Each project has a privacy mode, chosen when it is created. It is enforced when events arrive — not in the panel — so an app cannot send what its project does not allow.
The two modes
| Product analytics | Strict anonymous | |
|---|---|---|
| Identifier across sessions | A pseudonymous install id | None |
| People and profiles | Yes | No |
| Per-person retention | Yes | No |
Union.identify, crash keys | Allowed | Refused |
| Screens, events, features, crashes | Yes | Yes |
| Linking purchases to people | Yes | No |
The mode cannot be changed after the project is created: switching would change the meaning of data already collected.
What is never stored
- The full IP address: it is truncated before anything is written.
- Advertising identifiers. The SDK uses no IDFA and needs no App Tracking Transparency prompt.
- The query string or fragment of a deep link — only scheme, host and path.
- Survey comments and question text from Survicate — only the NPS category and score.
- The IP of a server sending server-side events, and any country or region for them.
App Store privacy answers
The SDK ships a PrivacyInfo.xcprivacy. Your answers in App Store Connect depend on the mode:
- Product analytics: Product Interaction, Device ID and User ID — linked to the user, used for analytics, not for tracking. Plus anything you send as traits, such as email or name.
- Strict anonymous: Product Interaction, not linked to the user.
- Crash reports count as Other Diagnostic Data in both modes.
Worth knowing
Only strict anonymous is anonymous
Do not describe product analytics data as “fully anonymous” in your app’s privacy copy: an install id is pseudonymous, not anonymous.
Updated Oct 23, 2026 · Markdown