Privacy & Consent

Gating collection on consent

The SDK collects nothing while it is disabled. The plugin configures the native SDKs when the app launches, before any Dart code runs, so the state for that launch has to come from the native config files. Set GrovsEnabled to false in Info.plist and grovs_enabled to false in AndroidManifest.xml:

<!-- ios/Runner/Info.plist -->
<key>GrovsEnabled</key>
<false/>

<!-- android/app/src/main/AndroidManifest.xml, inside <application> -->
<meta-data
    android:name="grovs_enabled"
    android:value="false" />

Then turn the SDK on or off from Dart as consent changes:

import 'package:grovs_flutter_plugin/grovs.dart';
 
final grovs = Grovs();
 
Future<void> userDidChangeConsent(bool granted) async {
  await ConsentStore.save(granted); // your own storage
  await grovs.setSDK(granted);
}

The flag is not persisted by the SDK. Store the user's decision yourself and, on every launch, call setSDK(true) once you have restored a positive one:

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  if (await ConsentStore.hasConsent()) {
    await Grovs().setSDK(true);
  }
  runApp(const App());
}

Calling setSDK with the state the SDK is already in does nothing. On Android the consent state is shared by every Flutter engine in the process, because the native SDK is configured once per process.

While the SDK is disabled

What the native SDKs stop doing is the same as in a native app, and is listed in iOS Privacy & Consent and Android Privacy & Consent. In short:

• Nothing leaves the device: no authentication, device lookup, events, screen views, or purchases.
• Link generation fails, so generateLink throws a GrovsException.
• Changes to the user identifier, user attributes, push token, and screen aliases are held as the latest desired values.
• Events and purchases already queued stay on the device.

The plugin adds one rule of its own: deep links that arrive while disabled are not delivered on onDeeplinkReceived, and any links buffered for delivery are discarded.

Enabling again

When you call setSDK(true), the native SDK authenticates if needed and sends everything that was held or queued.

The plugin also replays the link that launched the app while it was disabled. On Android it re-runs the launch intent through Grovs.onStart; on iOS it hands the universal link or URL back to the SDK. Only the most recent launch link is kept, and it is delivered on onDeeplinkReceived once resolved.

What the SDK collects

The plugin collects nothing itself; everything below is collected by the native SDK for the platform the app runs on. The full per-platform tables are in iOS Privacy & Consent and Android Privacy & Consent. In summary:

Neither native SDK reads the advertising identifier, and iOS does not require App Tracking Transparency.

Store privacy declarations

• App Store: the native iOS SDK ships a privacy manifest, and your App Privacy answers need to cover what it collects. See iOS privacy manifest and App Store privacy details.
• Google Play: your Data safety form must cover the same. See Google Play data safety.

Anything you put in user attributes or event properties, such as an email address or a name, is data you collect too and needs its own declaration.

Logs

setDebugLevel accepts 'info' or 'error'. Any other value is treated as 'error'. Pass 'info' while integrating:

await Grovs().setDebugLevel('info');

Where the logs appear and how to filter them is platform-specific: see iOS logs and Android logs.