Both stores ask what data your app collects, including data collected by the SDKs inside it. This page gives the answers for the Fingerly mobile SDKs. React Native, Flutter and Lynx apps use the same native SDKs and collect nothing more, so the same answers apply.
What the mobile SDKs collect
- Device identifiers. Identifiers the operating system makes available to apps, and a random installation identifier the SDK keeps in your app's own storage: the Keychain on iOS, and private app preferences on Android. Never the advertising identifier.
- Device and app characteristics. Hardware, operating system, display, language and time zone settings, battery state, network type, and the integrity of the device and of your app. On Android, also the mobile network operator's name, the store that installed your app, and whether specific apps from a fixed list declared in the SDK's manifest are installed.
- The IP address each request comes from. Fingerly determines the country and the network from it.
- Your tag, the string you pass to
identify.
The SDKs never collect precise location, contacts, photos, messages, anything your users type, browsing history or advertising data, and never show a permission prompt. They make no App Tracking Transparency request because they do not track.
Apple: App Privacy details
In App Store Connect, under App Privacy, declare these data types for Fingerly:
| Data type | Collected | Linked to the user | Used for tracking | Purpose |
|---|---|---|---|---|
| Identifiers: Device ID | Yes | See below | No | App Functionality |
| Location: Coarse Location | Yes, derived from the IP address | See below | No | App Functionality |
| Other Data: Other Data Types | Yes, device and app characteristics | See below | No | App Functionality |
| Identifiers: User ID | Only if your tags contain a user or account ID | Yes | No | App Functionality |
Apple's App Functionality purpose includes preventing fraud and implementing security measures, which is what Fingerly is for.
Linked to the user
Fingerly does not know who your users are. The data becomes linked to a user's identity when your app or your server stores the request ID or the visitor ID with their account, as the use-case recipes do. If you do that, answer Yes.
Tracking
Answer No. Fingerly processes the data on your behalf, only to prevent fraud and keep your app secure. It does not combine it with other companies' data, the same device has a different visitor ID for every Fingerly customer, and nothing is used for advertising. Apple's definition of tracking does not include data used solely for fraud prevention or security on your behalf. This stays true only if your own use of the data stays within those purposes.
Privacy manifest
Google Play: Data safety
In Play Console, under App content > Data safety, declare these data types for Fingerly:
| Data type | Collected | Shared | Purpose |
|---|---|---|---|
| Device or other IDs | Yes | No | Fraud prevention, security, and compliance |
| Location: Approximate location | Yes, derived from the IP address | No | Fraud prevention, security, and compliance |
| App activity: Installed apps | Yes, a fixed list of specific apps | No | Fraud prevention, security, and compliance |
| App info and performance: Diagnostics | Yes, device characteristics such as battery state | No | Fraud prevention, security, and compliance |
The other questions
| Question | Answer for Fingerly |
|---|---|
| Is the data shared? | No. Fingerly is a service provider processing the data on your behalf, which Google does not count as sharing. |
| Is it processed ephemerally? | No. Identification events are kept for 30 days. See data retention. |
| Is collection required or optional? | Required, unless you load the SDK with a consent state other than granted and let users decline. Then optional. See consent tools. |
| Is all data encrypted in transit? | Yes. The SDK sends everything to Fingerly over HTTPS. If you set a custom endpoint, it must be an https:// URL for this to stay true. |
| Can users request deletion? | Yes, through your own process. Fingerly deletes a visitor's data when you ask at support@fingerly.io. |
Permissions and package visibility
- The SDK's manifest declares only
INTERNETandACCESS_NETWORK_STATE. Both are granted at install time, so there is no prompt and no Permissions Declaration Form. - It checks for specific apps through a
<queries>list of package names, and never requestsQUERY_ALL_PACKAGES. - It uses no Google Play services and no advertising ID, so you do not need to declare the
AD_IDpermission for Fingerly.
Backups
The SDK does not exclude its installation identifier from Android Auto Backup, so your app's backup rules decide whether it is backed up. To keep it on one device, exclude the io.fingerly.sdk.install shared preferences file in your backup rules.
Your privacy policy
Both stores link to your privacy policy. Say that your app uses device identification from Fingerly to prevent fraud and keep accounts secure, what that involves, and how long the data is kept. See privacy and consent.