Privacy is a huge concern to most customers. Part of the Windows
Store app certification process includes checking for the presence
of a privacy policy if your app declares any capabilities which
could affect privacy.
MSDN has a section (4.1.1) explaining what is expected
from the privacy policy. I won't quote it here, but some important
points jump out (emphasis mine):
Declaring certain capabilities in your app manifest
makes us think your app collects the corresponding private
information. For example, declaring Internet capabilities
(internetClient, internetClientServer) in the app manifest makes us
think you're collecting the IP number of the user.
Note that the default templates for apps in Visual Studio
include the internetClient capability, so unless you change the
default manifest, you will need a privacy policy.
So if your app connects to the Internet, you need a privacy
policy explaining what you do with the information (IP numbers, for
example).
Similarly, if your app captures Webcam images, Audio or
video recordings, accesses Photos, Contacts, or Documents, or
collects user-entered name, address, date of birth or other
personally identifiable information (PII), you must have a
privacy policy.
The format and structure of the privacy policy is up to you and
your lawyer. It's a legal document, just like an EULA or other
license agreement. For those reasons, Microsoft does not provide a
template or any guidance on the format of the document other than
the following:
In general, an acceptable privacy policy is one that:
- Informs users of the information collected by your app
- Informs users how that information is used, stored, secured and
disclosed
- Describes the controls that users have over the use and sharing
of their information
- Describes how they may access their information
- Complies with applicable laws and regulations
Again, refer to our official documentation on the topic on MSDN
for any updates to this guidance.
Viewing the Policy
Prior to installation, the privacy policy is also available on
the app's page in the store. Once installed, the privacy policy is
accessed through the Settings pane in the app, as shown here:
By way of example, here's part of the privacy policy flyout page
for an app:
So, you can see that the policy doesn't need to be written in
legalese, but can instead be plain text which explains the
information collected and what you do with it.
