Privacy Policy Clause for OneSignal (2026) - Copy-Paste Text + Store Label Mapping

OneSignal sends push, device, and session data to OneSignal, Inc. OneSignal is a separate company that stores a push subscription and usage profile for every user, so both app stores and GDPR/CCPA require you to disclose it — and on Google Play to declare it as shared. Generate a full privacy policy with this clause built in →

Does OneSignal need a privacy policy disclosure?

OneSignal is a third-party customer-messaging platform (push, email, SMS, in-app). Once initialized, its SDK creates a subscription record on OneSignal's servers and begins sending data: the push token, device model, operating system, app version, SDK version, language, time zone, cellular carrier, notification permission status, and session data (first seen, last seen, session count, total usage time). It derives a country from the request IP address; for users in the EU and UK it does not store the IP itself. If you call OneSignal's identify APIs it also stores the external user ID (alias), email address, phone number, and any tags you set.

OneSignal acts as a data processor and service provider for the app developer under its DPA, but it is a distinct third party. On the Google Play Data Safety form, OneSignal's own documentation instructs developers to answer "Shared: Yes." Used purely for notifications it is not "tracking" under Apple's rules and does not require the App Tracking Transparency prompt, but if you push OneSignal data into analytics or advertising integrations it can become tracking under Guideline 5.1.2.

What data does OneSignal collect?

Data type	Purpose	Linked to the user?	Used for tracking?
Push subscription token	Deliver notifications	Yes if you set an external ID or email	No by default
Device model, OS, app version, SDK version	Segment and deliver messages	No	No
Language, time zone	Localize and schedule messages	No	No
Cellular carrier	Delivery diagnostics	No	No
IP address (not stored for EU/UK) → derived country	Coarse geo-segmentation	No	No
Session count, total usage duration, first and last active time	Engagement analytics and send timing	No	No
Notification permission status	Suppress sends to opted-out devices	No	No
External user ID / alias, email, phone, tags (you set these)	Cross-device targeting and personalization	Yes	No unless fed to ad integrations
In-app purchase events (if enabled)	Analytics	Depends on your backend linking	No

The exact list depends on the developer's configuration and enabled features: everything below the session data is optional and depends on whether you call the identify, email, SMS, or tag APIs, and whether you send location.

Copy-paste privacy policy clause for OneSignal

Push notifications and messaging (OneSignal). This app uses OneSignal, a
service provided by OneSignal, Inc., to send and manage notifications. When
you use the app, OneSignal collects a push subscription token, your device
model, operating system, app version, language, time zone, carrier,
notification permission status, and session information such as how often
and how long you use the app. It also uses your IP address to determine your
country and then discards it for users in the EU and UK. If we identify you
to OneSignal, it additionally stores an account identifier and any contact
details or tags we provide. OneSignal processes this data as our service
provider to deliver and measure messaging; it is retained until you
unsubscribe or we delete your record. For more information see
https://onesignal.com/privacy_policy. Contact us to access or delete your
data.

Adapt this: gate initialization behind consent with OneSignal's consent-required methods; remove the account-identifier sentence if you never identify users; add a sentence if you send location or track in-app purchases. This is not legal advice; you are responsible for accuracy.

App Store "App Privacy" label answers

Per OneSignal's Apple App Privacy guidance, declare in App Store Connect:

• Identifiers > Device ID (push token) and Identifiers > User ID (OneSignal ID or your external ID) — App Functionality — Linked to the user if you identify users, otherwise Not Linked — Not used to track.
• Usage Data > Product Interaction (session counts, durations, notification interactions) — Analytics — Linked per your implementation — Not used to track.
• Contact Info > Email Address / Phone Number — only if you add them to OneSignal — App Functionality — Linked — Not used to track.
• Purchases > Purchase History — only if you enable in-app purchase tracking.
• Country derived from IP alone is generally not declared as Location; declare Location > Coarse Location only if you send location to OneSignal.
• NSPrivacyTracking is false in OneSignal's manifest; only check "Used to Track You" if you feed OneSignal data to an ad network.

Google Play Data Safety answers

OneSignal's own Data Safety guidance says to declare, at minimum:

• App activity > App interactions (sessions, notification clicks) — Collected: Yes — Shared: Yes (with OneSignal) — Purposes: Analytics, Developer communications — may be marked processed ephemerally where the form allows.
• Device or other IDs (push token, OneSignal ID, aliases) — Collected: Yes — Shared: Yes — Purpose: App functionality, Developer communications.
• Financial info > Purchase history — only if your app has in-app purchases visible to OneSignal — Shared: Yes — Purpose: Analytics.
• Personal info > Email addresses / Phone numbers, and App activity for tags and outcomes — only if you send them.
• Location > Approximate location — only if you send location to OneSignal.
• Users can request deletion; OneSignal deletes message data on a rolling basis and subscription records when the user or app is removed.

OneSignal-specific gotchas

• On the Google Play form the answer is "Shared: Yes" — OneSignal is a separate third party, not a Firebase-style subprocessor, and OneSignal's docs say so explicitly.
• The SDK starts collecting the moment OneSignal.initialize runs; for real consent, call setConsentRequired(true) before initialize and setConsentGiven(true) afterwards (older SDKs: setRequiresUserPrivacyConsent / provideUserConsent).
• IP addresses are only auto-dropped for EU and UK users; for everyone else the IP is used and may be stored unless you disable IP collection in app settings.
• External user IDs and email or SMS subscriptions turn an anonymous push record into "Linked to the user" data on both stores and create a clear deletion obligation.
• Tags are arbitrary key/value pairs — teams routinely push personal data (names, plan tiers, birthdays) into them without disclosing it.
• Message content sent from the OneSignal dashboard is stored indefinitely until manually deleted; API-sent messages are deleted roughly 30 days after delivery (uncertain — confirm against your plan).
• OneSignal's free tier includes usage analytics; review whether your configuration crosses into "tracking" before you certify the ATT answer.

Related

See the sibling clauses for Firebase Cloud Messaging, Firebase Crashlytics, Sentry, and Firebase Performance Monitoring. To assemble these into one document, use the privacy policy page generator or the Firebase privacy policy generator.