What Doodle
actually sends.

The app depends on TelemetryDeck’s Swift SDK 2.14.2. Production initialization sets the app ID and leaves the SDK defaults in place. Tests and SwiftUI previews set analyticsDisabled, turn off the automatic session signal, and turn off session statistics, so those runs do not send.

Doodle’s own helper only accepts a signal name. Its comment says parameter values are not hashed before they leave the device, so callers pass none. The four names the app sends are below. The SDK also sends TelemetryDeck.Session.started because sendNewSessionBeganSignal defaults to true and production does not change it.

Every signal still carries the SDK’s default payload. In SDK 2.14.2 that payload includes app version and build, device model, architecture, operating system and version, screen size and scale, orientation, locale, region, language, time zone, whether the build is debug, TestFlight, simulator, or App Store, and the SDK version. With session statistics left on, it also includes first-session date, session counts, distinct days used, and average session length. On iOS, which is how iPhone, iPad, and this app’s Mac Catalyst build are compiled, it adds accessibility flags: reduce motion, bold text, invert colors, darker system colors, reduce transparency, differentiate without color, and the content-size category. The visionOS branch of that function does not add those accessibility keys. Calendar fields include day of week, hour, and whether the SDK treats the day as a weekend.

The signal body includes a session ID that is an unhashed UUID. The user identifier is separate and is hashed, described next. Drawing strokes, document names, and filenames are not fields in these calls.

Doodle does not set defaultUser or a salt. The SDK then builds its own identifier and hashes it with SHA-256 and an empty salt. On iOS and visionOS that identifier is identifierForVendor when the system provides one. If it does not, the SDK substitutes a string that includes the words “unknown user,” the system version, and the build number. Mac in this project is Mac Catalyst, so it uses the iOS path rather than the native-macOS UUID stored in the SDK’s UserDefaults.

The SDK README for 2.14.2 says the ingestion service salts that hash and hashes it again. That second hash is TelemetryDeck’s server, not code in this repository. Doodle does not set a custom salt, which the same README describes as an optional extra.

There is no in-app control that sets analyticsDisabled for a person using the App Store build. There is no App Tracking Transparency prompt in the app source. Turning off pack-reminder notifications, or denying the microphone, does not stop these signals.

The Mac sandbox entitlements include the photos library. A search of the app sources found no Photos framework calls. Why that entitlement is present is not established here. Do not read it as a claim that drawings are uploaded to Photos.

There is no CloudKit container and no iCloud entitlement. The App Store description says there is no app-managed cloud synchronization. Saving through a file provider does not mean the current canvas is synced by Doodle.

Purchases go through StoreKit and Apple. The app does not run its own account system. Organization seats are assigned by Apple School Manager or Apple Business Manager. The network client entitlement is what lets the app reach Apple and TelemetryDeck.

No ad network, SKAdNetwork, or tracking-authorization API appears in the app target. The US listing’s privacy label, checked 12 November 2026, is headed “Data Not Collected.” That label does not match the signals above. The app’s own PrivacyInfo.xcprivacy in this repository also says tracking is false and lists no collected data types. The SDK’s privacy manifest for 2.14.2 declares product interaction and device ID, not linked to identity and not used for tracking, for analytics. A district should treat the label as out of date relative to this code.

The public policy at /privacy says it was last updated April 8, 2022. It describes accounts and generic usage data, including IP address, in template language. That page is not a description of the current app. This sheet is.

doodle.app is a Next.js site on Cloudflare Workers. The pages do not embed a third-party analytics script, and the site code does not set a cookie. A theme choice can be stored in localStorage under the key “theme.” The worker also has an endpoint that signs a consumer promotional offer after it receives a subscription transaction ID. Organization seats are not eligible for those offers, and opening this page does not call that endpoint. Whether Cloudflare keeps request logs is outside this repository.

• TelemetryDeck’s retention period, whether an IP address is logged on their servers, and how a district would delete a hashed identifier. The SDK sends the payload. The vendor’s server policy is not in this repo.
• Whether the published App Store privacy label will be updated. Today it still says data is not collected.
• The purpose of the Mac photos-library entitlement.
• A COPPA or FERPA legal conclusion. Those statements are not written. The US listing’s age rating is 4+.
• That version 4.0.2’s public what’s-new text, which is about coloring packs, is the same build as the seat code in this checkout. The checkout’s marketing version is 4.0.1.