app-authlisted

# App Auth ## Decide first: does this app need accounts at all? Accounts are a permanent liability: a breach surface, a GDPR data subject, a support queue, a store-mandated deletion flow, and a place for players to lose progress. Add them only for a reason you can name. | Need | Lightest solution that works | |---|---| | Save progress on one device | No account. Local save. | | Restore purchases on a new device | **No account** — the store account already does this. Play and Apple restore entitlements for free. | | Cloud save across the user's own devices | Platform save: Play Games Services Saved Games, or iCloud/Game Center. Still no account of yours. | | Leaderboards, achievements | Play Games Services + Game Center. Still no account of yours. | | Cross-platform progress (iOS ↔ Android ↔ web) | Now you need an account system. | | Social features, user-generated content, server-authoritative economy | Account system, and a moderation plan. | **For a children's app, the answer is almost always no accounts.** Collecting a child's email triggers COPPA/GDPR-K verifiable parental consent, which is far more work than the feature is worth. See `references/compliance-and-account-deletion.md`. ## If you do need accounts Pick the smallest set of methods. Every method is a code path, a recovery story and a support category. A good default for a game with cross-platform progress: 1. **Sign in with Google** (Credential Manager) — covers most Android users in one tap 2. **Sign in