Privacy
Apple requires every third-party SDK to declare the APIs it uses and the data it collects. Detour ships that declaration with the package, so you do not have to write it yourself. The App Store Connect questionnaire is still yours to fill in, because Apple holds the app developer responsible for everything the app collects, SDKs included.
What ships with the SDK
Section titled “What ships with the SDK”From 1.1.1 the package bundles a PrivacyInfo.xcprivacy manifest. Both Swift
Package Manager and CocoaPods copy it into your app bundle, and Apple aggregates
it into the Privacy Report generated at upload.
It declares Detour as non-tracking: NSPrivacyTracking = false and no
tracking domains. Integrating the SDK therefore does not by itself require an App
Tracking Transparency prompt.
What the manifest declares
Section titled “What the manifest declares”| Declared | Details |
|---|---|
UserDefaults API, reason CA92.1 | App-scoped keys only: the first-launch flag and a locally generated device ID. |
DeviceID | A random UUID stored on device, sent with analytics events. |
ProductInteraction | Event names from logEvent / logRetention, plus Universal Link opens (link URL, its query parameters, app version, OS version, device model). |
OtherUserContent | A web URL extracted from the clipboard, read on first launch (and again after resetSession(allowDeferredRetry: true)). Only the URL is sent, and any other copied text is discarded on device, and a clipboard holding no web URL sends nothing. |
OtherDataTypes | The deferred-matching signals sent on first launch: device model, OS version, screen size and scale, locales, timezone, user agent. |
Every collected type is declared as not linked to the user and not used for tracking.
To check the result for your own build: Xcode → Organizer, right-click the archive, Generate Privacy Report.
Clipboard access and the system paste alert
Section titled “Clipboard access and the system paste alert”When the copied content came from another app, iOS shows its own paste-permission
modal, "YourApp" would like to paste from "Safari", before your UI appears on
first launch, and its default button denies access.
Detour checks detectPatterns(for: [.probableWebURL]) first, so it only reads the
clipboard when it actually holds a web URL, but that check does not suppress the
alert. Set shouldUseClipboard: false to
skip the read entirely and never show it. Deferred matching then runs without the
clipboard signal, which lowers its success rate on iOS. See
Matching.
App Store Connect questionnaire
Section titled “App Store Connect questionnaire”In App Store Connect, open your app → App Privacy → Data Collection → Edit, and answer Yes to “Do you or your third-party partners collect data from this app?“.
1. Tick the applicable boxes
Section titled “1. Tick the applicable boxes”Listed in the order they appear on screen, so you can work top to bottom:
| Category | Tick | Applies when |
|---|---|---|
| User Content → Other User Content | Yes | Only if shouldUseClipboard is left enabled (the default). Skip it if you set shouldUseClipboard: false. |
| Identifiers → Device ID | Yes | Always. Detour generates and stores a random device ID for analytics. |
| Usage Data → Product Interaction | Yes | Always. Event names from logEvent / logRetention, plus Universal Link opens. |
| Other Data | Yes | Always. The deferred-matching signals. |
2. Fill in the section for each box you ticked
Section titled “2. Fill in the section for each box you ticked”Once you save, each type you selected has its own setup step. Answer the three questions in each:
| Data type | Used for | Linked to identity | Used for tracking |
|---|---|---|---|
| Other User Content | App Functionality | No | No |
| Device ID | App Functionality, Analytics | No | No |
| Product Interaction | App Functionality, Analytics | No | No |
| Other Data | App Functionality | No | No |
These answers mirror the shipped manifest exactly, so they cross-check against the Privacy Report Xcode generates from your archive.