Skip to main content
Both stores ask you to declare the data your app and its SDKs collect. This page lists what the Insito SDK collects so you can fill in the forms. You remain responsible for the final answers: add anything your app sends through identify() properties or event names, and anything collected by other SDKs.
The declarations below assume you follow the userId guidance: an opaque ID, with no email address, phone number, name or customer number in the ID or in properties. If you do send those, you also have to declare them as contact info or other identifiers.

What the SDK collects

Purposes: analytics (your survey results) and app functionality (deciding which survey to show and when). Insito doesn’t use the data for advertising, doesn’t share it with data brokers and doesn’t track users across apps. All traffic uses TLS. The SDK doesn’t read the advertising identifier (IDFA/AAID), location, contacts, photos or any hardware identifier, so it doesn’t need the App Tracking Transparency prompt. The API sees the device’s IP address for rate limiting only; it isn’t used to derive location.

Apple

App Privacy (App Store Connect)

Under App Privacy → Data Types, select:
  • Identifiers → User ID
  • Usage Data → Product Interaction
  • User Content → Other User Content
  • Diagnostics → Other Diagnostic Data
For each one, answer: used for Analytics and App Functionality, linked to the user’s identity, not used for tracking.

Privacy manifest

Both SDK packages include the matching manifest at privacy/PrivacyInfo.xcprivacy. The SDKs are pure JavaScript and pure Dart, so Xcode doesn’t pick the file up from the package. Add its collected data types to your app’s own manifest instead:
Add this to app.json (or app.config.*) and rebuild:
The Insito code doesn’t call any of Apple’s required-reason APIs. Its native dependencies ship their own manifests, which Xcode includes automatically:

Google Play Data safety

In Play Console, under App content → Data safety:
  1. Does your app collect or share any of the required user data types? Yes.
  2. Is all of the user data encrypted in transit? Yes.
  3. Do you provide a way for users to request that their data is deleted? Yes, if you handle requests with the erasure tool.
  4. Select these data types:
Insito is your service provider, so data sent to it doesn’t count as shared under Google’s definition. Mark collection as optional only if you ask for consent first with deferCollection and optIn(); see Consent in the SDKs.