---
title: "Data Collected"
description: "See what data is collected by the Sentry Android SDK."
url: https://docs.sentry.io/platforms/android/data-management/data-collected/
---

# Data Collected for Android

Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.

The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. This page lists data categories that the Sentry Android SDK collects. Use [`dataCollection`](https://docs.sentry.io/platforms/android/configuration/options.md#dataCollection)to control automatic collection for supported categories.

After you configure any Data Collection field or call `options.getDataCollection().forceDataCollection()`, unconfigured fields use their documented defaults.

Data Collection controls only data added automatically by SDK integrations. Data you add through scopes, event processors, `beforeSend`, or other APIs is still sent.

## [HTTP Headers](https://docs.sentry.io/platforms/android/data-management/data-collected.md#http-headers)

Request and response headers use `DENY_LIST` by default. Supported integrations collect header names and non-sensitive values while replacing sensitive values with `"[Filtered]"`.

Configure [`dataCollection.httpHeaders.request`](https://docs.sentry.io/platforms/android/configuration/options.md#dataCollection) and [`dataCollection.httpHeaders.response`](https://docs.sentry.io/platforms/android/configuration/options.md#dataCollection) to control header collection. `Cookie` and `Set-Cookie` values in the general HTTP header map are always replaced with `"[Filtered]"`; use `dataCollection.cookies` to control separately collected cookie data. OkHttp, Ktor Client, and Apollo 3 and 4 can attach available request and response headers to captured HTTP client errors.

Session Replay network details use [separate options](https://docs.sentry.io/platforms/android/session-replay/configuration.md).

## [Cookies](https://docs.sentry.io/platforms/android/data-management/data-collected.md#cookies)

Cookies use `DENY_LIST` by default. Supported integrations collect cookies while replacing sensitive values with `"[Filtered]"`. Use `dataCollection.cookies` to control cookie collection.

## [Information About Logged-in User](https://docs.sentry.io/platforms/android/data-management/data-collected.md#information-about-logged-in-user)

The SDK assigns a random installation ID when an event has no user ID. This ID is generated once per app installation and isn't controlled by Data Collection.

`dataCollection.userInfo` allows integrations to populate other user identity information automatically. It defaults to `true`. Set it to `false` to disable automatic user enrichment. User information you set explicitly with `Sentry.setUser()` or on a scope isn't removed.

## [Users' IP Addresses](https://docs.sentry.io/platforms/android/data-management/data-collected.md#users-ip-addresses)

When `dataCollection.userInfo` is `true`, the SDK adds `"{{auto}}"` as the user's IP address so Sentry can infer it from the connection. Set `dataCollection.userInfo=false` to disable automatic IP enrichment.

## [Request URL](https://docs.sentry.io/platforms/android/data-management/data-collected.md#request-url)

The request URL (without the query string) of outgoing and incoming HTTP requests is **always sent to Sentry**. Depending on your application, this could contain PII data.

## [Request Query String](https://docs.sentry.io/platforms/android/data-management/data-collected.md#request-query-string)

Query parameters use `DENY_LIST` by default. Use `dataCollection.urlQueryParams` to filter or disable query string collection for instrumented request URLs.

## [Request and Response Bodies](https://docs.sentry.io/platforms/android/data-management/data-collected.md#request-and-response-bodies)

All request and response body directions are enabled by default, but integrations collect bodies only where supported. Some integrations collect body content, while others collect only body sizes.

Use `dataCollection.httpBodies` to choose which directions to collect or an empty set to disable body collection. Session Replay network body collection uses [separate options](https://docs.sentry.io/platforms/android/session-replay/configuration.md).

## [Source Context](https://docs.sentry.io/platforms/android/data-management/data-collected.md#source-context)

Our build tool plugins for Gradle and Maven can upload your source code to Sentry, which can then used to show the lines of code where an error happened in the Issue Details page.

To opt into sending this source context to Sentry, you have to enable the feature as described in [the Source Context documentation](https://docs.sentry.io/platforms/android/source-context.md).

## [File I/O](https://docs.sentry.io/platforms/android/data-management/data-collected.md#file-io)

File I/O instrumentation collects file names and absolute paths by default. Set `dataCollection.filePaths=false` to omit them. File extensions and byte counts remain available when paths are disabled.

## [Device Context](https://docs.sentry.io/platforms/android/data-management/data-collected.md#device-context)

The SDK automatically collects device and operating-system context, including the manufacturer, model, architecture, orientation, display details, boot time, timezone, memory size, and emulator status.

Set [`collectAdditionalContext=false`](https://docs.sentry.io/platforms/android/configuration/options.md#collectAdditionalContext) to reduce additional dynamic context such as battery level, available memory, storage state, and connectivity.

## [GraphQL Data](https://docs.sentry.io/platforms/android/data-management/data-collected.md#graphql-data)

GraphQL document and variable collection default to `true`. Use `dataCollection.graphql.document` and `dataCollection.graphql.variables` to disable either category. Operation metadata used for tracing and grouping can still be collected when document or variable content is disabled.

## [SQL Queries](https://docs.sentry.io/platforms/android/data-management/data-collected.md#sql-queries)

While SQL queries are sent to Sentry, neither the full SQL query (`UPDATE app_user SET password='supersecret' WHERE id=1;`), nor the values of its parameters will ever be sent. A parameterized version of the query (`UPDATE app_user SET password=? WHERE id=?;`) is sent instead.

## [Logs](https://docs.sentry.io/platforms/android/data-management/data-collected.md#logs)

Log messages, parameters, and breadcrumb content may contain application data. Data Collection doesn't filter this content. Use `beforeBreadcrumb` for breadcrumbs, `beforeSend` for events, or `options.getLogs().setBeforeSend(...)` for Sentry Logs when you need application-specific filtering.

## [Session Replay](https://docs.sentry.io/platforms/android/data-management/data-collected.md#session-replay)

By default, our Session Replay SDK masks all text content, images, webviews, and user input. This helps ensure that no sensitive data is exposed. You can find [more details in the Session Replay documentation](https://docs.sentry.io/platforms/android/session-replay/privacy.md).