Real numbers from this tool, line by line.
Your app lets people sign up. Since 2022-06-30, that one fact brings in App Store rule 5.1.1(v): an app that supports account creation must let people start deleting their account inside the app. When App Review finds the path missing, the submission can come back rejected, and your release waits for another round.
Google Play asks for the same thing from another angle. An app with account creation must offer deletion inside the app and also a web link where people can ask for deletion without reinstalling. That link goes in the Data safety form. Ship to both stores and you need both paths.
Then there is the EU. Under GDPR Art. 17 people can ask for their data to be erased, and Art. 12(3) gives you one month to reply. A request that arrives on 2026-09-24 needs a reply by 2026-10-24. A request that arrives on 2026-01-31 needs a reply by 2026-02-28, because February has no 31st. Show that date on screen.
The free checker asks seven yes-or-no questions about your app (stores, sign-up, Sign in with Apple, subscriptions, EU users, ad tracking) and one date. It lists the screens you need, the rule behind each one and the kit variant that draws it.
Here are three results I measured with it.
An app on both stores with sign-up, Sign in with Apple, subscriptions, ad tracking and EU users needs 8 screens, and 7 of them are required by a rule. The eighth is good practice: showing what deletion removes before the final tap. The Apple-specific ones are easy to miss. When an account signed in with Apple is deleted, the Apple token should be revoked through the Sign in with Apple REST API. When the app sells subscriptions through Apple, people should be told that billing continues through Apple until they cancel, because deleting the account does not stop the subscription.
An Android-only app with sign-up and EU users needs 4 screens, 3 of them rule-backed: the in-app deletion path plus the web link, the GDPR reply date, and consent checkboxes that start unticked. That last one comes from the CJEU Planet49 ruling (C-673/17): a pre-ticked box is not valid consent. GDPR Art. 7(3) adds that withdrawing consent must be as easy as giving it, which is why the toggles in the kit start in the off position.
An iOS game with no sign-up but with an ads SDK and EU users needs 2 screens, both rule-backed: unticked consents and the App Tracking Transparency prompt that App Store rule 5.1.2(i) requires before any tracking. There is no deletion screen at all, because there is no account to delete.
The kit itself is a mobile app UI kit for Figma with 8 components and 28 variants. I counted each list in the file. Button 4, alert 4, consent checkbox 4, privacy toggle 3, account data card 3, settings tab 3, rule badge 4, deletion progress 3. The free kit is the button and the alert, 8 variants: the whole in-app entry. The rest of the privacy settings screen is in the full kit.
It reaches Figma in 3 steps. The .sketch file opens when you drag it into Figma. It holds one named, coloured shape per variant, and the labels come through the other two routes. Each of the 28 SVGs pastes into Figma as a vector with its label. The plugin source, code.ts, builds all 28 variants with text once you compile it with tsc and run it as a development plugin. Some component structure may be simplified, and menu names differ by Figma version and language. Sketch users open the same file.
Run the checker with your own answers first; the list is free and stays on the page.