OneSignal was built to be compliant with GDPR, CCPA and all your data privacy needs, even on our Free Plan! This guide will walk through all the options for handling user data.
If you need a DPA and Model Clauses for compliance purposes, please see our Paid Plans for details.
The OneSignal SDK collects data once it is initialized on your app or website. See Data Collected by the OneSignal SDK for more information.
This guide will go over how to use OneSignal without sending Personal User Data.
IP Addresses is typically not considered to be private, but in the EU and UK, it is considered personal data in some cases. For this reason, OneSignal will automatically not collect IP Addresses from all EU and UK Users.
If you wish to additionally prevent the storage of IP addresses from non-EU or UK users, you will need to contact [email protected] with each of your app's OneSignal App ID and first 5 digits of your REST API key for verification.
OneSignal requires that you have appropriate consent for any data you send to us, including any personal data you may send to us as data tags or other fields.
For example, if you send us the user's email address or phone number, you must make sure you have all necessary consent to do so.
Some data is automatically collected by the OneSignal SDK. A complete list of automatically-collected information is available here: Data Collected by the OneSignal SDK.
Each of these fields can be customized by modifying our SDK code to exclude the field, or using provided helper methods. Instructions and examples on each of these methods is available below.
To assist with any compliance requirements, OneSignal has optional methods to delay initialization and prevent any data from being sent to OneSignal until the user has provided consent.
Your application can call these methods before the initialization of the OneSignal SDK to prevent data from being collected and anytime after the user provides consent to allow data collection. Until consent is provided, you can continue to call the SDK methods, but nothing will happen.
The consent setting is persisted between sessions. This means that your application only ever needs to collect consent by calling the provided method a single time, and the setting will be persisted (remembered) by the SDK.
A note for Wordpress clients
By default, the OneSignal WordPress plugin does not handle Personally Identifiable Information (PII) or EU and UK personal data.
OneSignal provides a method to disable Location sharing within each mobile SDK.
|Web SDK||Never sends Location|
See the Delete Users guide for more details on deleting user data.
Records of notifications that have been sent through OneSignal's dashboard can be deleted via the dashboard, but will otherwise be stored indefinitely unless you delete your OneSignal app.
Records of notifications sent through OneSignal's API will be deleted around 30 days of delivery.
All other data is typically stored until your app is deleted. See Managing your OneSignal Account for more information.
Updated 8 months ago