Data and privacy

Where the data lives

Server and database run in a data centre in Germany. There is one instance and one database; nothing is replicated to other regions.

What the SDK collects

On the first start the SDK creates a random install ID. It is not derived from the hardware and lives only in the storage of your app. With it, the SDK reports:

platform and OS version
language of the device
version of your app
the Play install referrer, once, on Android
the push token, if the user allows notifications
the events your app tracks, with the properties you pass
on its own: session_start on every app start with a random session ID, app_update when the version changes, the opening of a push, link_open with the slug when a link opens the app, in_app_view, in_app_tap and in_app_dismiss with the ID of an in-app message if your app uses LotseInAppMessages, and, if your app installs LotseScreenObserver, screen_view with the name of the screen
for feedback: text, category, app version, last screen, the metadata your app passes and, only on the user’s action, a screenshot
if your app calls Lotse.identify(): the user ID your app passes and the traits it attaches, stored as given

What a link click stores

Time, user agent, platform, a salted hash of the IP address, and a fingerprint made of platform, language and a shortened IP prefix. The full IP address is not stored.

What Lotse does not collect

No advertising IDs (IDFA, GAID), no location, no contacts, no device name, no list of installed apps. Lotse does not sell data and does not pass it on to ad networks.

Who else is involved

Three services, all of which you would need anyway:

Push on Android is delivered through Firebase Cloud Messaging by Google. Google receives the token and the content of the message. There is no other way to reach an Android device.
Push on iPhones is delivered through the Apple Push Notification service when the app operator uploaded an APNs key, otherwise through Firebase Cloud Messaging, which hands it to Apple. Apple receives the token and the content of the message. There is no other way to reach an iPhone.
E-mails for sign-up, password reset and project invitations of console users are sent through an EU mail provider.

How it is protected

Every project is a tenant. Each request is resolved to its project and each query is filtered by it. Push credentials are stored encrypted and never returned, not even to the console. Server keys are stored hashed and shown once. In the console, only the owner of a project and the members the owner invited have access to it.

Deletion

The owner deletes a project in the console, with everything in it. During the beta, single devices and users are deleted on request. A data processing agreement is available on request.

This website

Static files. No cookies, no analytics, no fonts or scripts from third parties.