[{"data":1,"prerenderedAt":151},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fapp-store-privacy":3},{"page":4,"toc":139,"updated":150},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fapp-store-privacy","App Store and Google Play privacy","App Store Privacy Labels and Google Play Data Safety for Fingerly","How to answer Apple's App Privacy questions and Google Play's Data safety form for the data the Fingerly iOS, Android and cross-platform SDKs collect.",[10,13,17,22,29,31,34,36,60,62,65,67,70,72,75,78,81,83,98,101,121,124,129,132,134,137],{"type":11,"text":12},"p","Both stores ask what data your app collects, including data collected by the SDKs inside it. This page gives the answers for the Fingerly mobile SDKs. React Native, Flutter and Lynx apps use the same native SDKs and collect nothing more, so the same answers apply.",{"type":14,"tone":15,"text":16},"callout","note","Your app's declarations are yours to make, and they cover everything your app collects, not only Fingerly. These answers describe the SDKs at version 0.1. Check them against how you use Fingerly, and take advice where you are unsure.",{"type":18,"level":19,"text":20,"id":21},"heading",2,"What the mobile SDKs collect","what-the-mobile-sdks-collect",{"type":23,"items":24},"list",[25,26,27,28],"**Device identifiers.** Identifiers the operating system makes available to apps, and a random installation identifier the SDK keeps in your app's own storage: the Keychain on iOS, and private app preferences on Android. Never the advertising identifier.","**Device and app characteristics.** Hardware, operating system, display, language and time zone settings, battery state, network type, and the integrity of the device and of your app. On Android, also the mobile network operator's name, the store that installed your app, and whether specific apps from a fixed list declared in the SDK's manifest are installed.","**The IP address** each request comes from. Fingerly determines the country and the network from it.","**Your tag**, the string you pass to `identify`.",{"type":11,"text":30},"The SDKs never collect precise location, contacts, photos, messages, anything your users type, browsing history or advertising data, and never show a permission prompt. They make no App Tracking Transparency request because they do not track.",{"type":18,"level":19,"text":32,"id":33},"Apple: App Privacy details","apple-app-privacy-details",{"type":11,"text":35},"In App Store Connect, under **App Privacy**, declare these data types for Fingerly:",{"type":37,"columns":38,"rows":44},"table",[39,40,41,42,43],"Data type","Collected","Linked to the user","Used for tracking","Purpose",[45,51,54,57],[46,47,48,49,50],"Identifiers: **Device ID**","Yes","See below","No","App Functionality",[52,53,48,49,50],"Location: **Coarse Location**","Yes, derived from the IP address",[55,56,48,49,50],"Other Data: **Other Data Types**","Yes, device and app characteristics",[58,59,47,49,50],"Identifiers: **User ID**","Only if your tags contain a user or account ID",{"type":11,"text":61},"Apple's **App Functionality** purpose includes preventing fraud and implementing security measures, which is what Fingerly is for.",{"type":18,"level":63,"text":41,"id":64},3,"linked-to-the-user",{"type":11,"text":66},"Fingerly does not know who your users are. The data becomes linked to a user's identity when your app or your server stores the request ID or the visitor ID with their account, as the [use-case recipes](\u002Fdocs\u002Fuse-cases) do. If you do that, answer **Yes**.",{"type":18,"level":63,"text":68,"id":69},"Tracking","tracking",{"type":11,"text":71},"Answer **No**. Fingerly processes the data on your behalf, only to prevent fraud and keep your app secure. It does not combine it with other companies' data, the same device has a different visitor ID for every Fingerly customer, and nothing is used for advertising. Apple's definition of tracking does not include data used solely for fraud prevention or security on your behalf. This stays true only if your own use of the data stays within those purposes.",{"type":18,"level":63,"text":73,"id":74},"Privacy manifest","privacy-manifest",{"type":14,"tone":76,"text":77},"warning","The iOS SDK does not include a privacy manifest (`PrivacyInfo.xcprivacy`) yet. Xcode's privacy report will not list Fingerly, and App Store Connect may report required reason APIs used by the SDK when you upload a build. Email [support@fingerly.io](mailto:support@fingerly.io) before you submit an app that includes the iOS SDK.",{"type":18,"level":19,"text":79,"id":80},"Google Play: Data safety","google-play-data-safety",{"type":11,"text":82},"In Play Console, under **App content > Data safety**, declare these data types for Fingerly:",{"type":37,"columns":84,"rows":86},[39,40,85,43],"Shared",[87,90,92,95],[88,47,49,89],"Device or other IDs","Fraud prevention, security, and compliance",[91,53,49,89],"Location: **Approximate location**",[93,94,49,89],"App activity: **Installed apps**","Yes, a fixed list of specific apps",[96,97,49,89],"App info and performance: **Diagnostics**","Yes, device characteristics such as battery state",{"type":18,"level":63,"text":99,"id":100},"The other questions","the-other-questions",{"type":37,"columns":102,"rows":105},[103,104],"Question","Answer for Fingerly",[106,109,112,115,118],[107,108],"Is the data shared?","**No.** Fingerly is a service provider processing the data on your behalf, which Google does not count as sharing.",[110,111],"Is it processed ephemerally?","**No.** Identification events are kept for 30 days. See [data retention](\u002Fdocs\u002Fdata-retention).",[113,114],"Is collection required or optional?","**Required**, unless you load the SDK with a `consent` state other than `granted` and let users decline. Then **optional**. See [consent tools](\u002Fdocs\u002Fconsent-tools).",[116,117],"Is all data encrypted in transit?","**Yes.** The SDK sends everything to Fingerly over HTTPS. If you set a custom `endpoint`, it must be an `https:\u002F\u002F` URL for this to stay true.",[119,120],"Can users request deletion?","**Yes**, through your own process. Fingerly deletes a visitor's data when you ask at [support@fingerly.io](mailto:support@fingerly.io).",{"type":18,"level":63,"text":122,"id":123},"Permissions and package visibility","permissions-and-package-visibility",{"type":23,"items":125},[126,127,128],"The SDK's manifest declares only `INTERNET` and `ACCESS_NETWORK_STATE`. Both are granted at install time, so there is no prompt and no Permissions Declaration Form.","It checks for specific apps through a `\u003Cqueries>` list of package names, and never requests `QUERY_ALL_PACKAGES`.","It uses no Google Play services and no advertising ID, so you do not need to declare the `AD_ID` permission for Fingerly.",{"type":18,"level":63,"text":130,"id":131},"Backups","backups",{"type":11,"text":133},"The SDK does not exclude its installation identifier from Android Auto Backup, so your app's backup rules decide whether it is backed up. To keep it on one device, exclude the `io.fingerly.sdk.install` shared preferences file in your backup rules.",{"type":18,"level":19,"text":135,"id":136},"Your privacy policy","your-privacy-policy",{"type":11,"text":138},"Both stores link to your privacy policy. Say that your app uses device identification from Fingerly to prevent fraud and keep accounts secure, what that involves, and how long the data is kept. See [privacy and consent](\u002Fdocs\u002Fprivacy-and-consent).",[140,141,142,143,144,145,146,147,148,149],{"id":21,"text":20,"level":19},{"id":33,"text":32,"level":19},{"id":64,"text":41,"level":63},{"id":69,"text":68,"level":63},{"id":74,"text":73,"level":63},{"id":80,"text":79,"level":19},{"id":100,"text":99,"level":63},{"id":123,"text":122,"level":63},{"id":131,"text":130,"level":63},{"id":136,"text":135,"level":19},"2026-09-17T16:58:12.000Z",1789667797515]