App Submission & Compliance
Integrating PPCashDeskSDK affects your App's privacy declarations and review configurations on the App Store and Google Play. The SDK has fulfilled its own compliance requirements (Privacy Manifest, data encryption, etc.). The following describes what merchants need to know and do.
SDK Data Collection
Data Collected Directly by the SDK
| Data Type | Details | Purpose | Storage |
|---|---|---|---|
| Payment Information | Card number, CVV, expiry date | Complete payment authorization | Encrypted via RSA-OAEP for transmission; no plaintext stored |
| Billing Address | Name, street, city, state/province, postal code, country, email, phone | Payment verification and risk control | Not persisted locally |
| Device Identifier | IDFV (iOS only) | Unique device identification; not an advertising identifier | Not persisted locally |
| Usage Data | App version, device type (iOS/Android) | Compatibility and feature support | Not persisted locally |
| Diagnostics | Request ID (random UUID), error logs | Request tracing and troubleshooting | Not persisted locally |
| Language Preference | Current language setting | SDK UI localization | Not persisted locally |
Data Collected Indirectly via the Risk Device Fingerprint Module
| Data Type | Default State | Purpose | Configurable |
|---|---|---|---|
| Sensor Data (accelerometer, gyroscope) | Enabled | Device environment profiling | Can be disabled via configuration |
| Behavioral Biometrics (touch patterns, interaction behavior) | Enabled | Fraud behavior detection | Can be disabled via configuration |
| System Boot Time | Enabled | Anti-tampering / timestamp verification | Not configurable |
| File Timestamps | Enabled | File integrity check | Not configurable |
| Disk Space | Enabled | Device environment profiling | Not configurable |
| Precise Location | Disabled | High-precision geolocation risk control | Can be enabled via configuration |
| Coarse Location | Disabled | Region-level geolocation risk control | Can be enabled via configuration |
Configuration
For items marked "Can be disabled/enabled via configuration", refer to the Embedded SDK - iOS Integration Guide or Embedded SDK - Android Integration Guide for details.
Impact on Store Review
The data collection described above requires merchants to complete platform-specific privacy declaration configurations before submission:
iOS App Store — Verify Privacy Manifest integration, complete App Privacy Labels, and disclose SDK information in Review Notes.
Android Google Play — Complete Data Safety declaration and verify permission declarations.
Privacy Policy (both platforms) — Disclose the use of PPCashDeskSDK for payment processing in your App's privacy policy, including the Risk Device Fingerprint Module's data collection behavior.
Compliance Inquiries
For further questions about data collection and privacy compliance, please contact your PingPong account manager or legal team.
iOS App Store Submission Guide
This section describes the compliance impact of integrating PPCashDeskSDK on iOS App Store review, and the actions merchants need to take.
Privacy Manifest Requirements
Privacy Manifest Included in the SDK
SDK includes Privacy Manifest
PPCashDeskSDK ships with a PrivacyInfo.xcprivacy file covering all built-in modules, including the Risk Device Fingerprint Module. Xcode automatically merges the SDK's Privacy Manifest with the app's Privacy Manifest at build time. No manual copying is required.
Apple states:
Any version of a listed SDK, as well as any SDKs that repackage those on the list, are included in the requirement.
This means that as long as the SDK itself has correctly declared its API usage, the app does not need to re-declare the APIs used internally by the SDK.
What merchants need to do
- Verify the integration method: Integrate PPCashDeskSDK via CocoaPods or Swift Package Manager and confirm that the SDK's
PrivacyInfo.xcprivacyfile is included in the app bundle. - Check the Xcode merge result: After building, review the Privacy Manifest merge log in Xcode's Report Navigator and confirm there are no errors.
- Declare app-level data separately: If the app itself, outside the SDK, collects additional data, declare it in the app's own
PrivacyInfo.xcprivacy.
Required Reason API declarations
PPCashDeskSDK declares the following Required Reason APIs in its Privacy Manifest:
| API Category | Reason Code | Purpose |
|---|---|---|
| UserDefaults | CA92.1 | Stores SDK runtime configuration and session state |
| File Timestamp | C617.1 | Risk Device Fingerprint Module reads file timestamps for device characteristic collection |
| Disk Space | E174.1 | Risk Device Fingerprint Module reads disk space information for device characteristic collection |
Note
These APIs are used internally by the SDK. Merchants do not need to re-declare these entries in their own Privacy Manifest unless the app code independently uses the same APIs.
App Store Connect compliance configuration
The following configurations are required in App Store Connect due to SDK integration:
| Item | Guideline | Merchant Action |
|---|---|---|
| App Privacy Labels include SDK data collection items | 5.1.1 | Refer to the SDK data collection tables above and accurately fill in the SDK data types in Privacy Labels |
| Privacy Policy discloses use of PPCashDeskSDK | 5.1.2 | Describe the SDK data types and purposes in the privacy policy, including the Risk Device Fingerprint Module |
| Review Notes explain that the SDK includes a Risk Device Fingerprint Module | 2.3.1 | Proactively disclose this to prevent reviewers from flagging it |
Changelog
| Date | Change |
|---|---|
| 2026-04-15 | Initial version |
Android Google Play Submission Guide
This section describes the compliance impact of integrating PPCashDeskSDK on Google Play review, and the actions merchants need to take.
Note
This section is derived from general SDK behavior. Some Android-specific configuration items are still pending final confirmation from the Android SDK team. Items marked as pending confirmation should be verified against the SDK release notes.
Data Safety Declaration
Google Play requires all apps to accurately declare data collection practices in the Data Safety form in Play Console. The following items need to be declared due to PPCashDeskSDK integration.
SDK data type mapping
| SDK Collected Data | Data Safety Category | Purpose | Optional |
|---|---|---|---|
| Payment info (card number, CVV) | Financial info > Credit/debit card info | App functionality | No |
| Billing address | Personal info > Address | App functionality | No |
| Device identifier | Device or other IDs | App functionality | No |
| Sensor data (accelerometer, gyroscope) | App activity > Other actions | Fraud prevention, Security | Yes (can be disabled by configuration) |
| Behavioral biometrics (touch patterns) | App activity > Other actions | Fraud prevention, Security | Yes (can be disabled by configuration) |
Permission Requirements
Android permissions used by the SDK
| Permission | Type | Purpose |
|---|---|---|
android.permission.INTERNET | Normal permission | Initiate payment network requests |
android.permission.ACCESS_NETWORK_STATE | Normal permission | Detect network connectivity |
These are normal permissions and are granted automatically by the system, without requiring user prompts.
Permissions not used by the SDK
The following sensitive permissions are not requested or used by PPCashDeskSDK: CAMERA, READ_CONTACTS, ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION (unless the merchant explicitly enables location features), and READ_PHONE_STATE.
What merchants need to do
- Confirm that only actually used permissions are declared in
AndroidManifest.xml - In Play Console under App content > Permissions, provide a usage description for SDK-related permissions
Changelog
| Date | Change |
|---|---|
| 2026-04-15 | Initial version, derived from general SDK behavior |