Privacy regulations for mobile app analytics
What counts as personal data, what usually brings consent into play, and how Respectlytics is built to keep personal data out of your analytics. Written for developers, to share with legal.
Not legal advice. Regulations vary by jurisdiction and change over time; your legal team decides what applies to your app.
What counts as personal data
Under rules like the GDPR, any information that can identify a person, directly or indirectly. In mobile analytics that usually means:
- Device identifiers
- The IDFA, the IDFV and the Android Advertising ID each single out one device.
- IP addresses
- They can be used to identify or locate someone.
- Persistent user IDs
- Any identifier that follows the same person over time.
- Custom properties
- Free-form fields that can end up holding names, emails or other details.
What usually brings consent into play
Consent requirements are generally triggered when analytics:
- stores something on the device: cookies, local storage or identifiers written to disk
- links behaviour across visits to the same person
- collects device identifiers or fingerprints the device
- shares data with advertising networks or other services
There is also a difference between processing data for a moment, such as looking up a country from an IP address and discarding it, and retaining it in databases, logs or files. Retained personal data brings stricter obligations.
How Respectlytics keeps the list short
The architecture avoids the usual triggers. What follows describes the product, not your obligations.
No device identifiers
The SDKs never read the IDFA, the IDFV or the Android Advertising ID, and do not fingerprint the device.
No IP address with an event
It is used to look up the country, then discarded. The event keeps the country alone.
Five fields, and nothing undeclared
A request with any other field is rejected, and a property is kept only when you declared it and its value, so personal details have no extra field to arrive in.
Sessions that stay separate
A new session ID every two hours and on each launch; no stored field links two sessions.
Nothing on the device
The session ID lives in memory only: no disk, no local storage, no cookies.
No selling, no ad networks
We do not sell, rent or trade data, and do not share it with advertising networks. The privacy policy says who receives data.
A checklist for your legal team
The technical facts, in one place, for their review.
- No device identifiers collected
- No persistent user IDs
- No free-text properties: only properties and values you declared
- No IP address stored with analytics data
- Session IDs replaced every two hours
- Session IDs in memory only on the device
- No cookies or local storage
- Servers and databases in the EU
Should you ask for consent?
The question everyone wants a one-word answer to. Here is what we can and cannot say.
What we can tell you
- the architecture avoids the usual triggers: device storage, persistent identifiers and tracking across sessions
- the rules share core principles, but how they are applied varies by country and changes over time
What we cannot tell you
- what your app needs: we are not lawyers and do not give legal advice
- that your app complies with any particular law
Share this page and the technical documentation with your legal team. The technical facts are clear; the legal reading is theirs to make.
Questions about the rules
What Respectlytics stores, and what that leaves for you to decide.
What data does Respectlytics store?
Five fields per event: event_name, session_id (hashed before storage), timestamp, platform and country, a two-letter code looked up from the IP address when the app does not send one. On a paid plan, an event can also keep properties you declared, each with a value you declared or a number's band. The API rejects any request with an unknown field.
Does Respectlytics store IP addresses?
Not with analytics data. The IP address is used to look up the country and then discarded. Separate security records, described in the privacy policy, may contain IP addresses.
Does Respectlytics use cookies or device storage?
No. The session ID exists only in memory on the device, is not written to disk, and is replaced every two hours and on each launch.
Do I need to update my privacy policy?
Yes. Disclose that your app uses analytics. The privacy policy snippet on this site is a starting point that describes what Respectlytics handles; have your legal team review the final text.
Is Respectlytics compliant with privacy regulations?
We do not claim that, and no tool can make an app compliant on its own. Respectlytics is designed to collect as little as possible, which leaves your legal team less to assess. They decide what applies to your app.
How does the right to erasure apply?
None of the five stored fields is a user or device identifier, so there is nothing to look up by user. If your legal team decides deletion is appropriate, you can delete by date range, platform and country in the dashboard or through the API.
Related
Guides for the practical side.
Privacy policy snippet Data deletion guide Why privacy-first analytics matters SDK documentation
Try it on your own app
Free for one app and 20,000 events a month, no card needed. Unlimited apps on every paid plan.
This guide is provided for educational purposes and does not constitute legal advice. Privacy regulations vary by jurisdiction and change over time; consult your legal team to determine the requirements that apply to your situation.