Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageHow Google finds the mismatch
The Data safety section in App content asks what your app collects, what it shares, whether data is encrypted in transit and whether users can ask for deletion. Google compares these answers with two sources: the SDKs and permissions it detects in your bundle (the Google Mobile Ads SDK that ships with the WebViewGold template, OneSignal or Firebase when push is enabled, Crashlytics when tracking is on) and what the reviewer observes when using the app, such as a sign-up form that asks for name and email.
One detail trips up most web-wrapped apps: data entered into the WebView counts as collected by your app when you control the website it loads. Your Supabase or Firebase login, the analytics script Lovable added, the Stripe checkout on your domain: all of that is your app's data collection in Google's eyes, even though no native code touches it.
What a typical WebViewGold app collects
| Data type | Collected? | Typical purpose | Where it comes from |
|---|---|---|---|
| Name, email address | Yes, if you have a login | Account management | Supabase, Firebase Auth, Base44 users, your own backend |
| Device or other IDs | Yes, if push or ads are on | Push notifications, advertising | OneSignal or Firebase subscription ID, advertising ID via AdMob |
| Crash logs, diagnostics | Yes, if TRACKING_EVENT is true | Analytics, app stability | Firebase Crashlytics in WebViewGold |
| App interactions | Yes, if an analytics script runs | Analytics | Google Analytics, PostHog, Plausible and similar on your site |
| Approximate or precise location | Only if requireLocation is true and your web app asks | App functionality | HTML5 geolocation inside the WebView |
| Photos, files | Only if uploads leave the device | App functionality | File uploads from your web app |
| Purchase history, payment info | Yes, if you store orders | App functionality | Stripe, RevenueCat, your database |
Fill the form truthfully in twenty minutes
Inventory first, then answer. Guessing is what produced the mismatch.
Inventory the native side
Open Config.java and note which of these are true:
PUSH_ENABLED,FIREBASE_PUSH_ENABLED,PUSHWOOSH_ENABLED,SHOW_BANNER_AD,SHOW_FULL_SCREEN_AD,ENABLE_REWARDED_ADS,TRACKING_EVENT,requireLocation. Each true value is a data flow you must declare. In the Cloud Builder the same options are the feature toggles.Inventory the web side
List every third-party script and backend your web app talks to: auth provider, database, analytics, error tracking, chat widgets, payment provider, AI APIs that receive user prompts. Ask your builder to print the list if you are not sure; Cursor, Claude Code or Codex can grep the codebase for external hosts.
Use the vendors' own data safety guidance
OneSignal, Firebase and Google AdMob publish exactly which data types and purposes to declare for their SDKs. Copy those answers instead of guessing. Mark data sent to a vendor that only processes it on your behalf as collected; mark data an ad network uses for its own purposes as shared.
Answer the encryption question only if it is true
Declare encryption in transit when every request uses HTTPS. In WebViewGold for Android, switch cleartext traffic off as described in the support center and enable
BLOCK_SELF_SIGNED_AND_FAULTY_SSL_CERTSso a faulty certificate fails instead of silently going through.Answer the deletion question with a link
Say yes to "users can request deletion" only if there is a real path, and provide the web URL that Play shows on your listing. The account deletion guide covers the implementation.
Match the privacy policy
Every data type you declare must also appear in your privacy policy, and the policy must be reachable from the app and the listing. Then save the form and submit a new review; a changed form alone can be reviewed, but if you also changed Config.java, upload the new bundle first.
Great work! Never coded anything but managed to work with this. Easy and fast! Also with great help from the creators!
Mismatches that trigger the rejection
- "No data collected" while the app has a sign-up form or a login.
- No "Device or other IDs" declared while OneSignal, Firebase push or AdMob is enabled.
- Advertising ID not declared although the ads permission is in the merged manifest (see below).
- Encryption in transit declared while the WebView still loads http:// resources.
- "Data can be deleted" declared without a deletion page or in-app option.
- Privacy policy that describes a website and never mentions the app, push or ads.
Remove the advertising ID permission when you do not show ads
The Google Mobile Ads SDK is part of the WebViewGold Android template, and its manifest adds the Ad ID permission even when SHOW_BANNER_AD and SHOW_FULL_SCREEN_AD are false. If you do not use ads, remove the permission in AndroidManifest.xml with the manifest merger, then declare no advertising ID. If you do use ads, keep it and declare the advertising ID under "Device or other IDs".
xml
<!-- inside <manifest>, with xmlns:tools="http://schemas.android.com/tools" declared -->
<uses-permission android:name="com.google.android.gms.permission.AD_ID" tools:node="remove" />Frequently asked questions
Does WebViewGold itself collect data?
No. WebViewGold is a project template that runs on your account; there is no WebViewGold server receiving user data. What you declare depends on the services you enable (push, ads, Crashlytics) and on what your web app does.
I only use the Cloud Builder. Do I still need to know Config.java?
The toggles you set in the Cloud Builder map to the same options. Enabled push means device identifiers, enabled ads means advertising ID, enabled tracking means crash logs. Declare based on the toggles.
Do I have to declare data processed by Supabase or Firebase as shared?
Typically no. A backend that processes data on your behalf is a service provider, and that data is declared as collected by you. Check the vendor's own guidance if you use additional features such as third-party analytics.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.