AppsFlyer sends user data to AppsFlyer Ltd. Device identifiers, IP address and install and click data leave the device and are processed on AppsFlyer's infrastructure so it can attribute installs to marketing campaigns — a third-party data transfer that App Store review, Google Play and the GDPR all require you to disclose. Generate a full privacy policy with this clause built in →
Does AppsFlyer need a privacy policy disclosure?
Yes. AppsFlyer is a mobile attribution and marketing-analytics SDK. When a user installs or opens your app, the SDK sends AppsFlyer a first-open or session event together with device identifiers (IDFA when App Tracking Transparency consent is granted, IDFV, the Android Advertising ID, and an AppsFlyer-generated ID), the device IP address, device attributes (model, OS, carrier, language) and any click or referrer data it can match. AppsFlyer compares that against ad-network click data to decide which campaign drove the install.
Because AppsFlyer links data collected in your app with advertising activity from other apps and companies, this is "tracking" under Apple's App Tracking Transparency and Guideline 5.1.2, and you must show an ATT prompt before the SDK collects the IDFA. AppsFlyer generally acts as your data processor for the raw attribution data, but ad networks that receive postbacks act as independent controllers. On iOS, AppsFlyer also reads SKAdNetwork and AdAttributionKit conversion data.
What data does AppsFlyer collect?
| Data type | Purpose | Linked to the user? | Used for tracking? |
|---|---|---|---|
| Device identifiers (IDFA with ATT consent, IDFV, Android Advertising ID, AppsFlyer ID, optional customer user ID) | Match installs to ad clicks, attribution | Yes | Yes |
| IP address | Attribution matching, coarse geo, fraud detection | Yes | Yes |
| Install, first-open, session and re-engagement events | Attribution and analytics | Yes | Yes |
| In-app events you send (including revenue and purchase events, if configured) | Campaign ROI reporting | Yes | Yes |
| Click and referrer data (ad-network click IDs, deep-link parameters) | Attribution | Yes | Yes |
| Device and configuration attributes (model, brand, OS version, carrier, locale, timezone) | Attribution, fraud detection, compatibility | Yes | Yes |
The exact list depends on your configuration. Enabling the customer user ID, sending revenue events, turning on the fraud-protection product, or integrating additional partners all expand what you must disclose. AppsFlyer offers IP-address masking and a device-ID opt-out; if you enable those, adjust the table accordingly.
Copy-paste privacy policy clause for AppsFlyer
Attribution. We use AppsFlyer, a mobile attribution service provided by
AppsFlyer Ltd., to measure the performance of our marketing campaigns.
When you install or use our app, the AppsFlyer SDK collects device
identifiers (including the advertising identifier where you have granted
permission), your IP address, install and in-app events, and technical
device attributes, and transmits them to AppsFlyer. AppsFlyer processes
this data as our service provider to determine which advertising channel
led you to our app and to detect install fraud. Advertising networks
that receive attribution results act as independent controllers for
their own measurement. This processing constitutes cross-app tracking
and we request your consent before collecting the advertising
identifier. AppsFlyer's EU representative is AppsFlyer Germany GmbH,
Berlin. Learn more at https://www.appsflyer.com/legal/services-privacy-policy/.Adapt this: remove the fraud-detection phrase if you do not license Protect360, and add revenue or subscription events if you send them. You are responsible for making sure the wording matches what your build does; this is a starting point, not legal advice.
App Store "App Privacy" label answers
For a standard AppsFlyer integration, declare in App Store Connect:
- Identifiers > Device ID — purpose "Third-Party Advertising" or "Analytics", Linked to the user: Yes, Used to Track You: Yes.
- Identifiers > User ID — only if you set a customer user ID. Linked: Yes, Used to Track You: Yes.
- Usage Data > Product Interaction — purpose "Analytics" and "Third-Party Advertising", Linked: Yes, Used to Track You: Yes.
- Usage Data > Advertising Data — campaign and click data, Used to Track You: Yes.
- Purchases > Purchase History — only if you send revenue events.
- Diagnostics is generally not required unless you enable additional SDK modules.
AppsFlyer ships an Apple privacy manifest (SDK 6.14.0 and later) that lists these data types and its tracking domains; add those domains to your app's manifest and make sure ATT gates the IDFA.
Google Play Data Safety answers
In the Play Console Data Safety form, declare:
- Device or other IDs — Collected: Yes. Shared: Yes (with advertising networks). Purpose: Advertising or marketing, Analytics, Fraud prevention. Not processed ephemerally.
- App activity > App interactions and Other actions — Collected: Yes. Shared: Yes. Purpose: Advertising or marketing, Analytics.
- App info and performance > Other app performance data — if you send diagnostic events.
- Financial info > Purchase history — only if you send revenue events. Shared: Yes.
- Approximate location is derived from IP; declare Location > Approximate location if you have not enabled IP masking.
Users can request deletion: AppsFlyer exposes an OpenDSR / data-subject-request API keyed on the device identifier, and the SDK has opt-out methods. Mention that route in your policy.
AppsFlyer-specific gotchas
- ATT gates the IDFA, not the SDK. AppsFlyer keeps collecting the IDFV, its own AppsFlyer ID and the IP address even when the user denies tracking — you still owe the disclosure and the "Used to Track You" label because the data feeds cross-app attribution.
- Probabilistic modeling is off by default on iOS. AppsFlyer disabled fingerprint-style probabilistic attribution for iOS install attribution after Apple's stance hardened; do not re-enable it for iOS without legal review, because Apple rejects apps that fingerprint regardless of ATT consent.
- Tracking domains must be in your privacy manifest. If you omit AppsFlyer's domains from
NSPrivacyTrackingDomains, iOS will not block them under ATT and your label becomes inconsistent with runtime behavior. - Retention is set by AppsFlyer and your partners. Raw user-level data retention depends on your plan and each connected ad network's terms; state a retention period in your policy and confirm it in your AppsFlyer dashboard settings.
- Revenue events expand your label. Sending
af_purchaseadds purchase history to every store disclosure. - EU representative. AppsFlyer Ltd. is established in Israel; its Article 27 EU representative is AppsFlyer Germany GmbH in Berlin — name it if your policy lists sub-processor representatives.
Related
See the sibling clauses for Adjust, Branch, Firebase Authentication and Sign in with Apple. For the full document use the privacy policy page generator, and for Firebase services read the Firebase privacy policy generator guide.