Privacy & Data Safety
Understand exactly what the SDK collects and transmits, and fill out the stores' data safety / privacy labels correctly.
Google Play (Data Safety) and the App Store (App Privacy labels) require you to declare what data your app collects and shares. Declaring it wrong can get you rejected at review — or become a policy violation later. This page lays out exactly what the Unveily SDK handles so you can complete your policy and labels with confidence.
Core principle — separate the two parties
Two parties handle data in your app. Always distinguish them when declaring.
| Party | What it handles | Who declares it |
|---|---|---|
| Unveily SDK (native) | App/device identifiers needed for license verification | Per the table below (mostly N/A) |
| Your web app (WebView content) | Login info, user input, everything sent to your server | Your responsibility — declare what the web app collects |
Most of the Data Safety / label content depends on what your web app collects. Don't declare "no collection" just because you looked at the Unveily SDK. If your WebView handles email, payments, location, etc., you must declare those.
What the Unveily SDK collects & transmits
Sent to Unveily's server (license verification)
At app launch the SDK sends the following to Unveily's server (api.actuallyworks.net) to verify the license.
| Item | Content | Personal data? |
|---|---|---|
| License key | The subscription license key issued to your company | ❌ Not end-user data |
| Package name / Bundle ID | App identifier | ❌ |
| App signature hash (Android) | Tamper-protection signing fingerprint | ❌ |
| Integrity token | Play Integrity token (when enabled) | ❌ Device check, not user identification |
These identify the app/license, not the end user (no name, email, etc.). (As with any server request, an IP address may be observed in transit.)
Analytics & tracking
The Unveily SDK includes no Firebase Analytics, Crashlytics, advertising identifiers (AAID/IDFA), or third-party tracking SDKs. The SDK itself does not analyze or track user behavior.
Push notifications (FCM)
If you use push notifications, Firebase Cloud Messaging's device registration token is used. This is a device identifier, managed in your server / Firebase project to deliver push.
Device features (camera, location, biometric, photos, etc.)
- Accessed only when you enable the feature in config and the user actually uses it.
- Any resulting data (photos, location, etc.) stays on the device or is passed to your web app. Unveily does not receive or store it.
- Each feature is disabled (commented out) by default in the manifest / Info.plist; enable only what you use → Production Checklist.
Filling out Google Play Data Safety
Complete this under Play Console → App content → Data safety.
- Start from what your web app collects — email, name, payments, location, anything the web app sends to a server
- Declare data types corresponding to the device permissions you use (e.g. "Location" if location is enabled)
- For each, choose the purpose and whether it's encrypted in transit (yes for HTTPS)
- The Unveily SDK itself collects no analytics/ads data, so those aren't reportable unless your web app collects them
Leaving unused permissions in the manifest forces you to declare unnecessary items in Data Safety. Enable only the permissions for the Bridges you actually use.
Filling out App Store privacy labels
Complete this under App Store Connect → app → App Privacy.
- Again, base your type selection on what your web app collects
- Indicate whether each data type is used for Tracking — the Unveily SDK does no tracking
- Keep the labels consistent with the
Info.plistusage-description strings for the features you use - For in-app purchases (Pro), see In-App Purchase setup
What to include in the privacy policy document
At minimum, your public policy document should cover:
- The data items and purposes your app (including the web app) collects
- Whether data is retained, shared, or provided to third parties
- How users can request access/deletion, plus a contact
- The device permissions used (camera, location, etc.) and their purpose
- Optionally, that app-identifying info is sent to Unveily's server for license verification
You can quickly draft the policy with an AI tool (Claude, ChatGPT, etc.) by telling it "data our web app collects: [list], device permissions we use: [list]." But always have a human verify the draft matches your actual collection.