Almost every third-party SDK in your app sends user data to someone else's servers. App Review, the Google Play Data Safety form and the GDPR all expect your privacy policy to name those recipients, say what they receive and why, and match the answers you give in your App Store privacy label. This library gives you a copy-paste privacy policy clause for each common SDK, plus the exact App Store "App Privacy" categories and Google Play Data Safety data types that SDK maps to. Generate a full privacy policy with these clauses built in →
How to use this library
Start from the SDKs your app actually links. For each one, open its page below, paste the clause into your privacy policy under a "Third-party services" or "Data sharing" heading, and adapt the bracketed parts (retention period, hosting region, whether you identify users). Then use the same page's label section when you fill in App Store Connect and the Play Console. If two SDKs collect the same category, you still declare it once per store, but you should list every processor in the policy text.
A few rules that apply across all of them:
- Analytics, crash and push SDKs are normally "not tracking" in a default configuration, because they do not use an advertising identifier or build a cross-app profile. They still have to be disclosed as data collection.
- Advertising and attribution SDKs are "tracking" under Apple's App Tracking Transparency framework and Guideline 5.1.2. They need an ATT prompt before they can read the IDFA, and Apple's June 2026 Guidelines rewrite treats device fingerprinting as tracking even when the user denies the prompt.
- Self-hosted changes the answer. If you run an SDK's backend yourself (self-hosted PostHog, Sentry, Supabase), there is no third-party transfer and you disclose only your own hosting.
- These clauses are templates, not legal advice. You are responsible for confirming they match your build and your configuration.
Analytics and product data
These SDKs record screen views, events and a device or user identifier so you can measure usage. In a default setup they are processors acting on your instructions and are not used for tracking.
Crash reporting, performance and push
Diagnostics SDKs send stack traces, device state and performance traces; push SDKs register a device token and route message payloads. Watch for stack traces and URL paths that carry personal data.
- Firebase Crashlytics
- Sentry
- Firebase Performance Monitoring
- Firebase Cloud Messaging (FCM)
- OneSignal
Advertising
Ad SDKs read device identifiers, build or feed cross-app models and share data with advertising partners as independent controllers. Every one of these is tracking and needs an ATT prompt and, in the EEA and UK, a consent signal.
Attribution and deep linking
Attribution SDKs match an install or a click to a marketing source, which involves identifiers and, on iOS, probabilistic matching. They are tracking SDKs and are declared as such.
Authentication
Sign-in SDKs receive an account identifier, and often an email address and display name, to create and verify user accounts. This is app functionality, not tracking, but it triggers account-deletion obligations.
If your app has accounts, you also need a public deletion route. See the account deletion page generator.
Payments and backend
Subscription, paywall and backend SDKs process purchase records, receipts and whatever application data you store. Payment processors are usually a mix of processor and independent controller for fraud and legal compliance.
What App Review actually checks
Reviewers compare three things: the data-collection disclosure in your privacy policy, the App Privacy label in App Store Connect, and the behaviour they observe from the app. A Guideline 5.1.1(v) or 5.1.2 rejection usually means one of those three disagrees with the others — for example, an SDK collects an identifier that the label does not declare, or an ad SDK runs before the ATT prompt. Working SDK by SDK through this library keeps the three aligned.
Related
Build the full document with the privacy policy page generator, add a compliant deletion route with the account deletion page generator, and if your stack is Firebase-heavy read the Firebase privacy policy generator guide.