What leaves the device, and what we never see
This page describes behaviour you can verify: the SDK is open source, the wire schema is published, and the list of things it will not collect is normative rather than aspirational.
- Event name, day and millisecond timestamp, sequence number
- Flat event properties you choose to send
- Session id, scoped to one install
- Install id: a random UUID, salted and SHA-256 hashed on device
- App id and app version
- OS version, device model, locale
- Whether the build is pre-release, if you pass it in
- IP addresses — not stored with any event
- IDFA or any advertising identifier
- IDFV, Keychain values, device serial
- Location, of any precision
- Free text, screenshots, session replay
- Email, name or account identifier, unless you deliberately call
identify(), which hashes it first - Anything that links one app to another, or one device to another
Why the install id is not a person
The id starts as a random UUID generated on the device, is hashed with a salt you choose and commit with your app, and never leaves in raw form. It is scoped to one app: the same device running two apps produces two unrelated ids, and no backend can join them. Deleting the app deletes it. It counts installs, which is why the dashboard says "installs, not people" on the tile rather than letting you round it up to users.
Withhold the identity consent group and the id becomes per-session instead of persistent, which costs you retention numbers and nothing else.
No cookies, no banner code
The SDK sets no cookies, uses no web view, and sends no IP address to be retained. There is nothing for a consent banner to describe, and no ATT prompt: NSPrivacyTracking is false and there are no tracking domains.
What your own app must disclose is still yours to determine — declare Product Interaction and Other Diagnostic Data in your privacy manifest, plus User ID only if you call identify(). This is a description of the SDK's behaviour, not legal advice.
Consent, and what it costs
usage — events and sessions. Denied: nothing is captured.diagnostics — OS version, device model, locale. Denied: documented fallbacks are sent instead.identity — a persistent install id. Not granted by default. Denied: per-session id, so retention becomes unavailable and the dashboard says so on the tile.