Reference
Privacy
This page describes the SDK's current manifest and data paths. Your app determines which optional data it sends and whether that data is linked to a signed-in user.
Bundled privacy declarations
PrivacyInfo.xcprivacy declares tracking as false and lists no tracking domains. It declares access to UserDefaults with reason CA92.1; the default anonymous-token provider uses UserDefaults to persist a random voter token.
The manifest declares these data categories for app functionality, with linked-to-user and tracking flags set to false:
| Manifest category | Relevant SDK data |
|---|---|
| User ID | Anonymous voter token used for participation |
| Product interaction | Participation such as votes and community actions |
| Other user content | Ideas, comments and feedback content |
These are the SDK manifest's declarations, not a completed privacy label for every host app. Verified identity, emails, custom properties, screenshots and diagnostics can change what your integration collects and links to a person. Review those actual data flows when preparing your app's disclosures.
The source package excludes the manifest from its source target; the XCFramework build process copies it into the framework resources. Inspect the artifact you distribute rather than assuming a source checkout proves the packaged manifest is present.
Public and private content
Community ideas and comments are intended for public display under the configured moderation rules. Private feedback, chat, device context and diagnostics belong to the support workflow. Internal notes are excluded from user-facing private threads.
Only promote a private report into a public idea after reviewing the public title and description. Do not copy private contact information, screenshots or diagnostic logs into it.
Identity and storage
Verified credentials come from your authenticated backend. The signing secret stays there; the client receives a short-lived credential and holds it in memory. Clear that credential on sign-out and separate caches and queued writes across account changes.
The default anonymous token is persistent rather than a fresh value for every request. Custom token providers, read caches and offline queue storage can change persistence behavior; review the implementations your host app supplies.
Server-side tenant and reporter checks restrict private data access. A public App ID identifies the destination app; it is not proof of a user's identity.
Screenshots and diagnostics
captureAppNorthScreenshot requires consent, a capture adapter and an app-specific redactor. It returns no screenshot if capture or redaction fails, the output is invalid, or redaction returns the unchanged image. The SDK does not infer which parts of your UI are sensitive.
Diagnostics are optional structured entries. The server sanitizes recognized sensitive patterns, but cannot guarantee that arbitrary text or images contain no personal data. Redact before submission and keep screenshots and logs out of routine error telemetry.
For public review drafts, the configured AI provider receives the app name and review context when drafting is requested. Store-connection secrets are sealed on the server. See Verified identity, Private feedback and Offline and cache for implementation details.