department-of-veterans-affairs / va-mobile-app

"If VA were a company, it would have a flagship mobile app."
https://department-of-veterans-affairs.github.io/va-mobile-app/
17 stars 2 forks source link

va.gov and flagship mobile app: Add account deletion information to sign in screen #9961

Open timwright12 opened 3 weeks ago

timwright12 commented 3 weeks ago

Problem

As a Veteran, I want to get regular mobile app updates on my Android device(s). As a contributor to the flagship mobile app, I want my product/design/code to be successfully released to Veterans via Google Play app store, with zero app store rejections.

As of September 2024, there are over 1 million Android app downloads of the flagship app. To ensure future test and production builds of the app are successfully approved by Google reviewers (machine and people) and get onto internal app contributors' and Veterans' devices, VA needs to comply with Google policy on account creation and account deletion. See details below.

While this is driven by Google Play policy, because VA releases updates on both ios and android OS at the same time, to ensure equity with Veterans regardless of income and device type, the impact of this problem hits both ios and android.

Description

The mobile app has gotten rejected a few times this year from the Android play store for non-compliance related to account creation/deletion. Google’s stance is that if an app offers account creation, they also have to offer account deletion.

From our point of view, we don’t have account creation inside the app because it’s all third party services and you can’t actually create an account from inside the app, so we don’t offer information about deletion (and we can’t change the login screen). So far the rejections haven’t caused much mayhem because we can appeal them. However, twice now our appeals have failed (although we were lucky that the rejections were just on test builds so it didn’t affect production). It’s really just a matter of time before the app gets rejected for this reason again and our appeals are denied on a production release.

The ask: we’re requesting that some information about deleting accounts be added to the login screen somewhere. I was able to find information on the following services:

I was unable to find account deletion information for DS_Logon.

I believe just adding those links should help us get around the policy and prevent future rejections. This requires support from the Identity team. Read the Slack thread for more context.

Google's policy

Google Play’s data deletion badge and Data deletion area within the Data safety section give users a new set of transparency and controls over their user data while providing developers a way to showcase how they treat user data responsibly. If your app allows users to create an account from within your app, our User data policy requires that it must also allow users to request for their account to be deleted.

OCTO/VA teams involved

Digital Experience Portfolio's Identity, Content/Public, Mobile platform

Samara-Strauss commented 3 weeks ago

My request, if possible -- we need to validate whether the proposed solution will actually meet Google's standards. If so, I think it's something we can accommodate, though probably after 1/31 (MHV retirement date). But I don't want to go through all the work to add this and then have Google still feel this solution doesn't meet their standards.

Samara-Strauss commented 3 weeks ago

From Slack, it sounds like we feel this solution meets Google's standards. I think we can accommodate this, but I can't make promises on timeline given the team's current work related to the sign-in transition.