERMISSIONS: PURPOSE & CONTROL

3.1 Permission Philosophy

We follow privacy-by-design principles: ✅ Minimal: Only request permissions essential for core functionality
✅ Contextual: Explain why a permission is needed before the system prompt appears
✅ Granular: Allow feature use even if optional permissions are denied
✅ Reversible: Users can revoke permissions anytime via device settings

3.2 iOS Permissions (iOS [X.X]+)

3.3 Android Permissions (Android [X.X]+, API [XX]+)

3.4 Permission Request UX Best Practices

Before triggering the system permission dialog, we display a pre-permission explanation screen:

[App Name] Would Like to Access Your Camera📸 Why we need this:

Upload profile photos to personalize your account
Submit visual assignments for courses
Verify identity for secure transactions

🔒 Your control:

You can deny this permission and still use most features
Change anytime in Settings → Privacy → Camera
We never access your camera without your explicit action

[Not Now]  [Allow Access]

⚠️ Platform Compliance:

• iOS: We comply with Apple’s requirement to provide a NSCameraUsageDescription (and similar) in Info.plist
• Android: We declare permissions in AndroidManifest.xml with android:permissionGroup and runtime rationale

4. TRACKING & IDENTIFIERS: ATT, AAID, AND MORE

4.1 Identifier Inventory

4.2 App Tracking Transparency (iOS)

4.2.1 ATT Prompt Implementation

• We display Apple’s system ATT prompt only after a contextual pre-prompt explaining value
• Prompt text (localized): “[App Name] would like permission to track your activity across other companies’ apps and websites. This helps us show relevant course recommendations and measure our marketing. Your data is never sold.”

4.2.2 If User Declines ATT

✅ Features that still work:

• Core App functionality: browsing, purchasing, learning, community
• First-party analytics (aggregated, non-identifiable)
• Crash reporting and performance monitoring
• Transactional notifications

❌ Features that are limited:

• Personalized ad targeting on third-party platforms
• Cross-app attribution for marketing campaigns
• Behavioral retargeting based off-App activity

4.3 Android Advertising ID (AAID) Compliance

• We respect the user’s AAID opt-out or reset via Google Play Services
• If AAID is unavailable or opted-out, we fall back to:
  • Contextual (non-behavioral) ad serving
  • First-party analytics using anonymized identifiers
  • Conversion measurement via aggregated, privacy-preserving APIs (e.g., Google’s Privacy Sandbox)

4.4 No Fingerprinting or Probabilistic Tracking

🚫 We do not engage in:

• Device fingerprinting (combining non-resettable identifiers to recreate tracking)
• Probabilistic attribution without user consent
• Cross-device tracking without explicit, granular consent

5. THIRD-PARTY SDKS & DATA SHARING

5.1 SDK Inventory & Data Flows

We use third-party SDKs to enhance functionality. Each is governed by a Data Processing Agreement (DPA) compliant with DPDP Act and GDPR.

5.2 SDK Compliance Safeguards

✅ Data Minimization: SDKs configured to collect only essential data
✅ Anonymization: IP addresses truncated; user IDs hashed before transmission
✅ Retention Limits: Raw event data auto-deleted per SDK provider policies (e.g., Firebase: 14 months)
✅ Contractual Controls: DPAs require SDK providers to:

• Process data only on our instructions
• Implement equivalent security measures
• Assist with data subject requests
• Notify us of sub-processors

5.3 Platform-Specific SDK Restrictions

iOS (Apple Guidelines)

• All SDKs comply with Apple’s Privacy Manifest requirements
• We declare data collection purposes in PrivacyInfo.xcprivacy files
• No SDK collects data before ATT consent (where required)

Android (Google Play Policies)

• All SDKs declared in Play Console’s Data Safety section
• No hidden or undeclared data collection
• Compliance with User Data Policy and Permissions Policy

6. PLATFORM-SPECIFIC USER RIGHTS & CONTROLS

6.1 Accessing & Managing Your Data In-App

You can exercise many rights directly within the App:

6.2 Platform-Level Privacy Controls

iOS (Apple Ecosystem)

• App Privacy Report (iOS 15.2+): View data accessed by the App in Settings → Privacy → App Privacy Report
• Hide My Email: Supported for Sign in with Apple; generates unique, random email addresses
• Privacy Nutrition Labels: Accurately reflect our data practices in App Store listing

Android (Google Ecosystem)

• Data Safety Section: Transparent disclosure in Play Store listing about data collection/sharing
• Permission Dashboard: Android 12+ shows when/why permissions were used
• Private Compute Core: Leverages on-device processing for sensitive tasks (e.g., next-word prediction) where feasible

6.3 Exercising Formal Rights (DPDP/GDPR)

For rights requiring backend processing (erasure, portability, objection):

1. Open App → Profile → Privacy → “Request Data Rights”
2. Select right type and provide verification
3. Receive confirmation email with tracking ID
4. Monitor status in App → Support → My Requests

🔹 Verification: We may request additional ID verification for high-risk requests (e.g., erasure) to prevent unauthorized access.

7. CHILDREN’S PRIVACY ON MOBILE

7.1 Age Gating & Parental Consent

• Age Verification: During registration, users declare age. If under 18:
  • Users 13–17: Require verifiable parental consent via email confirmation + ID match
  • Users under 13: Account creation blocked; redirect to parent registration flow
• Parental Dashboard: Parents of minor users (13–17) receive:
  • Activity summaries (courses taken, time spent)
  • Permission management for camera, location, notifications
  • One-click data deletion request

7.2 Platform-Specific Child Protections

iOS (Apple)

• Complies with App Store Review Guideline 1.3 for Kids Category apps (if applicable)
• No behavioral advertising to users identified as minors
• ATT prompt not shown to users under 18 (per Apple policy)

Android (Google)

• Complies with Families Policy if targeting children
• No use of AAID for personalization to users under 18
• Clear disclosure in Data Safety section about child-directed content

7.3 Educational Content Safeguards

• Age-Appropriate Design: LMS content for minors avoids dark patterns, excessive gamification, or manipulative notifications
• No Profiling: Minors’ learning data is not used for behavioral advertising or cross-context profiling
• Enhanced Moderation: Forum posts by minor accounts undergo priority review for safety

8. APP SECURITY & DATA PROTECTION

8.1 Technical Safeguards (Mobile-Specific)

✅ Secure Storage:

• iOS: Keychain for tokens, sensitive prefs; Data Protection API for files
• Android: EncryptedSharedPreferences, Android Keystore for keys; scoped storage for files

✅ Network Security:

• TLS 1.3+ for all API communications
• Certificate pinning for critical endpoints (e.g., payments, auth)
• No sensitive data in URL parameters or logs

✅ Code Protection:

• iOS: Bitcode enabled, symbol stripping, jailbreak detection (non-intrusive)
• Android: ProGuard/R8 obfuscation, SafetyNet/Play Integrity API for device integrity

✅ Runtime Protection:

• Root/jailbreak detection (graceful degradation, not hard block)
• Debugging detection in production builds
• Tamper detection for in-App purchase validation

8.2 Data Minimization On-Device

• Local Caching: Only essential data cached locally (e.g., course progress); auto-purged after 30 days of inactivity
• No Unnecessary Collection: App does not access contacts, call logs, SMS, or other apps’ data unless explicitly granted for a declared feature
• Ephemeral Processing: Sensitive inputs (e.g., payment forms) never persisted to device storage

8.3 Secure Authentication Flows

• Biometric Login: Optional Face ID/Touch ID (iOS) or Fingerprint/Face Unlock (Android); falls back to password
• Session Management: Short-lived access tokens + refresh token rotation; remote logout capability
• 2FA Support: TOTP or SMS-based two-factor authentication for account security

9. DATA DELETION: UNINSTALL & ACCOUNT REMOVAL

9.1 What Happens When You Uninstall the App?

🔹 Important: Uninstalling the App does not delete your Account or backend data. To fully erase your data, use the in-App “Delete Account” feature or contact [privacy@olelectronics.com].

9.2 Account Deletion Process (In-App)

1. Navigate to: Profile → Security → Delete Account
2. Review consequences: loss of course access, order history, community contributions
3. Confirm via password or biometric authentication
4. Receive confirmation email with 30-day grace period (to prevent accidental deletion)
5. After 30 days:
   • Personal data erased from active systems
   • Anonymized analytics data retained for service improvement
   • Legal records (transactions) retained per tax law requirements

9.3 Platform-Specific Deletion APIs

• iOS: We implement ASAccountAuthenticationModification for seamless account deletion flow; support Apple’s Account Deletion API where applicable
• Android: We support Google’s Data Delete API for Play Store compliance; users can also request deletion via Play Store → App → Privacy

10. PLATFORM COMPLIANCE DISCLOSURES

10.1 Apple App Store Disclosures

Privacy Nutrition Labels (App Store Listing)

We accurately declare data practices per Apple’s categories:

ATT Prompt Justification (Required by Apple)

“We use tracking to show you relevant course recommendations based on your interests across apps and websites, and to measure the effectiveness of our marketing campaigns. You can change your choice anytime in Settings.”

10.2 Google Play Store Disclosures

Data Safety Section (Play Console)

We declare data practices transparently:

Data Types Declared:

• Personal info: Name, email address (collected, not shared)
• Financial info: Purchase history (collected, not shared)
• App activity: In-app actions, course progress (collected, not shared)
• App info & performance: Crash logs, diagnostics (collected, not shared)
• Device or other IDs: IDFV, Firebase ID (collected; shared only with analytics partners under DPA)

10.3 Regional Compliance Addenda

India (DPDP Act Mobile Obligations)

• Consent Artifacts: We maintain auditable records of in-App consent prompts (timestamp, version, user action)
• Grievance Redressal: In-App “Help → Privacy Complaint” flow routes to our DPDP-mandated Grievance Officer
• Data Localization: Primary processing occurs in India; cross-border transfers use DPDP-prescribed safeguards

EU/EEA (GDPR Mobile Obligations)

• Lawful Basis Transparency: Each in-App data collection point references its legal basis (e.g., “We use this to fulfill your order [Contract]”)
• DPIA for Mobile Features: We conducted Data Protection Impact Assessments for high-risk processing (e.g., location-based course recommendations)
• SCCs for Transfers: Standard Contractual Clauses govern any data transfers outside the EEA

11. UPDATES & VERSION HISTORY

11.1 Policy Update Process

• This Supplement is reviewed quarterly and updated for:
  • New OS versions (iOS/Android) with privacy changes
  • New SDK integrations or permission requirements
  • Changes in DPDP/GDPR enforcement guidance
  • Platform policy updates (Apple/Google)

11.2 Notifying Users of Changes

For material changes (e.g., new data collection, reduced rights):

1. Update this Supplement with new “Last Updated” date
2. Display in-App notice at next launch: “We’ve updated our Mobile Privacy Supplement. Review changes [here]. Continued use accepts the update.”
3. Email registered users with summary of changes and link to full document
4. Allow 7 days for review before changes take effect

11.3 Version History

Archived versions available at [privacy.yourcompany.com/app-privacy-history]

12. CONTACT & SUPPORT

12.1 Privacy-Specific Contacts

12.2 Platform-Specific Support Channels

Apple App Store

• Report a Concern: App Store → [App Name] → “…” → Report a Concern
• Privacy Inquiries: Apple’s Privacy Portal for account-level requests

Google Play Store

• Data Safety Feedback: Play Store → [App Name] → Data Safety → “Provide feedback”
• Policy Questions: Google Play Console → Policy Status → Contact Support

12.3 Physical Address for Legal Notices

OLelectronics.com
Attn: Mobile Privacy Compliance
House No: 346, 1st Floor, Police Station, Zoo-Narengi Rd, opp. Barista Cafe and Geetanagar, Ambikagirinagar
Guwahati, Assam, 781024, India

For secure document submission, request our encrypted upload portal via email.

13. APPENDIX: PERMISSION REFERENCE TABLES

13.1 iOS Permission Keys (Info.plist)

<!-- Camera Usage -->
<key>NSCameraUsageDescription</key>
<string>Upload profile photos, submit visual assignments, or verify your identity securely.</string><!-- Photo Library Usage -->
<key>NSPhotoLibraryUsageDescription</key>
<string>Select images from your library to personalize your profile or submit course assignments.</string>
<!-- Location Usage -->
<key>NSLocationWhenInUseUsageDescription</key>
<string>Localize course content, calculate accurate shipping, and show region-specific offers.</string>
<key>NSLocationAlwaysAndWhenInUseUsageDescription</key>
<string>(Only if background location essential) Provide location-based course reminders when you're near relevant venues.</string>
<!-- Microphone Usage -->
<key>NSMicrophoneUsageDescription</key>
<string>Record audio for language practice, voice notes in forums, or assignment submissions.</string>
<!-- Tracking Usage (ATT) -->
<key>NSUserTrackingUsageDescription</key>
<string>We use tracking to personalize course recommendations and measure marketing effectiveness. Your data is never sold.</string>

13.2 Android Permission Declarations (AndroidManifest.xml)

<!-- Camera -->
<uses-permission android:name="android.permission.CAMERA" 
    android:maxSdkVersion="33" />
<!-- Android 13+ media permissions -->
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
<uses-permission android:name="android.permission.READ_MEDIA_VIDEO" /><!-- Location -->
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
<!-- Android 13+ notification permission -->
<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
<!-- Runtime Permission Rationale (shown before system prompt) -->
<!-- Implemented in code via ActivityCompat.shouldShowRequestPermissionRationale() -->

13.3 Permission Decision Tree (User Flow)

User triggers feature requiring permission
        │
        ▼
Is permission essential for core functionality?
├─ Yes → Show system prompt with contextual rationale
└─ No  → Show optional feature explanation + "Not Now" / "Allow"
        │
        ▼
User grants/denies permission
        │
        ▼
If denied: 
  • Disable feature gracefully
  • Offer alternative (e.g., "Upload later from web")
  • Allow re-prompt after 30 days or user-initiated retry