What the store reviewer checks
These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.
A policy that answers four questions
Slack asks for what data is collected, how it is used, how long it is kept, and how people can request to access, transfer or delete it.
A contact the reviewer can use
The policy needs contact information. Slack says an email address or a web form is the minimum.
Data you receive but never use
If your app receives data but never uses it, Slack says the privacy policy must state this. Do not leave it out because the app ignores the data.
What to account for
Scopes that match the policy
Slack asks apps to follow the principle of least privilege when they request scopes. List each scope in your own notes and check the policy describes the data it opens.
AI features: do not store Slack data
For AI agents, Slack says not to store the Slack data you obtain. Store metadata and pull the data in real time when needed. Your policy must say what you really keep.
Consent before you email users
Slack requires explicit consent before you contact people by email addresses you got through the Slack API. Say in the policy how you ask for it.
Common mistakes to check
A website policy that ignores the app
A policy written for your marketing site does not describe messages, channels or profiles that the app reads in a workspace. Add the app data flows to it.
Tokens in logs or public code
Slack says API tokens must never be logged, stored in client-side code or public repositories, or made accessible to end users. A policy cannot fix a leaked token.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
List what the app reads and stores
Write down each Slack scope, the data it returns, where you store it and for how long. Mark data you receive but never use.
Scan your public site and draft
Scan the site that hosts your listing links. Review the suggested vendors, answer the business questions, then add the Slack data flows by hand.
Test a deletion request
Ask for your own test workspace data to be deleted by the route the policy names. Check someone answers and the data goes.
Example
Fictional app: Harbor Standup
Assume a bot that posts a daily standup prompt and keeps answers for 90 days. The scan sees analytics on the marketing site; the owner confirms what the bot stores.
A useful next action
Add the 90-day retention and the deletion contact to the draft, then link the published page in the listing. Keep the scan evidence with your notes.
Questions before publishing
Does Slack ask for anything besides a policy?
Yes. Slack lists a support page that answers within two business days, and says apps must follow its App Developer Policy, Marketplace Agreement and API Terms of Service.
Can the scan see my Slack data?
No. The scan reads your public website only. It cannot see tokens, scopes, stored messages or what your backend does. You confirm those facts yourself.
Is the draft reviewed by a lawyer?
No. A lawyer has not reviewed our templates. The draft is a starting point that you check and adapt against Slack's current rules.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.