SDK compliance guide
This guide helps developers meet regulatory requirements for protecting the personal information of end users. It explains how to use third-party software development kits (SDKs) without infringing on the rights of end users. You can use this guide to perform a self-check and correctly configure the Object Storage Service (OSS) SDK to ensure compliance.
1. SDK privacy policy disclosure example
Application operators must clearly inform end users how the OSS SDK processes personal information. The disclosure must include the SDK name, its business functions, the purpose of data processing, the types of data collected, and a link to the SDK's privacy policy. Your application must have its own privacy policy, which must state that you use the OSS SDK. For example, you can add the following details to your application's third-party sharing list:
SDK name: Object Storage Service SDK
Business function: Uses Object Storage Service to upload or download files
Types of personal information collected: Operating system name, operating system version, network connectivity method, device model, and Build.ID
Privacy policy link: Privacy Policy
2. When to initialize the SDK and call business functions
When an end user launches your application for the first time, you must call the relevant SDK APIs only after the end user agrees to your privacy policy and actively uses a feature that is provided by the SDK. Do not collect device information immediately after the end user provides consent unless it is necessary. This practice prevents excessive or premature data collection.
3. Explanation of system permissions requested by the SDK
Android operating system application permissions list:
|
Permission |
Required |
Purpose |
When to request |
|
INTERNET |
Yes |
To obtain network access permissions. Without this permission, the SDK features will not be available. |
Before calling the information collection API. |
|
WRITE_EXTERNAL_STORAGE |
No (Recommended) |
Write permission is required for breakpoint record files for resumable uploads and downloads. It is also required for Simple Log Service. |
Before calling the information collection API. |
|
READ_EXTERNAL_STORAGE |
Yes |
Read permission is required to read data from files during data upload. |
Before calling the information collection API. |
4. Appendix
Object Storage Service SDK Privacy Policy: Privacy Policy
Android Integration Guide: OSS Android SDK
iOS Integration Guide: OSS iOS SDK
Security and Compliance: Compliance Certifications