Is a push token personal data?

It is a device identifier that can be linked to a user, so many privacy laws, including the GDPR, may treat it as personal data. Disclose it. This is not legal advice.

Can I send promotional push notifications?

On iOS, only if users explicitly opt in through consent language in your app, and you must offer a way to opt out (Guideline 4.5.4).

Apple App Store · Platform guide

Privacy policy for apps with push notifications (FCM, OneSignal)

If your app sends push notifications, your privacy policy should say you store a device push token or installation ID, which provider delivers messages, and how users opt out. Apple’s Guideline 4.5.4 also says push must not be required for the app to work and must not be used for marketing unless users explicitly opt in.

§ 1

What Apple App Store requires

App Review Guideline 4.5.4 — Push Notifications

“Push Notifications must not be required for the app to function, and should not be used to send sensitive personal or confidential information.”

Source: developer.apple.com verified 2026-10-30

1.1Marketing push needs opt-in. Apple: push “should not be used for promotions or direct marketing purposes unless customers have explicitly opted in to receive them via consent language displayed in your app’s UI”. Source: developer.apple.com

1.2OneSignal and IP addresses. OneSignal: “OneSignal will automatically not collect IP Addresses from Users within the EU and UK.” Elsewhere IP collection is on by default unless you contact support. Source: documentation.onesignal.com

1.3Google Play: disclose SDK data. Google Play’s User Data policy says your “privacy policy must clearly explain all data collection and sharing”, including SDKs. Source: support.google.com

§ 2

What common SDKs collect

SDK / API	Data it collects	Source
Firebase Cloud Messaging	Firebase installation IDs (to route push messages to devices)	Source: firebase.google.com
OneSignal	Push subscription / device token IP address outside the EU and UK by default	Source: documentation.onesignal.com

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

3.1Your app’s store listings and Settings → Privacy.
3.2Next to the in-app notification opt-in prompt.

§ 4

Sample clause

§ 4.1 · Notifications

If you allow notifications, we store a push token for your device with our provider so we can send you alerts. We send marketing messages only if you opt in under Settings → Notifications. You can turn notifications off at any time in your device settings.

Illustrative wording. Your generated policy is written from your own answers.

§ 5

Questions

Is a push token personal data?: It is a device identifier that can be linked to a user, so many privacy laws, including the GDPR, may treat it as personal data. Disclose it. This is not legal advice.
Can I send promotional push notifications?: On iOS, only if users explicitly opt in through consent language in your app, and you must offer a way to opt out (Guideline 4.5.4).