Privacy

The App Store and Google Play both make you declare what your app collects, including what the third-party SDKs inside it collect. This page lists everything @swmansion/react-native-detour sends, so you can fill in both forms without reading the SDK source.

What the SDK sends

The SDK makes four network calls, all to godetour.dev.

Sent	When	Contents
Deferred-matching signals	First launch after install, once	Platform, device model, manufacturer, OS version, screen size and scale, locales, timezone, user agent. On iOS also the clipboard string.
Universal / App Link click	Every link open the SDK handles	The link URL and its query parameters, app version, OS version, device model.
Analytics event	Each DetourAnalytics.logEvent call	Event name, your data payload, platform, device ID.
Retention event	app_open on cold start, plus logRetention calls	Event name, platform, device ID.

The device ID is a random UUID the SDK generates on first use and keeps in the configured storage. It is scoped to your app’s storage, is not IDFA, IDFV or the Android advertising ID, and is regenerated when app data is cleared.

Set shouldTrackAutomaticEvents: false to stop the automatic app_open event. It does not affect the other three calls.

Clipboard

On iOS the SDK calls Clipboard.getStringAsync() on first launch and sends the result with the matching signals. It does not check the content of the string, so the string can be any text the user copied.

Set shouldUseClipboard: false to skip the read. Deferred matching then runs without that signal, which lowers its success rate on iOS. See Matching.

On Android the SDK never reads the clipboard, even with the flag left at true. The Play install referrer provides the click id there, so matching does not need the clipboard.

App Store Connect questionnaire

These answers are required on every submission, and they have to cover the SDKs you integrate, not only your own code. See App privacy details on the App Store.

Open your app → App Privacy → Data Collection → Edit, and answer Yes to “Do you or your third-party partners collect data from this app?”. Answer for the version that is live on the App Store, not for the build you are working on.

The next screen lists every data type, grouped by category. Select these four. Each selected type then gets its own setup step with three questions, answered by the last three columns.

Data type	Select when	Used for	Linked to identity	Used for tracking
User Content → Other User Content	shouldUseClipboard left at its default of true	App Functionality	No	No
Identifiers → Device ID	Always	App Functionality, Analytics	No	No
Usage Data → Product Interaction	Always	App Functionality, Analytics	No	No
Other Data	Always	App Functionality	No	No

Device ID covers any device-level ID, not only the advertising identifier, so the UUID the SDK generates belongs there. Other Data is the last row in the list and covers data types Apple does not name separately. Select it for the deferred-matching signals.

All four have to be declared. Apple lets you leave out a data type only when it is collected infrequently, the user chooses to provide it, and the collection is outside the app’s primary functionality. Link resolution is none of those.

The package ships no privacy manifest

The package is pure TypeScript, so it ships no PrivacyInfo.xcprivacy of its own, and the Expo modules it depends on each declare an empty NSPrivacyCollectedDataTypes. The Privacy Report that Xcode generates from your archive therefore lists no collected data for Detour. Answer the questionnaire from this page rather than from that report.

Your app’s own manifest does not have to cover the SDK. Apple expects each SDK to ship its own, and states that your file does not need to repeat what the SDKs you link collect. See Describing data use in privacy manifests.

Google Play Data safety

In Play Console, select the app, then open Monitor and improve → Policy and programmes → App content, and start the Data safety form. It asks first whether the app collects or shares any of the required user data types. Answer Yes, because the SDK sends the data listed below off the device.

Data types

Declare Android behavior only. The SDK does not read the clipboard on Android, so no user content applies. Two groups do.

Group	Check	Select when
Device or other IDs	Device or other IDs	Always. The generated device ID, and the deferred-matching signals, which identify one install.
App activity	App interactions	Always. Link opens, app_open, and any event you log yourself.
App activity	Other actions	Only if you log events that do not describe a screen or a tap. Whatever you pass to logEvent.

Data usage and handling

Each type you selected gets its own set of questions. For all of them: purpose App functionality and Analytics, the data is required rather than optional, because link resolution does not work without it, and it is not processed ephemerally, because Detour stores it to match a later install.

The form also asks whether each type is shared. Google does not count data sent to a service provider that processes it on your instructions, and does count data sent to a third party. Whether Detour is one or the other is set by your contract with us, so take that answer from the contract. The definitions are in Provide information for Google Play’s Data safety section.

The package requests no Android permissions of its own. In particular it does not add com.google.android.gms.permission.AD_ID, so it does not force an advertising-ID declaration onto your app.

These declarations cover the SDK, not your payloads

The SDK does not inspect two kinds of data it sends, so nothing above covers them:

• DetourAnalytics.logEvent sends the data object as you built it.
• Universal Link query parameters are forwarded as-is.

If either one carries personal data, declare it under your own app’s entries.

Related pages

Installation Add the package and configure native link handling.

API Reference Config fields, including the two privacy switches.

Matching Which signals feed deferred-link attribution.

Analytics What the analytics module records.