The privacy label asks two different questions: what you collect for the product, and whether you track the person across other companies’ apps or sites. Writing “we value privacy” in both fields does not clear review.
List SDKs first
Export analytics, ads, crash, and login SDKs. Split them into collected-in-app versus joined-with-data-from-elsewhere. IDFA or email sent to an ad network is tracking. An in-app analytics counter usually is not.
Permission copy and the label must tell the same story. After an SDK change, update the form; do not wait for a spot check.