A four-line data label leaves out what the policy discloses

The design

Google Play requires every Android developer to complete a standardized Data safety declaration, and Character.AI's entry for its app, retrieved 16 September 2026, states that the app shares no data with third parties and may collect four categories: personal info (an email address), app activity (app interactions, in-app search history, and other user-generated content), device or other IDs, and app info and performance (crash logs and diagnostics). The expanded data-safety view further ties each category to a stated purpose, mostly app functionality, account management, and analytics, and separately declares that data is encrypted in transit and that a user can request deletion.

What the evidence says

The label is developer-declared, not audited by Google, and its own text on the main listing says the developer provided the information and may update it. Read against Character.AI's own Privacy Policy, current as of a July 2026 effective date, the two documents describe overlapping but differently scoped worlds: the policy lists disclosure to affiliates, to vendors and service providers including advertising and analytics providers, for safety and legal reasons, and in business transfers, categories broader than the four the Play label enumerates as collected, and going beyond the label's headline claim that the app shares no data with third parties.

What it asks of people

A prospective user comparing the two documents is asked to understand a technical distinction: the label's no-sharing claim describes a specific Play Console category (transfer to a third party for that party's own independent purposes) rather than a blanket assurance that no other company ever processes the data. Someone relying on the four-line summary alone would not learn about the policy's broader vendor and advertising disclosures, which only the longer document states.

Privacy and safeguards

The label's stated safeguards are narrow: encryption in transit and a deletion-request mechanism. It says nothing about retention periods, while the privacy policy separately states that some information, tied to a publicly shared Character, may be retained even after a user deletes their account and data, a retention carve-out the Play label does not surface at all.

• Does 'no data shared with third parties' on the label match how a reader would interpret the same phrase in the privacy policy's vendor and advertising disclosures?
• What does the privacy policy's account-linked retention exception mean in practice for a deleted account's public Characters?
• Has the declared category list changed since this label was last retrieved, and does Character.AI publish a changelog for it?

The two documents are not contradictory so much as differently grained; the label is a quick, standardized snapshot, and the policy is the fuller account a reader needs to understand what it leaves out.