Data Collected for Android
See what data is collected by the Sentry Android SDK.
Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.
The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. This page lists data categories that the Sentry Android SDK collects. Use dataCollectionto control automatic collection for supported categories.
After you configure any Data Collection field or call options.getDataCollection().forceDataCollection(), unconfigured fields use their documented defaults.
Data Collection controls only data added automatically by SDK integrations. Data you add through scopes, event processors, beforeSend, or other APIs is still sent.
Request and response headers use DENY_LIST by default. Supported integrations collect header names and non-sensitive values while replacing sensitive values with "[Filtered]".
Configure dataCollection.httpHeaders.request and dataCollection.httpHeaders.response to control header collection. Cookie and Set-Cookie values in the general HTTP header map are always replaced with "[Filtered]"; use dataCollection.cookies to control separately collected cookie data. OkHttp, Ktor Client, and Apollo 3 and 4 can attach available request and response headers to captured HTTP client errors.
Session Replay network details use separate options.
Cookies use DENY_LIST by default. Supported integrations collect cookies while replacing sensitive values with "[Filtered]". Use dataCollection.cookies to control cookie collection.
The SDK assigns a random installation ID when an event has no user ID. This ID is generated once per app installation and isn't controlled by Data Collection.
dataCollection.userInfo allows integrations to populate other user identity information automatically. It defaults to true. Set it to false to disable automatic user enrichment. User information you set explicitly with Sentry.setUser() or on a scope isn't removed.
When dataCollection.userInfo is true, the SDK adds "{{auto}}" as the user's IP address so Sentry can infer it from the connection. Set dataCollection.userInfo=false to disable automatic IP enrichment.
The request URL (without the query string) of outgoing and incoming HTTP requests is always sent to Sentry. Depending on your application, this could contain PII data.
Query parameters use DENY_LIST by default. Use dataCollection.urlQueryParams to filter or disable query string collection for instrumented request URLs.
All request and response body directions are enabled by default, but integrations collect bodies only where supported. Some integrations collect body content, while others collect only body sizes.
Use dataCollection.httpBodies to choose which directions to collect or an empty set to disable body collection. Session Replay network body collection uses separate options.
Our build tool plugins for Gradle and Maven can upload your source code to Sentry, which can then used to show the lines of code where an error happened in the Issue Details page.
To opt into sending this source context to Sentry, you have to enable the feature as described in the Source Context documentation.
File I/O instrumentation collects file names and absolute paths by default. Set dataCollection.filePaths=false to omit them. File extensions and byte counts remain available when paths are disabled.
The SDK automatically collects device and operating-system context, including the manufacturer, model, architecture, orientation, display details, boot time, timezone, memory size, and emulator status.
Set collectAdditionalContext=false to reduce additional dynamic context such as battery level, available memory, storage state, and connectivity.
GraphQL document and variable collection default to true. Use dataCollection.graphql.document and dataCollection.graphql.variables to disable either category. Operation metadata used for tracing and grouping can still be collected when document or variable content is disabled.
While SQL queries are sent to Sentry, neither the full SQL query (UPDATE app_user SET password='supersecret' WHERE id=1;), nor the values of its parameters will ever be sent. A parameterized version of the query (UPDATE app_user SET password=? WHERE id=?;) is sent instead.
Log messages, parameters, and breadcrumb content may contain application data. Data Collection doesn't filter this content. Use beforeBreadcrumb for breadcrumbs, beforeSend for events, or options.getLogs().setBeforeSend(...) for Sentry Logs when you need application-specific filtering.
By default, our Session Replay SDK masks all text content, images, webviews, and user input. This helps ensure that no sensitive data is exposed. You can find more details in the Session Replay documentation.
Our documentation is open source and available on GitHub. Your contributions are welcome, whether fixing a typo (drat!) or suggesting an update ("yeah, this would be better").