Security

Last updated Sep 24, 2026View as Markdown

This SDK mainly receives critical fixes. New capabilities are shipping in the CSQ SDK first.

Migrate to the CSQ SDK using our AI wizard.

The Android SDK requires a set of permissions to operate properly and transmits all data securely over HTTPS.

App permissions

The SDK includes the following permissions, which are mandatory for the SDK to operate properly:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.READ_BASIC_PHONE_STATE" />
<uses-permission-sdk-23 android:name="android.permission.SYSTEM_ALERT_WINDOW" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

Permission	Required to	Associated with read/write operations under e-privacy directive
`android.permission.INTERNET`	Send collected data to Contentsquare servers	Yes. The end-user's data is collected for analytics purposes.
`android.permission.READ_BASIC_PHONE_STATE`	Retrieve non-sensitive device information such as carrier name for analytics purposes	Yes. The end-user's data is collected for analytics purposes.
`android.permission.SYSTEM_ALERT_WINDOW`	Use Contentsquare in-app features	No. This permission is solely used to display Contentsquare UI elements in our customers' apps.
`android.permission.ACCESS_NETWORK_STATE`	Check network availability before sending data	No. This permission is solely used to check the network status check.

Deep link usage

As outlined in the Android Security Guidelines ↗, there are security risks associated with using deep links.

To address these concerns, the SDK implements robust data validation for deep links and safeguards to prevent deep link hijacking, following these guidelines.

If you have specific security concerns and prefer to remove the SDK deep link declaration from your application, add the following code snippet to your AndroidManifest.xml file inside the <application> tag:

<application>
  <!-- ... -->
  <activity
      android:name="com.contentsquare.android.analytics.internal.features.deeplink.DeepLinkActivity"
      tools:node="remove" />
  <!-- ... -->
</application>

Removing the deep link will disable the In-app feature within your application.

Transmission and hosting

All data is encrypted in transport over HTTPS. Our hosting solution is a PCI DSS Level 1 Service Provider.