▸Install the Swift (iOS) SDK
// Package.swift
dependencies: [
.package(url: "https://github.com/respectlytics/respectlytics-swift.git", from: "3.0.0")
]
// Or via Xcode → File → Add Packages → paste the URL above.The SDK ships only via Swift Package Manager. CocoaPods and Carthage are not published — fewer integration paths means fewer surfaces to keep audited.
▸Initialize Respectlytics in Swift (iOS)
import Respectlytics
@main
struct MyApp: App {
init() {
Respectlytics.configure(appKey: "<YOUR_APP_KEY>")
}
var body: some Scene { WindowGroup { ContentView() } }
}Call configure once at app launch — typically in your App struct's init. No Info.plist keys are required: the SDK does not call ATTrackingManager and does not request the IDFA, so NSUserTrackingUsageDescription should NOT be added.
✦Privacy & implementation notes
GDPR's Article 4(1) classifies IP addresses as personal data, with narrowing case law on transient-purpose processing. The ECJ's Patrick Breyer v. Bundesrepublik Deutschland (2016) and subsequent cases established that even "dynamic" IPs are personal data when the recipient has the means to identify the user. The transient-discard pattern minimises the data-retention surface but doesn't eliminate the legal classification — consult your legal team.
The country code stored in events is sufficient for the most common product breakdown — "how does this metric vary by market?". Going deeper (city, ZIP) almost always falls into either a marketing-ads use case (handled elsewhere) or a vanity dashboard that doesn't drive product decisions.
Apple rejected approximately 3% of apps in 2024 for incorrectly omitting NSUserTrackingUsageDescription when ATT was required by the SDKs they shipped. Respectlytics doesn't trigger ATT. The corollary is also true: do not add the key on Respectlytics's account — its presence implies you track across apps, even if your code never calls requestTrackingAuthorization.
Internally the Swift SDK uses Swift Concurrency: events are queued in an actor-isolated buffer (RAM-only), flushed on a 30-second timer and on UIApplication.willResignActiveNotification. Force-quit before flush drops queued events — by design. There is no UserDefaults or file backing.
⇋How this compares to other analytics SDKs
| Geolocation handling | Firebase Analytics | Mixpanel | Amplitude | Respectlytics |
|---|---|---|---|---|
| Stores IP address | Yes | Yes (90 days default) | Yes | No (discarded after lookup) |
| Stores precise lat/long | Optional | Optional | Optional | No |
| Stores city / region | Yes | Yes | Yes | No |
| Stores country code | Yes | Yes | Yes | Yes |
| Per-user location history | Yes | Yes | Yes | No |
| Reverse-DNS or VPN detection | Yes | Yes | Yes | No |
❓Frequently asked questions
Is the IP-address-then-discarded path still considered processing PII?
Most regulators (including the EU's EDPB) classify IP addresses as personal data even when transiently held for a strictly defined purpose. The transient-then-discarded pattern is generally accepted as the most minimised viable approach for country lookup. Consult your legal team for the exact framing in your jurisdiction; the standard disclaimer applies.
How accurate is the country lookup?
We use MaxMind GeoLite2's country database, refreshed monthly. Accuracy is ~99% for standard residential and mobile IP ranges; lower for VPNs, Tor, and corporate egresses. For country-level rollups in product analytics, the accuracy is sufficient.
Can we get city-level breakdowns for marketing?
Not from Respectlytics, by design. City-level geolocation is one of the more privacy-sensitive analytics fields and is not aligned with the ROA philosophy. If you genuinely need city-level breakdowns for paid ads campaigns, your ads platform provides them on its own (Google Ads, Meta Ads) — that lives in the ads attribution layer, not in product analytics.
What about regions like Hong Kong / Taiwan / Crimea — how are they assigned?
Respectlytics uses ISO 3166-1 alpha-2 country codes from MaxMind. Regions with politically contested status are coded by MaxMind's geographic convention, not by political alignment. If your audience needs a finer regional breakdown for a specific reason, the workaround is to fire distinct event_names per region of interest.