Each project has a privacy mode, chosen when it is created. It is enforced when events arrive — not in the panel — so an app cannot send what its project does not allow.
The two modes
| Product analytics | Strict anonymous | |
|---|---|---|
| Identifier across sessions | A pseudonymous install id | None |
| People and profiles | Yes | No |
| Per-person retention | Yes | No |
Tapll.identify, crash keys |
Allowed | Refused |
| Screens, events, features, crashes | Yes | Yes |
| Linking purchases to people | Yes | No |
The mode cannot be changed after the project is created: switching would change the meaning of data already collected.
Websites
A website in the same project follows the same mode. In strict anonymous, the script stores nothing in the browser and needs no consent banner; the visitor is a server-side hash with a daily salt, so someone who returns on another day counts again. In product analytics the script keeps an anonymous id in localStorage and can show Tapll’s consent banner. The path of a page is stored, never its query string or fragment. See Add the website script.
What is never stored
- The full IP address: it is truncated before anything is written.
- Advertising identifiers. The SDK uses no IDFA and needs no App Tracking Transparency prompt.
- The query string or fragment of a deep link or a web page — only the path.
- Survey comments and question text from Survicate — only the NPS category and score.
- The IP of a server sending server-side events, and any country or region for them.
App Store privacy answers
The SDK ships a PrivacyInfo.xcprivacy. Your answers in App Store Connect depend on the mode:
- Product analytics: Product Interaction, Device ID and User ID — linked to the user, used for analytics, not for tracking. Plus anything you send as traits, such as email or name.
- Strict anonymous: Product Interaction, not linked to the user.
- Crash reports count as Other Diagnostic Data in both modes.
Only strict anonymous is anonymous Do not describe product analytics data as “fully anonymous” in your app’s privacy copy: an install id is pseudonymous, not anonymous.