Data and privacy
Performance monitoring works without knowing who the user is. This page lists exactly what the SDK sends, what it deliberately does not, and the controls you have over sampling, retention and residency.
What the SDK sends
| Category | Fields | Purpose |
|---|---|---|
| App | Bundle or package ID, version, build, environment | Release comparison |
| Device | OS and version, device model, locale, network type (wifi, cellular, none), memory class, screen density | Segmenting by device class and network |
| Session | Random session ID, start time, sample rate, foreground duration | Grouping events into one run of the app |
| App start | Start kind, phase durations | Cold and warm start metrics |
| Screens | Screen name, time to first frame, time to ready, slow and frozen frame counts | Per-screen rendering metrics |
| Requests | Method, host, route template, status code, timing breakdown, body sizes | Network metrics |
| Crashes | Stack traces, thread states, exception type and message, breadcrumbs of the last 30 seconds | Crash reports |
| Custom | Trace names, attributes you set, custom event names | Whatever you decide to measure |
What the SDK never sends
- Request or response bodies, headers, cookies, query strings or URL fragments. Only the host and a route template are kept; the template replaces numeric and UUID segments with placeholders before the request leaves the device.
- Screen contents, text fields, keystrokes, screenshots or view hierarchies.
- Advertising identifiers, contacts, location, or any identifier that survives an app reinstall. The installation ID is random and stored with the app's data.
- Precise IP addresses. The collector uses the connecting address to pick a coarse region label and discards it before the batch is stored.
Crash messages and custom attributes are the two places where an app can accidentally include personal data, for example an exception message that quotes an email address. The SDK runs a scrubber over both before upload that masks email addresses, phone numbers, card numbers and JWT-shaped strings. You can add patterns from the console.
User identifiers
If you set a user identifier, it is hashed on the device with a per-project salt before upload. The console can then filter sessions by the same identifier, which is useful for support cases, but the raw value never leaves the device. Leave it unset if you do not need this.
Sampling
Sampling is decided once per session, on the device, before any event is recorded, so a sampled session is always complete. The rate is set in the SDK configuration and can be overridden from the console per release, per platform or per environment, taking effect on the next launch. Crashes and ANRs are always recorded regardless of the rate; a crash from an unsampled session arrives with a minimal context of the last screen and the app start metrics.
Metrics in the console are scaled by the sample rate, so percentiles and counts stay comparable when you change it.
Retention
| Data | Free | Team | Business |
|---|---|---|---|
| Aggregated metrics | 7 days | 13 months | 13 months |
| Session traces | 7 days | 30 days | 90 days |
| Crash reports | 7 days | 90 days | 1 year |
| Development environment | 24 hours on every plan | ||
Retention can be shortened per project. Deleting a project removes its data within 72 hours, including backups, and the project key stops being accepted immediately.
Data residency
A project's home region is chosen when it is created and decides where its data is stored and processed. Devices anywhere in the world send telemetry to a collector in that region; a device in Asia using a European project talks to a European collector. Available regions: Europe, Russia and CIS, Middle East, Asia-Pacific, North America, South America.
Collectors keep no customer data. A batch is validated, acknowledged and forwarded to the storage region within seconds; if the storage region is unreachable, the collector answers 503 and the SDK keeps the batch on the device instead. This is what allows collectors to be placed close to users without moving data across regional boundaries.
For customers under the GDPR or Russian Federal Law 152-FZ we sign a data processing agreement and confirm the storage location in writing. Ask hello@mustgate.org.
Deletion requests
Because raw user identifiers never leave the device, most deletion requests can be satisfied by deleting the app's local data. If you set a hashed user identifier and need the matching sessions removed, submit the identifier from the console and the sessions are deleted within 72 hours.
Where the data lives
Storage regions run on infrastructure providers located in the respective region under contracts that prohibit access to customer data. The current list of providers is available on request and customers are notified 30 days before a change. See also the security page and the privacy policy.