Privacy
What the SDK collects, and what to answer in App Store Connect's privacy questions and Google Play's Data safety form.
The short version: no tracking, no advertising IDs, no prompt. The SDK collects a random install id, where the install came from, and your user id if you pass one. It's all for analytics.
What the SDK collects
| Data | Why |
|---|---|
| A random install reference | To count each install once |
| Apple's AdServices token (iOS) | To get Apple's attribution record |
| The Play Install Referrer (Android) | To see which campaign link led to the install |
| Your app user id, if you pass one | To match the install to revenue |
| App version, OS version, device model, locale | To read the install correctly |
It doesn't collect the IDFA, the advertising ID, the Android ID, names, emails, location, contacts or anything a user types. It doesn't use App Tracking Transparency, and doesn't need its prompt.
Fload sends Apple's token back to Apple, to get the attribution record. Nothing goes to anyone else, and nothing is used for advertising or sold.
App Store privacy answers
The iOS SDK ships a privacy manifest (PrivacyInfo.xcprivacy) that declares no tracking, no tracking domains and no required-reason APIs. Xcode includes it in your app's privacy report.
In App Store Connect, under App Privacy, declare these data types:
| Data type | Linked to the user | Used for tracking | Purpose |
|---|---|---|---|
| Identifiers → Device ID (the random install reference) | Yes | No | Analytics |
| Usage Data → Advertising Data (Apple's attribution) | Yes | No | Analytics |
Identifiers → User ID (only if you call setUserId) | Yes | No | Analytics |
The install reference is random and made by the SDK. It isn't the IDFA or the vendor id. We declare it as a device ID to be safe.
If your app already declares some of these for other reasons, add Analytics to their purposes.
Google Play Data safety
In Play Console, under App content → Data safety, declare:
| Data type | Collected | Shared | Purpose |
|---|---|---|---|
| Device or other IDs (the random install id) | Yes | No | Analytics |
Personal info → User IDs (only if you call setUserId) | Yes | No | Analytics |
| App info and performance → Other app performance data (the Play Install Referrer, app and Android version, device model, locale) | Yes | No | Analytics |
And answer:
- Is data encrypted in transit? Yes. The SDK sends over HTTPS only.
- Is collection required or optional? The SDK has no opt-out of its own. Your app decides whether to call
configure, so if you only start it after consent, it's optional. - Is it used for advertising or marketing? No.
The install id isn't the advertising ID or the Android ID, and it resets on reinstall.
Consent
Apple says AdServices "does not engage in tracking as defined under the App Tracking Transparency framework", so the SDK needs no ATT prompt. If your app asks for consent under your own policy, call configure only after the user agrees. Until then the SDK does nothing.
Questions
For a data processing agreement or a deletion request, email support@fload.com. See also Fload's privacy policy.