Privacy and consent

Hey - by the end of this page you'll know which privacy work the tree does for you, where each piece lives, and what you still have to do before you ship to the EU, the UK or California. None of this is legal advice; it is the mechanism, so the lawyer's hour is spent on your words, not on plumbing.

What shipsCopy Anchor Link

bun run doctor --store ties it together: it warns when the manifest is missing, when the ATT flag and the manifest disagree, when a privacy URL is empty, and when account deletion is gone.

What is still yoursCopy Anchor Link

1. Host the privacy policy. Run bun run gen:privacy --owner "Your Company", read it, fill in every […] placeholder (retention periods, transfer mechanism, what your server keeps), have a lawyer look at it, publish it, and put the URL in readynative.config.ts → urls.privacy. Re-run after you add or remove a module.
2. Answer the store questionnaires from the same facts: App Store Connect → App Privacy (the manifest's data types are the answer), Play Console → Data safety (the doctor --store draft). Say "No" to tracking unless features.tracking is on.
3. Vendor deletion keys (backend=api-routes). Set the server keys the delete route uses: POSTHOG_PERSONAL_API_KEY + POSTHOG_PROJECT_ID (+ POSTHOG_API_HOST for EU), AMPLITUDE_API_KEY + AMPLITUDE_SECRET_KEY (+ AMPLITUDE_REGION=eu), REVENUECAT_SECRET_KEY. Analytics vendors can only find the user when you call analytics.identify(session.user.id). With Clerk, add a user.deleted webhook pointing at /api/webhooks/clerk and set CLERK_WEBHOOK_SIGNING_SECRET. Without API routes, vendor data is deleted on request - say so in the policy.
4. Your own tables. deleteAccount() removes the user at Supabase / Clerk / Better Auth; rows in your tables need on delete cascade (the Supabase migration shows how) or a hook. Apply both Supabase migrations (supabase db push) - deletion refuses to run without them and says which one is missing. "Export my data" covers the device; add an endpoint that returns the user's rows if you store anything server-side.
5. Sentry dashboard. Turn on Project Settings → Security & Privacy → "Prevent Storing of IP Addresses": the SDK sends no IP, but the connection itself reveals it.
6. Sign the DPAs of the processors you selected (they are linked from each module's docs page and from doctor --store).
7. Write the consent copy in your voice. src/components/consent-sheet.tsx is yours; keep "Only necessary" as prominent as "Accept all" - that is what regulators check - and raise CONSENT_VERSION when you change what you ask for.
8. Age. The template is not directed at children. If yours is, COPPA / Art. 8 need a parental flow the tree does not ship.

How consent flowsCopy Anchor Link

consentStore (src/stores/consent.ts, key readynative:consent, loaded when @/lib/consent is imported)
   │  { analytics, crash, doNotSell, version, decidedAt, updatedAt, source }
   ▼
consent.get()  ─ resolves undecided by region, doNotSell turns analytics off ─►  { analytics, crash }
   │                                                                              ▲
   ├─► PostHog   no client until yes → new PostHog + optIn / optOut                │  Settings → Privacy switches
   ├─► Amplitude no init until yes → init / setOptOut                              │  "Do not sell or share"
   └─► Sentry    no init until yes → Sentry.init / Sentry.close, beforeSend gate   │  ConsentSheet (by region, per CONSENT_VERSION)

The SDK modules subscribe to the store at import time, before the first screen renders, so the first analytics.screen() already sees the stored answer. With consent/none, undecided reads as consented, "Do not sell or share" still turns analytics off, and the store and the Settings card stay, so switching later changes nothing outside the module.

GotchasCopy Anchor Link

• Region comes from the device (locales and time zone), not IP. A user in Paris with a US region and a US time zone sees no sheet; the Settings switches are always there, and privacy.askEverywhere: true asks everyone.
• With AsyncStorage the consent store loads asynchronously; anything tracked before it has loaded is dropped rather than sent without a known answer.
• app.config.ts deep-merges arrays by replacement: a hand-written ios.privacyManifests in your base config is overwritten by the composed one. Add declarations to a module's privacy instead.
• The ATT purpose string stays in Info.plist even with features.tracking: false: the library is still linked, and App Store Connect flags a linked ATT framework without one. Nothing shows it.
• Keep crash.capture(err, ctx) contexts free of personal data; the scrubber masks emails and tokens it recognises, not everything personal.