Is the generated form guaranteed to be accepted?

No tool can promise that. Google holds the developer responsible for the declaration. The skill makes a draft, shows the evidence for each answer, and lists what it could not verify, such as what your backend does with the data.

Which SDKs does it know?

21 entries today, including Firebase Analytics, Crashlytics, Auth, Firestore and Cloud Messaging, AdMob, RevenueCat, Play Billing, Sign in with Google, ML Kit, OneSignal, Facebook, Sentry, Mixpanel, and the OpenAI and Gemini clients. Libraries it doesn't know are listed for you to review.

Does my code leave my machine?

The scan scripts run locally with Python and make no network calls. Your agent reads the findings like any other file in your project, under the same terms as the rest of your session.

Open-source agent skill for Android apps

Google Play Data safety form, filled from your code

Q: Does it submit the form for me?

No. It writes data_safety.csv and a report. You review them, then use Import to CSV in Play Console (App content, Data safety) and save. An optional upload through the Play Developer API is documented for teams that already publish from CI.

Your agent scans the manifest, Gradle files and source, matches every SDK against its vendor's disclosure, and writes the CSV that Play Console imports. Each answer comes with the file and line that justify it.

Get started View on GitHub

data_safety.csv Draft for review

Device or other IDsPSL_DEVICE_ID play-services-ads · build.gradle.kts:17Collected + shared
Crash logsPSL_CRASH_LOGS firebase-crashlytics · libs.versions.toml:12Collected
Approximate locationPSL_APPROX_LOCATION sent to your weather API · WeatherRepo.kt:42Collected

See it in 46 seconds

Why the Data safety form goes wrong

Every app on Google Play must declare what user data it collects and shares. Play Console’s form has 782 possible answers, and most of what an app collects comes from SDKs you didn’t write. An ads SDK can share your users’ device IDs. A crash reporter collects diagnostics. A “simple” analytics call sends app interactions. Miss one and the form no longer matches the app, which is what Google’s review checks.

SDKs you forgot aboutThe skill reads build.gradle, version catalogs and, if you run Gradle, the full dependency tree, then matches each SDK against its vendor’s Play disclosure.

Data your own code sendsIt finds HTTP clients, uploads, Firestore writes, analytics events, AI requests and sign-in code, and points your agent at each one to decide what leaves the device.

Rules that are easy to misreadCollected vs shared, service providers, ephemeral processing, IP-based location, Play Billing: the agent follows Google’s definitions, written down in the skill.

Evidence for every answerThe report links each true to a file and line, or to the SDK vendor’s page, and lists what still needs a human: your backend, older app versions, console settings.

How it works

Four steps: the agent reads AndroidManifest.xml, build.gradle.kts and Kotlin source; findings cite a file and line for each data type; the answers fill data_safety.csv in Play's own format; you import it in Play Console and review before saving.

Scan. A Python script reads your manifests, Gradle files, version catalog, source and network security config. No network calls, no dependencies.
Judge. Your agent checks each finding: is this data sent off the device? To a third party? Why? It asks you only what code can’t show, such as your deletion policy or what your backend shares.
Fill. The answers go into Google’s own CSV template. Only the answer column changes, so Play Console accepts the import.
Validate and report. Every conditional question is checked before you upload. The report shows each answer’s evidence and what changed compared to your current form.

See a full walkthrough →

SDKs it knows

Answers for these come from each vendor’s own Play data disclosure. All SDKs, including inferred entries →

Firebase AnalyticsDevice or other IDs, Approximate location, App interactionsCollected Firebase CrashlyticsCrash logs, Diagnostics, Device or other IDsCollected Firebase AuthenticationUser IDsCollected Cloud FirestoreDepends on how you use itCollected Firebase Cloud MessagingDevice or other IDsCollected Firebase Performance MonitoringDiagnostics, Device or other IDsCollected Firebase Remote ConfigDevice or other IDsCollected Firebase InstallationsDevice or other IDsCollected

Guides

Questions

Does it submit the form for me? No. You review the CSV and report, then import it yourself. More in the FAQ →

Is the result guaranteed to be accepted? No. It is a draft with evidence; you are responsible for the declaration. Why →

Which agents does it work with? Claude Code as a plugin, and Codex, Cursor, Copilot and other SKILL.md-aware agents through the skills CLI. Install →

Install

/plugin marketplace add sanikantv/data-safety-from-code
/plugin install data-safety-from-code@data-safety-from-code

claude plugin marketplace add sanikantv/data-safety-from-code
claude plugin install data-safety-from-code@data-safety-from-code

npx --yes skills add sanikantv/data-safety-from-code --skill data-safety-from-code -y

git clone https://github.com/sanikantv/data-safety-from-code.git
cp -r data-safety-from-code/skills/data-safety-from-code ~/.claude/skills/

Then, in your Android project:

/data-safety-from-code fill the Data safety form for this app

Your agent asks for your current Play Console export (App content → Data safety → Export to CSV), scans the project, asks a few questions, and writes data-safety/data_safety.csv and data-safety/data_safety_report.md.

Get started Star on GitHub

Built by Sanikant. Set in Google Sans Flex (SIL Open Font License), icons from Material Symbols (Apache 2.0). Google Play is a trademark of Google LLC; this project is not affiliated with Google. Output is a draft for review: you are responsible for your Data safety declaration.