Privacy policy clauses for Expo Notifications
Expo Notifications is a push notification service that enables Expo-built mobile applications to send real-time messages to users' devices. It collects device identifiers and delivery metadata to route notifications reliably across iOS and Android platforms.
Free scan · No signup · Results in 60 seconds
What data Expo Notifications collects
Your privacy policy must disclose each of the following data types when you use Expo Notifications.
When does Expo Notifications trigger privacy obligations?
Installation & Device Token Collection
Adding Expo Notifications to your Expo app triggers data protection obligations immediately upon installation. The moment your app requests push notification permissions from users, Expo generates and stores a device push token (a unique identifier for that device) on Expo's servers in the United States. This token is personal data under GDPR Article 4(1) because it identifies or relates to an identifiable natural person.
Which Regulations Apply
GDPR applies if you have users in the EU/EEA, regardless of your company location. You are the controller; Expo is a processor. CCPA applies if you have California users and meet the threshold (e.g., $25M+ revenue, data on 100K+ consumers). Device tokens may qualify as "identifiers" under CCPA Section 1798.100(d). ePrivacy Directive (Article 5(3)) requires prior consent before storing or accessing push notification identifiers on a user's terminal equipment in most EU member states—a higher bar than GDPR.
