Skip to content
- MUST apply redaction on the device. A field the app excludes never leaves the phone.
- MUST leave request bodies, response bodies and query strings on the device unless
the app turns their capture on.
- MUST honor consent: when the app withdraws it, the SDK stops collecting and drops
its queue, and the choice holds across launches until the app gives it back
(section 13.5).
- SHOULD identify users only by a hash the app provides, in
user.hash. An SDK
MUST NOT send user.email, user.name or user.full_name on its own initiative.
- MUST NOT send
device.id or identifiers derived from IDFV, IDFA or the Android ID
(section 2.2). app.installation.id is allowed and can
be turned off (section 2.3).
- MUST ship a privacy manifest (
PrivacyInfo.xcprivacy) with each SDK module on Apple
platforms, declaring the data it collects and the required-reason APIs it uses.
- A backend MUST NOT store the client IP address. It MAY derive a coarse location
(country, region) from it at the edge, then drop it.