Skip to main content
Google Play requires every developer to declare how their app collects and handles user data, including data handled by any third-party SDK they bundle. This page tells you which boxes to tick in the Play Console Data safety section when your app includes the Helium Android SDK.
Google is explicit that the declaration is yours to make: “You alone are responsible for making complete and accurate declarations in your app’s store listing on Google Play.” This page covers the Helium SDK only. Your final declaration must also account for your own app’s data collection and every other SDK you ship.

​
Data collection and security

Three questions gate the rest of the form.

​
Does your app collect or share any of the required user data types?

Select Yes. Helium collects a device identifier, purchase history, and paywall interaction data.

​
Is all of the user data collected by your app encrypted in transit?

Select Yes as far as Helium is concerned. All Helium network traffic uses HTTPS.
Google only lets you select “Yes” if encryption in transit applies to all user data your app and every one of its SDKs transmits off the device. Confirm this holds across your whole app before selecting it.

​
Do you provide a way for users to request that their data is deleted?

This one depends on your own support process, not on Helium. If you select Yes, make sure users have a route to reach you, such as an in-app link, a contact form, or a support email. On the client, Helium.resetHelium() clears the locally persisted Helium identity and user traits. For deletion of data already sent to Helium, contact Helium support.

​
Data types

✅ Required when using Helium💡 May be required, depending on how you configure the SDK❌ Not collected by Helium
Helium declares more than a billing-only SDK would, because paywall interaction data is what powers experiments and optimization rather than being a side effect. The four bolded rows above are the ones you always need.

​
Answering the per-data-type questions

For each data type you select, Google asks four follow-up questions. All four required Helium data types (Purchase history, App interactions, Diagnostics, and Device or other IDs) get the same answers. Any 💡 rows that apply to your setup generally follow the same pattern, though review the purposes for your own case.

​
Is this data collected, shared, or both?

Select Collected if Helium processes this data solely on your behalf and under your instructions. That is Google’s test for a service provider, and sharing does not apply. Select Collected and Shared, and declare the purposes of that sharing, if either of the following is true:
  • Helium uses your app’s data for its own cross-customer optimization or experiment purposes rather than solely on your instructions.
  • You forward Helium events to third parties that are not acting as your service providers.
Google is explicit that “if an SDK provider is building advertising profiles across multiple customers based on your app data, that would not be considered ‘service provider’ activity.” Confirm which of the above describes your contract and configuration before answering.

​
Is this data processed ephemerally?

Select No. Helium retains this data to power paywall experimentation and reporting.

​
Is this data required for your app, or can users choose whether it’s collected?

Select Data collection is required by default. The Helium SDK does not expose a per-user opt-out, so once you initialize it, collection begins.
You can declare this data optional instead if you gate Helium.initialize() behind your own consent prompt and only call it for users who agree. Google’s bar is that all users, regardless of device or region, must be able to opt in or out.
A consent gate answers this Play Data safety question only. It does not by itself establish compliance with GDPR, CCPA, or other privacy regimes, which impose separate requirements such as having a lawful basis for processing, giving notice at collection, and handling consumer rights requests. Review the jurisdictions you operate in with privacy counsel.

​
Why is this user data collected?

Select App functionality and Analytics.
Also select Personalization if you use audience targeting or experiment rules that tailor which paywall a user sees based on traits you provide.

​
What Helium does not collect

Worth knowing, because it keeps several categories off your form entirely:
  • No advertising identifier. Helium does not read the Google Advertising ID or App Set ID, and declares no com.google.android.gms.permission.AD_ID permission.
  • No location. No location APIs, no location permissions.
  • No contacts, photos, videos, audio, files, calendar, or messages.
  • No crash logs. Helium bundles no crash reporting library.
  • No health or fitness data.
The SDK contributes only these permissions to your merged manifest:

​
Optional modules

Two Helium modules change your answers if you use them.
The revenue-cat module sets Helium’s persistent installation ID as the RevenueCat app user ID, and by default also as a helium_hpid subscriber attribute. You can turn the attribute off by constructing the delegate with allowHeliumUserAttribute = false.Using this module means RevenueCat’s own data collection applies to your app as well. Refer to RevenueCat’s Data Safety guidance alongside this page.

​
What’s next

Identifying Users

How Helium.identity.userId and HeliumUserTraits work, which drive the conditional rows above

Google's Official Guidance

Play Console documentation for the Data safety section