Privacy first android skill

SKILL.md

Use when building Android apps with Kotlin, Jetpack Compose, MVVM, Hilt, Room 3, DataStore, Paging 3, or multi-module projects — especially when user privacy, data protection, or GDPR/CCPA compliance is required.

Triggers on requests to create Android projects, screens, ViewModels, repositories, feature modules, privacy-compliant data flows, or asks about Android architecture patterns with a privacy-first emphasis.

🛡️ Core Philosophy: Privacy by Design

Every decision — from architecture to UI — must answer: "Does this respect the user's privacy?"

1. Collect only what you need — minimize data at every layer
2. Encrypt everything at rest — tokens, PII, database fields
3. Be transparent — users must know what data you collect and why
4. Give users control — export, delete, and opt-out capabilities
5. Fail closed — when in doubt, protect the user

Decision Tree

Task	Reference File
Privacy-first architecture & data minimization	privacy-architecture.md
Privacy consent & GDPR/CCPA compliance	privacy-compliance.md
Data encryption & secure storage	android-security.md
Network security & certificate pinning	android-security.md
Permission handling & justification	android-permissions.md
Project structure & modules	modularization.md
Architecture layers (Domain, Data, UI, Common)	architecture.md
Compose patterns, Material motion, animation	compose-patterns.md
Material 3 theming, spacing tokens, dynamic colors	android-theming.md
Navigation3, adaptive navigation	android-navigation.md
Kotlin patterns, View lifecycle interop	kotlin-patterns.md
Coroutine patterns	coroutines-patterns.md
Gradle, product flavors, BuildConfig	gradle-setup.md
Testing approach	testing.md
Accessibility, TalkBack, WCAG	android-accessibility.md
Performance, benchmarking, Play Vitals	android-performance.md
Debugging, Logcat, ANR, R8, memory leaks	android-debugging.md
Crash reporting (provider-agnostic)	crashlytics.md
Code quality (Detekt)	code-quality.md

---

Creating a new project?

→ Start with privacy-architecture.md for privacy-first module design → Use assets/settings.gradle.kts.template for settings and module includes → Use assets/libs.versions.toml.template for the version catalog → Copy convention plugins from assets/convention/ to build-logic/ → Read modularization.md for structure and module types → Configure .gitignore with privacy-sensitive exclusions from android-security.md

Building any screen or feature?

→ FIRST check privacy-architecture.md → "Data Minimization Checklist" → Read compose-patterns.md for screen architecture → Ensure no PII leaks through logs, crash reports, or analytics → Use android-theming.md for Material 3

Handling user data?

→ Follow privacy-architecture.md → "Data Classification" → Encrypt at rest using android-security.md → Implement data retention policies → Provide export/delete capabilities per privacy-compliance.md

Adding analytics or crash reporting?

→ Follow privacy-compliance.md → "Privacy-Safe Analytics" → Use crashlytics.md with PII scrubbing → Never log PII, tokens, or user-identifiable data

Requesting permissions?

→ Follow android-permissions.md for just-in-time requests → Always explain why before requesting → Provide degraded-but-functional experience when denied → Track permissions in Play Console Data Safety

Implementing authentication?

→ Use android-security.md → Credential Manager & Biometrics → Store tokens in EncryptedSharedPreferences → Implement session timeout and re-authentication

Setting up network calls?

→ Follow android-security.md → Network Security → HTTPS only, certificate pinning for critical endpoints → No PII in URL parameters — use request body → Implement request signing for sensitive operations

Preparing for Play Store submission?

→ Complete privacy-compliance.md → "Play Console Data Safety Checklist" → Verify privacy policy URL is current → Ensure data deletion path exists → Review all SDK data collection declarations

Writing any Kotlin code?

→ Always follow kotlin-patterns.md → Align with architecture.md and modularization.md → Check for privacy implications in data flows

Testing?

→ Read testing.md for testing philosophy and patterns → Include privacy-specific test cases (PII leak detection, encryption verification) → Test permission denial flows thoroughly