#Privacy details for the stores

Both stores ask what data your app collects and why. The tables below list what X3 collects per module, so you can take them over into App Store Connect and the Play Console. The dashboard generates the same tables for exactly the modules your app uses: Einstellungen › Apps › Nordlicht › Datenschutz-Angaben (Privacy details), with copy buttons.

You decide how consent works in your app, and you are responsible for that decision. X3 implements your choice technically but does not check whether it is legally right for your users and countries. Clarify the legal basis with your privacy counsel and describe X3 in your privacy policy and in the App Store and Google Play privacy details.

Check the details for your app; X3 does not know every use. Other SDKs in your app and your own backend have their own entries.

Modules (which rows apply to you):

#App Store privacy details

All rows: data collected by your app through X3, Linked to the user: yes. Purpose Analytics unless stated.

"Used for tracking" means Apple's definition: linking data from your app with data of other companies for advertising or advertising measurement. With adPlatforms and iOS users who allowed ATT, X3 sends hashed identifiers and purchases to ad platforms, which is tracking; declare it, and your app must then ask for ATT before it happens (ATT rule). Without adPlatforms, or for users who did not allow ATT, X3 sends no user data to ad platforms.

#Google Play data safety

X3 is a service provider of the developer, so transfers to X3 are not "sharing" in Google's sense; transfers to ad platforms with adPlatforms are. Data is encrypted in transit: yes. Users can request deletion: yes (deleting a user).

In the Play Console declaration Advertising ID X3 alone means "No": the SDK removes the AD_ID permission from its manifest and never reads the advertising id. Check the merged manifest when other SDKs need it.

#Privacy manifest

Each iOS product ships its own PrivacyInfo.xcprivacy; Xcode merges them into your app's privacy report (Product › Archive › Generate Privacy Report).

The SDK uses no UserDefaults, no keychain and no file timestamp APIs. The manifests describe what the SDK can collect; your App Store privacy details describe what your app collects, and the tracking declaration for ad platforms is yours to make. React Native and Flutter apps get the same manifests through the native SDK.

#App Tracking Transparency

X3 itself needs no ATT prompt: it reads no IDFA and links nothing with other companies' data on its own. ATT matters only when you want iOS conversions with user data reported to ad platforms. Then call X3.requestTrackingAuthorization(), add NSUserTrackingUsageDescription and declare tracking. See conversions › ATT.

#What X3 never collects

• the IDFA or the GAID (AD_ID permission removed), identifierForVendor;
• device model or device name, fingerprints of any kind, IP address and user agent matching between app and web;
• what users type, keystrokes, the clipboard, contacts, photos, location APIs, network traffic or logs;
• anything before the purpose analytics is granted (except an inquiry sent with X3.lead);
• data for any host other than the one you configure (host).

IP addresses are used on the server for the coarse location and abuse protection and are not stored. Identifiers leave the device only as SHA-256 hashes; X3 stores keyed hashes.

#Legal notes

These notes describe typical requirements; they are not legal advice.

• § 25 TDDDG (formerly TTDSG) and Art. 5(3) ePrivacy Directive cover storing the install id in the app's storage and reading device information (install referrer, Apple Ads token, ATT status). The EDPB guidelines 2/2023 on the technical scope of Art. 5(3) apply to apps as much as to browsers.
• GDPR needs a legal basis for the processing: consent (Art. 6(1)(a)) or a documented legitimate interest (Art. 6(1)(f)) after your own assessment. Recordings and reporting to ad platforms are typically consent cases.
• Processor. X3 acts as your processor under your data processing agreement (Art. 28 GDPR) (processor and DPA).
• Health data (health preset) needs explicit consent (Art. 9 GDPR) (health projects).

You decide how consent works in your app, and you are responsible for that decision. X3 implements your choice technically but does not check whether it is legally right for your users and countries. Clarify the legal basis with your privacy counsel and describe X3 in your privacy policy and in the App Store and Google Play privacy details.