> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insito.app/llms.txt
> Use this file to discover all available pages before exploring further.

# App Store and Google Play privacy labels

> What to declare in App Privacy, the iOS privacy manifest and Google Play Data safety when your app uses Insito.

Both stores ask you to declare the data your app and its SDKs collect. This
page lists what the Insito SDK collects so you can fill in the forms. You
remain responsible for the final answers: add anything your app sends through
`identify()` properties or event names, and anything collected by other SDKs.

> [!WARNING]
>
> The declarations below assume you follow the [`userId`
> guidance](https://docs.insito.app/concepts/privacy): an opaque ID, with no email address, phone
> number, name or customer number in the ID or in properties. If you do send
> those, you also have to declare them as contact info or other identifiers.

## What the SDK collects

| Data | Examples | Linked to the user | Used for tracking |
| - | - | - | - |
| User ID | The `userId` you pass to `identify()` | Yes | No |
| Product interaction | Events you trigger, screens visited, surveys shown | Yes | No |
| User content | Survey answers, including free text | Yes | No |
| Diagnostics | OS version, app version, locale, timezone, session count | Yes | No |

Purposes: **analytics** (your survey results) and **app functionality**
(deciding which survey to show and when). Insito doesn't use the data for
advertising, doesn't share it with data brokers and doesn't track users across
apps. All traffic uses TLS.

The SDK doesn't read the advertising identifier (IDFA/AAID), location,
contacts, photos or any hardware identifier, so it doesn't need the App
Tracking Transparency prompt. The API sees the device's IP address for rate
limiting only; it isn't used to derive location.

## Apple

### App Privacy (App Store Connect)

Under **App Privacy → Data Types**, select:

* **Identifiers → User ID**
* **Usage Data → Product Interaction**
* **User Content → Other User Content**
* **Diagnostics → Other Diagnostic Data**

For each one, answer: used for **Analytics** and **App Functionality**,
**linked to the user's identity**, **not used for tracking**.

### Privacy manifest

Both SDK packages include the matching manifest at
`privacy/PrivacyInfo.xcprivacy`. The SDKs are pure JavaScript and pure Dart, so
Xcode doesn't pick the file up from the package. Add its collected data types to
your app's own manifest instead:

> [tab] Expo
>
> Add this to `app.json` (or `app.config.*`) and rebuild:
>
> ```json theme={null}
> {
>   "expo": {
>     "ios": {
>       "privacyManifests": {
>         "NSPrivacyCollectedDataTypes": [
>           {
>             "NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeUserID",
>             "NSPrivacyCollectedDataTypeLinked": true,
>             "NSPrivacyCollectedDataTypeTracking": false,
>             "NSPrivacyCollectedDataTypePurposes": [
>               "NSPrivacyCollectedDataTypePurposeAnalytics",
>               "NSPrivacyCollectedDataTypePurposeAppFunctionality"
>             ]
>           },
>           {
>             "NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeProductInteraction",
>             "NSPrivacyCollectedDataTypeLinked": true,
>             "NSPrivacyCollectedDataTypeTracking": false,
>             "NSPrivacyCollectedDataTypePurposes": [
>               "NSPrivacyCollectedDataTypePurposeAnalytics",
>               "NSPrivacyCollectedDataTypePurposeAppFunctionality"
>             ]
>           },
>           {
>             "NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeOtherUserContent",
>             "NSPrivacyCollectedDataTypeLinked": true,
>             "NSPrivacyCollectedDataTypeTracking": false,
>             "NSPrivacyCollectedDataTypePurposes": [
>               "NSPrivacyCollectedDataTypePurposeAnalytics",
>               "NSPrivacyCollectedDataTypePurposeAppFunctionality"
>             ]
>           },
>           {
>             "NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeOtherDiagnosticData",
>             "NSPrivacyCollectedDataTypeLinked": true,
>             "NSPrivacyCollectedDataTypeTracking": false,
>             "NSPrivacyCollectedDataTypePurposes": [
>               "NSPrivacyCollectedDataTypePurposeAnalytics",
>               "NSPrivacyCollectedDataTypePurposeAppFunctionality"
>             ]
>           }
>         ]
>       }
>     }
>   }
> }
> ```

> [tab] Bare React Native and Flutter
>
> Open your app's `ios/Runner/PrivacyInfo.xcprivacy` (Flutter) or
> `ios/<YourApp>/PrivacyInfo.xcprivacy` (React Native). If it doesn't exist,
> create it in Xcode with **File → New → File → App Privacy** and add it to
> the app target. Copy the four
> entries of `NSPrivacyCollectedDataTypes` from the SDK's manifest into it:
>
> * React Native: `node_modules/@insito/react-native/privacy/PrivacyInfo.xcprivacy`
> * Flutter: `privacy/PrivacyInfo.xcprivacy` in the
>   [`insito_flutter` package](https://pub.dev/packages/insito_flutter)

The Insito code doesn't call any of Apple's required-reason APIs. Its native
dependencies ship their own manifests, which Xcode includes automatically:

| Dependency | Declares |
| - | - |
| `@react-native-async-storage/async-storage` (1.24) | File timestamp, reason `C617.1` |
| `shared_preferences` (2.5) | User defaults, reason `1C8F.1` |
| `device_info_plus` (11.5) | Nothing collected, no required-reason APIs |
| `path_provider` (2.6) | No manifest shipped; it only looks up app directories |

## Google Play Data safety

In Play Console, under **App content → Data safety**:

1. **Does your app collect or share any of the required user data types?** Yes.
2. **Is all of the user data encrypted in transit?** Yes.
3. **Do you provide a way for users to request that their data is deleted?**
   Yes, if you handle requests with the
   [erasure tool](https://docs.insito.app/concepts/privacy.md#access-and-erasure-requests).
4. Select these data types:

| Category | Data type | Collected | Shared | Optional | Purposes |
| - | - | - | - | - | - |
| Personal info | User IDs | Yes | No | See below | Analytics, App functionality |
| App activity | App interactions | Yes | No | See below | Analytics, App functionality |
| App activity | Other user-generated content | Yes | No | See below | Analytics, App functionality |
| App info and performance | Diagnostics | Yes | No | See below | Analytics, App functionality |

Insito is your service provider, so data sent to it doesn't count as
**shared** under Google's definition. Mark collection as **optional** only if
you ask for consent first with `deferCollection` and `optIn()`; see
[Consent in the SDKs](https://docs.insito.app/concepts/privacy.md#consent-in-the-sdks).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.