Policies

Data Collection & Store Submission

Use this page to complete Apple's App Privacy questionnaire and Google Play's Data Safety form before you submit an app that embeds the Koah SDK. It states what the SDK collects and maps each item to both stores.

Completing these forms accurately is a mandatory gate to publish on the App Store and Google Play. The values below describe the Koah mobile SDKs (iOS, Android, Flutter, React Native) only — add your app's own collection on top. The JavaScript SDK is not covered here.

What Koah collects

The SDK is contextual: it does not read the advertising identifier (IDFA / Android Advertising ID), build a cross-app or cross-site profile, or track users across apps and websites. What it sends:

Data	What it is	Purpose	Linked to user?	Used for tracking?
Device & app context	Device type, manufacturer, model and marketing name (e.g. "iPhone", "Pixel 8" — never the user-assigned device name), OS name + version, app name / bundle ID / version / build, locale, emulator flag, a "location services enabled" boolean (a flag — not coordinates), user agent, and mobile radio technology (e.g. LTE, 5G). Flutter sends a smaller set: no location flag or radio technology	Ad format selection, diagnostics, invalid-traffic filtering	No	No
IP address & approximate location	The SDK reports the IP address of the device's active network interface (the Wi-Fi LAN address; on cellular, the carrier-assigned address, which can be a public IP; React Native reports the Wi-Fi address only). Koah's servers also see the public IP of the connection, as any HTTP service does. Koah resolves the request IP to an approximate location — country, region and city — with an IP-geolocation database hosted on Koah's own servers; the IP is not sent to a third-party lookup service. The SDK never reads GPS or precise coordinates	Ad selection and geographic targeting, invalid-traffic filtering, aggregate reporting	No	No
Pseudonymous client ID	A random per-install identifier (`{uuid}--{publisherId}`) generated on-device and sent as the `X-Koah-State` request header. Not the IDFA/AAID; not tied to a real-world identity	Stable session & attribution	No	No
Ad context text	The conversation / article / feed text you pass into `KoahAdContext`	Matching a relevant ad	No	No
Ad interaction & quality events	Impressions, views, clicks (with the tap position within the ad and the ad's on-screen frame), poll votes, and user-submitted ad reports (a reason code, no free text) — each identified only by a server-issued `queryExternalId`	Measurement, billing, ad quality	No	No
Age (optional)	Sent only if your app calls `setAge` / `setAgeRange`. An exact age is sent as a single-value range (`age…age`); a bucket is sent as its bounds. SDK versions 1.0 and later ignore any age under 13 — the setter is a no-op and an under-13 value persisted by an earlier version is discarded on upgrade	Demographic targeting	No	No
Gender (optional)	Sent only if your app calls `setGender` (`male` / `female`)	Demographic targeting	No	No
Household income bracket (optional)	Sent only if your app calls `setIncomeBracket` — an annual household income bucket in thousands of USD (`0-50` … `200+`)	Demographic targeting	No	No

Age, gender and income bracket are the visitor attributes; the SDKs that support each are listed there.

Where the data goes

Everything above is stored in app-private on-device storage and sent to Koah's servers (app.koah.ai in production). Two things reach other hosts:

Ad creative. Ad images and advertiser icons load directly from the advertiser's or its CDN's host, and tapping an ad opens the advertiser's page in a browser (Chrome Custom Tabs, SFSafariViewController, or the in-app browser on React Native). Those hosts see the device's IP address and user agent, as with any web content.
Demand partners. To fill a request from programmatic demand, Koah's servers may pass request signals such as the user agent and device / OS type to its demand partners.

The SDK fires no third-party tracking pixels or viewability beacons and embeds no third-party analytics or crash-reporting SDKs.

Ad context text is whatever you pass in. If you populate KoahAdContext with user-authored content (a chat message, a post body), disclose it as user content in the forms below. If you only pass your own app content, you don't.

Apple — App Privacy (nutrition labels)

In App Store Connect → App Privacy, declare the following for the Koah SDK. All are not linked to the user and not used for tracking.

Apple data type	Maps to	Purposes	Notes
Identifiers → Device ID	Pseudonymous client ID	Third-Party Advertising, Analytics, Product Personalization	Declared in the bundled privacy manifest
Usage Data → Product Interaction	Impressions, views, clicks, poll votes, reports	Third-Party Advertising, Analytics, Product Personalization	Declared in the bundled privacy manifest
Location → Coarse Location	Approximate location derived from the IP address	Third-Party Advertising, Analytics, App Functionality	Declared in the bundled privacy manifest
Diagnostics → Other Diagnostic Data	Device / OS / app context	App Functionality, Analytics	Declared in the bundled privacy manifest; used for compatibility & invalid-traffic filtering
User Content (conditional)	Ad context text	Third-Party Advertising	Only if you pass user-authored text into `KoahAdContext`
Other Data Types (conditional)	Age, gender	Third-Party Advertising	Only if you call `setAge` / `setAgeRange` / `setGender`; not in the bundled manifest
Financial Info → Other Financial Info (conditional)	Household income bracket	Third-Party Advertising	Only if you call `setIncomeBracket`; not in the bundled manifest

Apple has no "IP address" data type: per its guidance you declare the data types derived from how the IP is used — here Coarse Location and Other Diagnostic Data.

The SDK ships a PrivacyInfo.xcprivacy that declares Device ID, Product Interaction, Coarse Location, and Other Diagnostic Data with NSPrivacyTracking set to false. The privacy manifest feeds Apple's automated privacy report, but you still enter the nutrition labels above by hand in App Store Connect — including the conditional rows if you use those APIs.

Google — Play Data Safety

In the Play Console → Data safety form, declare the following. For every row: collected = Yes, not processed ephemerally, and not required to use your app.

Play data type	Maps to	Purposes
Device or other IDs	Pseudonymous client ID	Advertising or marketing; Analytics; Fraud prevention, security, and compliance
App activity → App interactions	Impressions, views, clicks, poll votes, reports	Advertising or marketing; Analytics
Location → Approximate location	Approximate location derived from the IP address	Advertising or marketing; Analytics; Fraud prevention, security, and compliance
App info and performance → Diagnostics	Device / OS / app context	App functionality; Analytics; Fraud prevention, security, and compliance
App activity → Other user-generated content (conditional)	Ad context text, if user-authored	Advertising or marketing
Personal info → Other info (conditional)	Age, gender — only if you call those setters	Advertising or marketing
Financial info → Other financial info (conditional)	Household income bracket — only if you call `setIncomeBracket`	Advertising or marketing

The form also asks whether each type is shared. Koah processes this data as your service provider; see Where the data goes for the third-party hosts involved and answer per Google's definition of sharing.

You must also declare the com.google.android.gms.permission.AD_ID permission status. Koah does not use the Advertising ID, so if Koah is your only ads SDK you can declare that your app does not use it.

App Tracking Transparency & IDFA

Koah does not use App Tracking Transparency. It never reads the IDFA, does not call ASIdentifierManager or ATTrackingManager, and does not track users across apps or sites — NSPrivacyTracking is false. You do not need to show an ATT prompt for Koah, and you should not add an NSUserTrackingUsageDescription on Koah's behalf. Adding an ATT call without that Info.plist key will crash your app.

You are the data controller for your users. In the EEA / UK, obtain a lawful basis (typically consent) before you initialize Koah, and gate the configure / init call behind your consent management platform (CMP). Users can request data deletion via support@koahlabs.com.

US state privacy (CCPA / CPRA and similar)

Where US state privacy laws apply, you are the business and Koah acts as a service provider / processor for the ad request. Serving ads may qualify as "sharing" for cross-context behavioral advertising under CPRA. Provide the required notice and honor consumer opt-out choices (including a "Do Not Sell or Share" mechanism) through your own consent/privacy controls, and gate Koah initialization accordingly.

Children's privacy (COPPA)

Koah serves third-party ads and is not designed for child-directed apps, the Apple Kids Category, or Google Play's "Designed for Families" program. Do not embed Koah in primarily child-directed apps, and do not provide ages for users under 13. For mixed-audience apps, gate Koah behind a neutral age screen.

Mobile SDK versions 1.0 and later enforce the last point in code: setAge / setAgeRange ignore any age or age range that starts under 13 (including the under-13 bucket), and an under-13 value persisted by an earlier version is discarded on upgrade. Nothing is stored or sent, and no error is thrown. The JavaScript SDK does not enforce this.

Privacy manifest by SDK

Apple's PrivacyInfo.xcprivacy declares the data types Koah collects:

iOS — bundled automatically in the KoahAds Swift package / XCFramework.
React Native — bundled automatically as a CocoaPods resource bundle; picked up on pod install (RN CLI and Expo prebuild). It declares the same data types as the iOS manifest and no required-reason APIs, because the package ships no native code.
Flutter — koah_flutter's iOS plugin does not yet bundle a manifest. Its plugin dependencies (flutter_secure_storage, device_info_plus, package_info_plus) already ship manifests for the required-reason APIs they use; add the manifest below to your app's iOS target to also declare the data types Koah collects.

If you vendor the SDK manually (or are on Flutter), add this manifest to your app target:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeDeviceID</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <false/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeThirdPartyAdvertising</string>
                <string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
                <string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
            </array>
        </dict>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeProductInteraction</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <false/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeThirdPartyAdvertising</string>
                <string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
                <string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
            </array>
        </dict>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeCoarseLocation</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <false/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeThirdPartyAdvertising</string>
                <string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
            </array>
        </dict>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeOtherDiagnosticData</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <false/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
                <string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
            </array>
        </dict>
    </array>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>
            </array>
        </dict>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategorySystemBootTime</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>35F9.1</string>
            </array>
        </dict>
    </array>
</dict>
</plist>

Optional AdMob adapter. The statements above describe the core Koah SDK. If you also add the optional Koah AdMob adapter, it links Google Mobile Ads, which uses the Advertising ID and ATT; declare the Advertising ID and AD_ID permission accordingly in that case.

Questions about data handling? Contact support@koahlabs.com.