# Privacy

The App Store and Google Play both make you declare what your app collects,
including what the third-party SDKs inside it collect. This page lists everything
`@swmansion/react-native-detour` sends, so you can fill in both forms without
reading the SDK source.

## What the SDK sends

The SDK makes four network calls, all to `godetour.dev`.

| Sent                        | When                                                     | Contents                                                                                                  |
| --------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Deferred-matching signals   | First launch after install, once                          | Platform, device model, manufacturer, OS version, screen size and scale, locales, timezone, user agent. On iOS also the clipboard string. |
| Universal / App Link click  | Every link open the SDK handles                           | The link URL and its query parameters, app version, OS version, device model.                              |
| Analytics event             | Each `DetourAnalytics.logEvent` call                      | Event name, your `data` payload, platform, device ID.                                                       |
| Retention event             | `app_open` on cold start, plus `logRetention` calls       | Event name, platform, device ID.                                                                            |

The **device ID** is a random UUID the SDK generates on first use and keeps in
the configured storage. It is scoped to your app's storage, is not IDFA, IDFV or
the Android advertising ID, and is regenerated when app data is cleared.

Set [`shouldTrackAutomaticEvents: false`](https://detour.swmansion.com/docs/sdk/react-native/api-reference#config-fields)
to stop the automatic `app_open` event. It does not affect the other three calls.

### Clipboard

On **iOS** the SDK calls `Clipboard.getStringAsync()` on first launch and sends
the result with the matching signals. It does not check the content of the
string, so the string can be any text the user copied.

Set [`shouldUseClipboard: false`](https://detour.swmansion.com/docs/sdk/react-native/api-reference#config-fields)
to skip the read. Deferred matching then runs without that signal, which lowers
its success rate on iOS. See [Matching](https://detour.swmansion.com/docs/platform/architecture/matching).

On **Android** the SDK never reads the clipboard, even with the flag left at
`true`. The Play install referrer provides the click id there, so matching does
not need the clipboard.

## App Store Connect questionnaire

These answers are required on every submission, and they have to cover the SDKs
you integrate, not only your own code. See
[App privacy details on the App Store](https://developer.apple.com/app-store/app-privacy-details/).

Open your app → **App Privacy** → **Data Collection** → **Edit**, and answer
**Yes** to *"Do you or your third-party partners collect data from this app?"*.
Answer for the version that is live on the App Store, not for the build you are
working on.

The next screen lists every data type, grouped by category. Select these four.
Each selected type then gets its own setup step with three questions, answered by
the last three columns.

| Data type                               | Select when                                        | Used for                     | Linked to identity | Used for tracking |
| --------------------------------------- | -------------------------------------------------- | ---------------------------- | ------------------ | ----------------- |
| **User Content** → Other User Content   | `shouldUseClipboard` left at its default of `true`  | App Functionality            | No                 | No                |
| **Identifiers** → Device ID             | Always                                              | App Functionality, Analytics | No                 | No                |
| **Usage Data** → Product Interaction    | Always                                              | App Functionality, Analytics | No                 | No                |
| **Other Data**                          | Always                                              | App Functionality            | No                 | No                |

**Device ID** covers any device-level ID, not only the advertising identifier, so
the UUID the SDK generates belongs there. **Other Data** is the last row in the
list and covers data types Apple does not name separately. Select it for the
deferred-matching signals.

All four have to be declared. Apple lets you leave out a data type only when it
is collected infrequently, the user chooses to provide it, and the collection is
outside the app's primary functionality. Link resolution is none of those.

:::note[The package ships no privacy manifest]
The package is pure TypeScript, so it ships no `PrivacyInfo.xcprivacy` of its
own, and the Expo modules it depends on each declare an empty
`NSPrivacyCollectedDataTypes`. The Privacy Report that Xcode generates from your
archive therefore lists no collected data for Detour. Answer the questionnaire
from this page rather than from that report.

Your app's own manifest does not have to cover the SDK. Apple expects each SDK to
ship its own, and states that your file does not need to repeat what the SDKs you
link collect. See
[Describing data use in privacy manifests](https://developer.apple.com/documentation/bundleresources/describing-data-use-in-privacy-manifests).
:::

## Google Play Data safety

In Play Console, select the app, then open **Monitor and improve** → **Policy and
programmes** → **App content**, and start the **Data safety** form. It asks first
whether the app collects or shares any of the required user data types. Answer
**Yes**, because the SDK sends the data listed below off the device.

### Data types

Declare Android behavior only. The SDK does not read the clipboard on Android,
so no user content applies. Two groups do.

| Group                       | Check                | Select when                                                                             |
| --------------------------- | -------------------- | ---------------------------------------------------------------------------------------- |
| **Device or other IDs**     | Device or other IDs  | Always. The generated device ID, and the deferred-matching signals, which identify one install. |
| **App activity**            | App interactions     | Always. Link opens, `app_open`, and any event you log yourself.                           |
| **App activity**            | Other actions        | Only if you log events that do not describe a screen or a tap. Whatever you pass to `logEvent`. |

### Data usage and handling

Each type you selected gets its own set of questions. For all of them: purpose
**App functionality** and **Analytics**, the data is **required** rather than
optional, because link resolution does not work without it, and it is **not**
processed ephemerally, because Detour stores it to match a later install.

The form also asks whether each type is **shared**. Google does not count data
sent to a service provider that processes it on your instructions, and does count
data sent to a third party. Whether Detour is one or the other is set by your
contract with us, so take that answer from the contract. The definitions are in
[Provide information for Google Play's Data safety section](https://support.google.com/googleplay/android-developer/answer/10787469).

The package requests **no Android permissions of its own**. In particular it does
not add `com.google.android.gms.permission.AD_ID`, so it does not force an
advertising-ID declaration onto your app.

:::caution[These declarations cover the SDK, not your payloads]
The SDK does not inspect two kinds of data it sends, so nothing above covers
them:

- `DetourAnalytics.logEvent` sends the `data` object as you built it.
- Universal Link query parameters are forwarded as-is.

If either one carries personal data, declare it under your own app's entries.
:::

## Related pages

[Installation](https://detour.swmansion.com/docs/sdk/react-native/sdk-installation/)
  [API Reference](https://detour.swmansion.com/docs/sdk/react-native/api-reference/)
  [Matching](https://detour.swmansion.com/docs/platform/architecture/matching/)
  [Analytics](https://detour.swmansion.com/docs/platform/fundamentals/analytics/)