Information about how the Xtremepush mobile SDKs store data
By default, the only data collected with the Xtremepush SDKs is anonymous in nature and cannot be used to identify a data subject. This data can be used to build up an understanding of how a mobile app is being used, but is not personally identifiable information. Instead, the data collected contains information about the device used to access a mobile app, such as the version of Android or iOS, the app version number, the SDK version number and analytics about app sessions.
The device ID (Android ID or IDFV) is processed by the SDK for the purposes of de-duplicating devices. This ID cannot be linked back to a user because it is unique for different apps (or developer accounts) on a device. As such, it is not deemed to be personal data. This is confirmed by the official documentation from both Android and Apple.
For services like push notifications, the consent for these notifications can be requested by the Xtremepush iOS SDK (Android push notifications don't require opting in), however, it is recommended this should be overridden if the app developers have a more sophisticated value exchange process, which moves the control of the consent to the main app code.
Based on the user's subscription in the app, push tokens are shared with the Xtremepush SDK after consent, but this does not introduce a personal identifier as these tokens change and are not the same for all apps on the user's device.
Identifiable data points such as Advertising IDs, email addresses, first/last names, mobile numbers, user IDs or geographical locations are not collected by the SDK automatically. Instead, functions need to be called by the app developers to pass this information to the Xtremepush SDK. Consent for this data collection will need to be obtained before passing this data to Xtremepush. For more information on this optional device data see our dedicated guide.