Privacy controls

Two calls, on every SDK: one stops recording, one forgets the device. Wire them to your consent prompt and your “delete my data” button.

Stop recording: optOut

After optOut() the SDK records and sends nothing from that device — no events, no sign-ins, no message reads, no link look-ups — and anything waiting to be sent is dropped. The answer is kept, so it holds on every later launch or visit until optIn(). isOptedOut() tells you which way it stands. Call either one before init if your consent prompt answers first — it wins over the answer from an earlier visit — and an opted-out web page writes nothing into the browser except that answer.

import treebars from '@treebars/web-sdk';

treebars.optOut();          // the person said no
treebars.isOptedOut();      // true, on this visit and the next
treebars.optIn();           // they changed their mind

Treebars.optOut()
Treebars.isOptedOut   // true
Treebars.optIn()

Treebars.optOut()
Treebars.isOptedOut()   // true
Treebars.optIn()

await treebars.optOut();
await treebars.isOptedOut();   // true
await treebars.optIn();

Forget the device: wipeLocalData

wipeLocalData() deletes everything the SDK keeps on the device: its id and the secret that proves it, who is signed in and who had been, everything waiting to be sent, the session, the in-app and notification history, and on the web the carried ad click and its cookie. It sends nothing on the way out. From the next event on, the device is one Treebars has never seen, with a new id.

The opt-out survives a wipe — it is the person's answer, not data about them. For “forget me and stop”, call both:

treebars.optOut();
treebars.wipeLocalData();

Erasing what was already sent

Neither call touches what already reached us. That is a request from your backend, with an admin API key: POST /privacy/delete with the project and the person. It removes them from every report, their profile and history, and the raw events kept in the archive, and it takes every id they were known by with it — the devices they used as well as their account id.

What the SDKs keep, and where

A device id and a secret, in storage the operating system never backs up — so a phone restored from a backup starts as a new device rather than a copy of the old one. Everything goes over HTTPS: the mobile SDKs refuse a plain http:// address unless it is your own machine. And a signed-in person's account id travels in a header, never in a URL a log would keep.