reis-mobile 0.3.6 → 0.4.0

package/skills/android-play-policy-insights/resources/goal_user_account.md

@@ -0,0 +1,106 @@
+{{#IF_ANY data_sources.USER_ACCOUNT, data_sources.ACCOUNT_DELETION}}
+{{ACTIVATE_GOAL}}
+{{/IF_ANY}}
+## User Account and Identity Audit
+
+### Hint: Deducing Account Presence
+
+To determine if an app handles user accounts (even if it uses third-party
+providers like Google Sign-In or Firebase Auth), look for:
+1. **Login/Auth Screens**: Semantic files or layouts named `login`, `auth`,
+   `signin`, or `signup`.
+2. **Account Management**: APIs like `AccountManager`, `CredentialManager`, or
+   `Firebase.auth`.
+3. **User Profile**: UI strings or data models referencing `profile`,
+   `my account`, or `user settings`.
+
+### Policies to Verify
+
+{{#IF_ANY data_sources.USER_ACCOUNT, semantic_files.USER_ACCOUNT}}
+#### Play Console Requirements (Policy ID: login_credentials)
+
+- **Goal**: Identify if the app implements a login wall or authentication
+  screen.
+- **The Policy Spirit**: To ensure Play Store reviewers can successfully test
+  and audit apps, developers must submit functional, non-expiring credentials in
+  Play Console if the app's features are gated behind a login screen.
+- **Evidence**:
+  {{#IF semantic_files.USER_ACCOUNT}}
+  - **Account Files**:
+    `{{#EACH semantic_files.USER_ACCOUNT}}{{ITEM}}, {{/EACH}}`
+  {{/IF}}
+  {{#IF data_sources.USER_ACCOUNT}}
+  - **Account Signals**:
+    `{{#EACH data_sources.USER_ACCOUNT}}{{ITEM}}, {{/EACH}}`
+  {{/IF}}
+- **Common Evaluation Matrix**:
+  | App State | Finding / Condition | Severity | Actionable Recommendation |
+  | :--- | :--- | :--- | :--- |
+  | **Login Screen Detected** | App displays or contains a login screen, registration wall, or authentication interface. | `IMPORTANT` | **Administrative Console Requirements**: Because your app implements a login flow, you MUST complete two manual setup steps in the Play Console dashboard to pass review:<br>1. **Reviewer Demo Credentials**: Submit active, non-expiring test credentials so Google Play reviewers can access your gated features.<br>2. **Account Deletion Link**: Submit a public-facing web link for account deletion to satisfy Google Play's data deletion policies. |
+
+- **Domain-Specific Heuristics (Strictly Bounded)**:
+  Look beyond standard native login buttons. Extrapolate using this heuristic:
+  1. **Hidden Gatekeepers**: Analyze if certain critical features (e.g.,
+     synchronizing local database, checkout forms, or member-only dashboards)
+     require authentication even if the app opens directly to a main page. If
+     you deduce that functional workflows require a login, treat it as a login
+     gate and output the `IMPORTANT` console credentials and deletion link
+     reminders.
+{{/IF_ANY}}
+
+{{#IF_ANY data_sources.USER_ACCOUNT, data_sources.ACCOUNT_DELETION}}
+#### Account Deletion Requirement (Policy ID: account_deletion)
+
+- **Goal**: If the app handles user accounts, it must provide a discoverable
+  in-app account deletion mechanism.
+- **The Policy Spirit**: Users have a fundamental right to request data erasure.
+  If they can create an account in-app, they must be able to delete it in-app.
+  Deletion must wipe remote database records, not just sign out.
+- **Evidence**:
+  {{#IF data_sources.USER_ACCOUNT}}
+  - **Account signals (Presence)**:
+    `{{#EACH data_sources.USER_ACCOUNT}}{{ITEM}}, {{/EACH}}`
+  {{/IF}}
+  {{#IF data_sources.ACCOUNT_DELETION}}
+  - **Deletion signals (Mechanism)**:
+    `{{#EACH data_sources.ACCOUNT_DELETION}}{{ITEM}}, {{/EACH}}`
+  {{/IF}}
+- **Common Evaluation Matrix**:
+  | App Account Status | Finding / Deletion Evidence | Severity | Actionable Recommendation |
+  | :--- | :--- | :--- | :--- |
+  | **Handles User Accounts** | App manages user accounts, but NO code, layout, or string suggests an in-app deletion button or process. | `IMPORTANT` | **Implement in-app deletion**: Create a highly discoverable path (e.g., under User Profile/Account Settings) to let users initiate account deletion directly in the app. |
+
+- **Domain-Specific Heuristics (Strictly Bounded)**:
+  Do not limit your analysis to basic "Delete" buttons. Actively analyze custom
+  and grey-area implementations:
+  1. **The Partial Deletion Trap**: Read the implementation of any found
+     deletion mechanisms. If the code merely calls `clearPreferences()`, clears
+     a local cookie, or triggers a standard `logout()` without sending a remote
+     delete/purge network API call to clean up backend user records, flag this
+     as a `IMPORTANT` violation of the deletion mandate.
+  2. **Indirect User Accounts**: If the app uses third-party sign-in bridges
+     (e.g., Google Sign-In, Firebase) but does not store an
+     explicit account profile on its own server, it still handles user account
+     details if any user preferences or device identifiers are cached remotely.
+     If so, a delete link/button is still required.
+{{/IF_ANY}}
+
+## Output schema
+
+Save final JSON output to `{{TEMP_DIR}}/worker_{{GOAL_NAME}}.json`.
+
+```json
+{
+  "domain": "User Account and Identity",
+  "findings": [
+    {
+      "policy_id": "STRING_VALUE (The exact Policy ID, e.g., account_deletion)",
+      "issue_summary": "STRING_VALUE",
+      "severity": "CRITICAL | IMPORTANT | SUGGESTION",
+      "files_involved": ["STRING_VALUE"],
+      "evidence": "STRING_VALUE",
+      "recommendation": "STRING_VALUE"
+    }
+  ]
+}
+```

package/skills/android-play-policy-insights/resources/policies.json

@@ -0,0 +1,321 @@
+{
+  "data_safety_section": {
+    "name": "Data safety section",
+    "category": "User Data",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/10144311#safetysection",
+      "https://developer.android.com/privacy-and-security/declare-data-use",
+      "https://support.google.com/googleplay/android-developer/answer/10787469"
+    ],
+    "taxonomy": {
+      "PRECISE_LOCATION": {
+        "category": "Location",
+        "data_type": "Precise location",
+        "description": "User or device physical location within an area less than 3 square kilometers, such as location provided by Android’s ACCESS_FINE_LOCATION permission."
+      },
+      "APPROX_LOCATION": {
+        "category": "Location",
+        "data_type": "Approximate location",
+        "description": "User or device physical location to an area greater than or equal to 3 square kilometers, such as the city a user is in, or location provided by Android’s ACCESS_COARSE_LOCATION permission."
+      },
+      "USER_ACCOUNT": {
+        "category": "Personal info",
+        "data_type": "User IDs",
+        "description": "Identifiers that relate to an identifiable person. For example, an account ID, account number, or account name."
+      },
+      "NAME": {
+        "category": "Personal info",
+        "data_type": "Name",
+        "description": "How a user refers to themselves, such as their first or last name, or nickname."
+      },
+      "EMAIL": {
+        "category": "Personal info",
+        "data_type": "Email address",
+        "description": "A user’s email address."
+      },
+      "ADDRESS": {
+        "category": "Personal info",
+        "data_type": "Address",
+        "description": "A user’s address, such as a mailing or home address."
+      },
+      "PHONE": {
+        "category": "Personal info",
+        "data_type": "Phone number",
+        "description": "A user’s phone number."
+      },
+      "RACE_ETHNICITY": {
+        "category": "Personal info",
+        "data_type": "Race and ethnicity",
+        "description": "Information about a user’s race or ethnicity."
+      },
+      "POLITICAL_RELIGIOUS_BELIEFS": {
+        "category": "Personal info",
+        "data_type": "Political or religious beliefs",
+        "description": "Information about a user’s political or religious beliefs."
+      },
+      "SEXUAL_ORIENTATION": {
+        "category": "Personal info",
+        "data_type": "Sexual orientation",
+        "description": "Information about a user’s sexual orientation."
+      },
+      "PERSONAL_INFO_OTHER": {
+        "category": "Personal info",
+        "data_type": "Other info",
+        "description": "Any other personal information such as date of birth, gender identity, veteran status, etc."
+      },
+      "CREDIT_DEBIT_BANK_ACCOUNT_NUMBER": {
+        "category": "Financial info",
+        "data_type": "User payment info",
+        "description": "Information about a user’s financial accounts such as credit card number."
+      },
+      "PURCHASE_HISTORY": {
+        "category": "Financial info",
+        "data_type": "Purchase history",
+        "description": "Information about purchases or transactions a user has made."
+      },
+      "CREDIT_SCORE": {
+        "category": "Financial info",
+        "data_type": "Credit score",
+        "description": "Information about a user’s credit score."
+      },
+      "FINANCIAL_INFO_OTHER": {
+        "category": "Financial info",
+        "data_type": "Other financial info",
+        "description": "Any other financial information such as user salary or debts."
+      },
+      "HEALTH": {
+        "category": "Health and fitness",
+        "data_type": "Health info",
+        "description": "Information about a user's health, such as medical records or symptoms."
+      },
+      "FITNESS": {
+        "category": "Health and fitness",
+        "data_type": "Fitness info",
+        "description": "Information about a user's fitness, such as exercise or other physical activity."
+      },
+      "EMAILS": {
+        "category": "Messages",
+        "data_type": "Emails",
+        "description": "A user’s emails including the email subject line, sender, recipients, and the content of the email."
+      },
+      "SMS_CALL_LOG": {
+        "category": "Messages",
+        "data_type": "SMS or MMS",
+        "description": "A user’s text messages including the sender, recipients, and the content of the message."
+      },
+      "OTHER_MESSAGES": {
+        "category": "Messages",
+        "data_type": "Other in-app messages",
+        "description": "Any other types of messages. For example, instant messages or chat content."
+      },
+      "PHOTOS": {
+        "category": "Photos and videos",
+        "data_type": "Photos",
+        "description": "A user’s photos."
+      },
+      "VIDEOS": {
+        "category": "Photos and videos",
+        "data_type": "Videos",
+        "description": "A user’s videos."
+      },
+      "AUDIO": {
+        "category": "Audio files",
+        "data_type": "Voice or sound recordings",
+        "description": "A user’s voice such as a voicemail or a sound recording."
+      },
+      "MUSIC": {
+        "category": "Audio files",
+        "data_type": "Music files",
+        "description": "A user’s music files."
+      },
+      "OTHER_AUDIO": {
+        "category": "Audio files",
+        "data_type": "Other audio files",
+        "description": "Any other user-created or user-provided audio files."
+      },
+      "FILES_AND_DOCS": {
+        "category": "Files and docs",
+        "data_type": "Files and docs",
+        "description": "A user’s files or documents, or information about their files or documents such as file names."
+      },
+      "CALENDAR": {
+        "category": "Calendar",
+        "data_type": "Calendar events",
+        "description": "Information from a user’s calendar such as events, event notes, and attendees."
+      },
+      "CONTACTS": {
+        "category": "Contacts",
+        "data_type": "Contacts",
+        "description": "Information about the user’s contacts such as contact names, message history, and social graph information like usernames, contact recency, contact frequency, interaction duration and call history."
+      },
+      "APP_INTERACTIONS": {
+        "category": "App activity",
+        "data_type": "App interactions",
+        "description": "Information about how a user interacts with the app. For example, the number of times they visit a page or sections they tap on."
+      },
+      "IN_APP_SEARCH_HISTORY": {
+        "category": "App activity",
+        "data_type": "In-app search history",
+        "description": "Information about what a user has searched for in your app."
+      },
+      "APPS_ON_DEVICE": {
+        "category": "App activity",
+        "data_type": "Installed apps",
+        "description": "Information about the apps installed on a user's device."
+      },
+      "USER_GENERATED_CONTENT": {
+        "category": "App activity",
+        "data_type": "Other user-generated content",
+        "description": "Any other user-generated content not listed here, or in any other section. For example, user bios, notes, or open-ended responses."
+      },
+      "OTHER_ACTIONS": {
+        "category": "App activity",
+        "data_type": "Other actions",
+        "description": "Any other user activity or actions in-app not listed here such as gameplay, likes, and dialog options."
+      },
+      "WEB_BROWSING_HISTORY": {
+        "category": "Web browsing",
+        "data_type": "Web browsing history",
+        "description": "Information about the websites a user has visited."
+      },
+      "CRASH_LOGS": {
+        "category": "App info and performance",
+        "data_type": "Crash logs",
+        "description": "Crash log data from your app. For example, the number of times your app has crashed, stack traces, or other information directly related to a crash."
+      },
+      "PERFORMANCE_DIAGNOSTICS": {
+        "category": "App info and performance",
+        "data_type": "Diagnostics",
+        "description": "Information about the performance of your app. For example battery life, loading time, latency, framerate, or any technical diagnostics."
+      },
+      "OTHER_APP_PERFORMANCE": {
+        "category": "App info and performance",
+        "data_type": "Other app performance data",
+        "description": "Any other app performance data excluding crash log data (e.g., stack traces) and diagnostics (e.g., battery life, loading time, latency, or framerate)."
+      },
+      "DEVICE_ID": {
+        "category": "Device or other IDs",
+        "data_type": "Device or other IDs",
+        "description": "Identifiers that relate to an individual device, browser or app. For example, an IMEI number, MAC address, Widevine Device ID, Firebase installation ID, or advertising identifier."
+      }
+    }
+  },
+  "login_credentials": {
+    "name": "Login credentials",
+    "category": "Play Console Requirements",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/15748846"
+    ]
+  },
+  "sms_call_log_policy": {
+    "name": "SMS and Call Log Permissions",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#sms-call-permissions",
+      "https://support.google.com/googleplay/android-developer/answer/10208820"
+    ]
+  },
+  "package_visibility_policy": {
+    "name": "Package Visibility",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#package-vis",
+      "https://support.google.com/googleplay/android-developer/answer/10158779"
+    ]
+  },
+  "all_files_access_policy": {
+    "name": "All Files Access",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#all-files-access",
+      "https://developer.android.com/training/data-storage/manage-all-files",
+      "https://support.google.com/googleplay/android-developer/answer/10467955"
+    ]
+  },
+  "photo_video_access_policy": {
+    "name": "Photo and Video Permissions",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#photo-and-video-permissions",
+      "https://support.google.com/googleplay/android-developer/answer/16935362",
+      "https://developer.android.com/training/data-storage/shared/media"
+    ]
+  },
+  "location_access_policy": {
+    "name": "Location Permissions",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241",
+      "https://support.google.com/googleplay/android-developer/answer/9799150"
+    ] 
+  },
+  "contacts_access_policy": {
+    "name": "Contacts Permissions",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16909972#contacts-permissions",
+      "https://support.google.com/googleplay/android-developer/answer/16935362"
+    ] 
+  },
+  "audio_recording_policy": {
+    "name": "Audio Recording Policy",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/10144311",
+      "https://support.google.com/googleplay/android-developer/answer/16558241"
+    ]
+  },
+  "files_and_docs_policy": {
+    "name": "Files and Docs Access Policy",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/10467955",
+      "https://support.google.com/googleplay/android-developer/answer/16558241"
+    ]
+  },
+  "prominent_disclosure_policy": {
+    "name": "Prominent Disclosure Policy",
+    "category": "User Data",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/10144311"
+    ]
+  },
+  "account_deletion": {
+    "name": "Account Deletion Requirement",
+    "category": "User Data",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/10144311#account_deletion",
+      "https://support.google.com/googleplay/android-developer/answer/13327111"
+    ]
+  },
+  "target_api_level": {
+    "name": "Target API Level Requirements",
+    "category": "Privacy, Deception and Device Abuse",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16561298",
+      "https://support.google.com/googleplay/android-developer/answer/11926878"
+    ]
+  },
+  "accessibility_api_policy": {
+    "name": "Accessibility API Policy",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#accessibility"
+    ]
+  },
+  "exact_alarm_policy": {
+    "name": "Exact Alarm Policy",
+    "category": "Permissions",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/16558241#exact_alarm"
+    ]
+  },
+  "foreground_services_policy": {
+    "name": "Foreground Services",
+    "category": "Privacy, Deception and Device Abuse",
+    "urls": [
+      "https://support.google.com/googleplay/android-developer/answer/13392821",
+      "https://support.google.com/googleplay/android-developer/answer/16559646#foreground_service"
+    ]
+  }
+}