Privacy & Data Controls
MGM is built to run useful product analytics on the minimum data possible. This page covers project-level controls; each SDK page has a Privacy section covering the client-side controls in detail.
What the SDKs collect
The SDKs never collect advertising identifiers (IDFA/GAID), location, contacts, or anything you don't explicitly pass to track() or identify(). identify() is optional — without it, users are tracked under a random, resettable anonymous ID ($anon_...) generated by the SDK, not derived from the device.
Every event automatically includes platform, OS version, app version, environment, and a session ID, plus — unless disabled — device model/type, manufacturer, locale, and timezone.
The opt-out story
All six SDKs ship the same controls:
optOut()/optIn()/isOptedOut— while opted out, tracking calls are no-ops, queued (unsent) events are purged, and the choice persists across launches.optedOutByDefault— start opted out for consent-first (e.g. GDPR) flows; calloptIn()after consent. A persisted opt-in/opt-out choice always wins on later launches.collectDeviceProperties: false— omit device model/type, manufacturer, locale, and timezone.resetAnonymousId()— rotate the anonymous ID so future events can't be linked to earlier activity.- A "forget me" reset that clears the user ID, rotates the anonymous ID, purges pending events and super properties, and starts a new session.
See the Privacy section of each SDK page: Swift, Android, React Native, JavaScript, Flutter, Capacitor. The JavaScript SDK additionally respects browser Do Not Track / Global Privacy Control signals and supports memory-only persistence.
IP geolocation (geo_mode)
Country, region, and city are derived from the request IP at ingestion — the SDKs never collect location. A per-project Geolocation setting governs how much is derived:
| Mode | Behavior |
|---|---|
full (default) | Country, region, and city derived from the request IP |
country_only | Country only — region and city are dropped, including any client-supplied values |
off | No IP lookup at all; the IP is not used |
Change it in your project's settings; it takes effect for new events.
Per-user data erasure
To honor a deletion request (GDPR/CCPA), open the user's page in the dashboard and use the erase user data action (admin only). It resolves all aliased IDs for the user, then deletes their events, daily activity rows, profile, and ID aliases from Postgres, and their events from ClickHouse.
Pre-computed historical aggregates (e.g. past chart totals) are not recomputed, and events sent before the user was ever identified under a never-linked anonymous ID can't be attributed to them.
Pair this with the SDK-side "forget me" reset so the device stops sending linkable events.
Data retention
Events are retained according to your organization's plan and deleted by daily cleanup jobs after the window:
| Plan | Retention |
|---|---|
| Free | 30 days |
| Starter | 90 days |
| Pro | 365 days |
| Enterprise | Unlimited |
Environment tagging
environment is a per-event property set by the SDK configuration (default "production"). Use it to keep different sources separable on the same project dashboard — for example, tag your marketing site's events with environment: "marketing" and your app's with "production", then use the dashboard's Environment filter to look at either in isolation. Values are free-form strings.
Private experiment enrollment
With local experiment enrollment, variant assignment happens on device and no user identifier is sent to the server for bucketing.