# Privacy and security

Updated September 11, 2026.

ActivationPal measures app usage, onboarding, and purchases. By default, the mobile SDK identifies an installation with a random device ID. It does not automatically collect the app user's name or email address.

## GDPR and your responsibilities

**We do not currently offer a GDPR / UK GDPR Data Processing Addendum (DPA).**

You decide which events to send. You are responsible for your app's privacy notice, lawful basis, consent where required, and user access/deletion requests.

A device ID lets you recognise repeat activity within your app. That means the data is not automatically anonymous, even without a name or email. You can also send optional user IDs and custom properties; purchase integrations may include customer attributes. Avoid sending names, emails, or sensitive information unnecessarily.

Disclosure alone does not establish GDPR compliance or remove an analytics provider's own obligations. See the [EDPB's explanation of controller and processor responsibilities](https://www.edpb.europa.eu/sme/learn-the-basics/data-controller-or-data-processor_en) and [ICO guidance on identifiers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/).

## Data collected and privacy controls

Events include timestamps, device/session IDs, app and device information, language, timezone, and approximate country/city. Custom properties, optional user IDs, and purchase-provider payloads depend on your integration.

| Question | Current behavior |
| --- | --- |
| Do you store IP addresses? | No dedicated raw-IP field in event records. Hosting receives the IP; the API uses it in memory for rate limiting. Provider logs may retain it. |
| Do you use IP geolocation? | Yes. Country and city derived by Vercel are stored with events. |
| Can IP processing or geolocation be disabled? | No built-in setting for either. |
| Can the random device ID be disabled, shortened, or rotated? | No built-in setting. It persists in app storage without a timed expiry. |
| Can an optional user ID be cleared? | Yes: `setUserId(nil)` in Swift, `setUserId(null)` in Kotlin/Flutter, or `setUserId(undefined)` in React Native. This does not change the device ID or delete history. |

For new installations, wait to configure the SDK until collection is permitted. There is currently no built-in runtime consent-withdrawal switch. Device IDs support analytics within an app; ActivationPal does not provide an advertising tracking network.

## Hosting and providers

The primary database is in **Northern California, United States** (Supabase/AWS). API functions default to **Washington, D.C., United States** (Vercel). Vercel also handles requests through its global network. There is no customer region selector.

| Provider | Purpose and location |
| --- | --- |
| Supabase / AWS | Event storage and authentication. Primary database: United States. |
| Vercel | Website/API hosting. United States function region; global request handling. |
| Crisp | Website support, account identity, plan and usage counts. Messaging: Netherlands; plugins: Germany; relays/logs also in US, UK and Singapore. [Details](https://help.crisp.chat/en/article/crisp-eu-gdpr-compliance-status-nhv54c/). |
| Loops | Team invitation emails and app labels. United States; other processing locations need confirmation. [Details](https://loops.so/privacy). |
| Stripe | ActivationPal subscription billing. International processing, including United States. [Details](https://stripe.com/legal/privacy-center). |
| DataFast | Website/dashboard traffic analytics. Storage region not confirmed. [Details](https://datafa.st/privacy-policy). |

Crisp and DataFast are website services, not part of the mobile SDK. Optional integrations exchange data with RevenueCat, Superwall, Apple (attribution/ads), and Google (dashboard sign-in). Your chosen API/MCP clients receive the analytics you authorize them to access.

This lists known integrations, not a complete contractual subprocessor schedule. Backup, log, staff-access, authentication-email, and onward-provider locations remain unconfirmed; we cannot promise EU-only processing.

## Retention

- **Events, identifiers, and location:** no automatic age-based deletion or configurable retention period. Records can remain until explicitly deleted. Plan history windows are not deletion deadlines.
- **Device ID:** persists without expiry; backup/restore can affect its lifetime. **SDK queue:** up to 500 events, removed after delivery or capacity eviction, without a time limit.
- **Apple attribution tokens:** removed/replaced through resolution and retry cleanup. Their 24-hour validity is not a deletion deadline.
- **In-memory IP keys:** ingestion counters reset after one minute; keys may remain until eviction or process termination.
- **Logs and backups:** retention periods and backup configuration are not confirmed. No customer retention settings.

## Export and deletion

To delete an app and its live events: **Settings → Apps → select app → Delete app**, type its slug, and confirm. This does not erase provider logs, backups, or separately connected RevenueCat/Wrapped data.

For a complete export or device-specific deletion, email [support@activationpal.com](mailto:support@activationpal.com) from your account email. Include the app slug, requested operation, device ID, and any linked user/purchase-provider IDs. Do not send credentials. Scope and turnaround are confirmed individually; no guaranteed service deadline is published.

There is no self-service device deletion or complete export. The agent API's event list is capped at 500 rows; timelines also have limits. Stop collection and webhooks if you need to prevent new records after deletion. [Managing apps](apps.md).

## Security

We use HTTPS, authenticated dashboard access, app-scoped permissions, hashed API-key authentication, encrypted retrievable SDK keys, encrypted integration secrets, and signature verification for customer-configured revenue webhooks. Privileged service administrators can access customer data. [Supabase documents AES-256 encryption at rest and TLS in transit](https://supabase.com/security).

No ActivationPal-specific independent audit or certification is published. Staff access-review practices, backup/restore guarantees, and incident-response deadlines are not confirmed here. Report security concerns to [support@activationpal.com](mailto:support@activationpal.com).

## How event data is used

Events power your analytics and internal service administration. Administration includes recent event details and activity counts combined across customer apps. Customer-facing access is limited to authorized apps.

The current implementation has no event-resale, advertising-audience export, model-training, or separate event-content product-development pipeline. This describes current behavior, not a contractual data-use guarantee. Apple attribution and customer-authorized AI/API clients are separate data flows.

## Example app notice

Adapt this to your integration and add your purposes, lawful basis/consent, retention, transfer details, and contact information.

> We use ActivationPal to understand app usage and purchases. It receives usage events, a random installation ID, app/device information, and approximate location derived from your IP address. Depending on our integration, it may also receive user identifiers and purchase data. Analytics data is stored in the United States. Contact our app support to request access or deletion.