# Privacy modes

> Choose between product analytics and strict anonymous mode for your iOS app in Union, and what each one stores and answers.

Source: https://useunion.dev/docs/privacy · Updated 2026-10-23

Each project has a privacy mode, chosen when it is created. It is enforced when events arrive — not in the panel — so an app cannot send what its project does not allow.

## The two modes

| | Product analytics | Strict anonymous |
| --- | --- | --- |
| Identifier across sessions | A pseudonymous install id | None |
| People and profiles | Yes | No |
| Per-person retention | Yes | No |
| `Union.identify`, crash keys | Allowed | Refused |
| Screens, events, features, crashes | Yes | Yes |
| Linking purchases to people | Yes | No |

The mode cannot be changed after the project is created: switching would change the meaning of data already collected.

## What is never stored

- The full IP address: it is truncated before anything is written.
- Advertising identifiers. The SDK uses no IDFA and needs no App Tracking Transparency prompt.
- The query string or fragment of a deep link — only scheme, host and path.
- Survey comments and question text from Survicate — only the NPS category and score.
- The IP of a server sending server-side events, and any country or region for them.

## App Store privacy answers

The SDK ships a `PrivacyInfo.xcprivacy`. Your answers in App Store Connect depend on the mode:

- **Product analytics:** Product Interaction, Device ID and User ID — linked to the user, used for analytics, not for tracking. Plus anything you send as traits, such as email or name.
- **Strict anonymous:** Product Interaction, not linked to the user.
- **Crash reports** count as Other Diagnostic Data in both modes.

> **Only strict anonymous is anonymous**
> Do not describe product analytics data as “fully anonymous” in your app’s privacy copy: an install id is pseudonymous, not anonymous.