Ask your provider for a one-line-per-permission table: what it is for, in which screen, what data it produces, where that data goes. Any permission still sitting in the Android manifest or the Info.plist without an active use should be removed before publication, for compliance reasons and for acceptance rates.<\/p>\n
Third-party SDKs: Firebase, Analytics, Facebook SDK, where the data goes<\/h2>\n
A mid-sized Flutter or React Native app easily carries fifteen to forty dependencies, a handful of which open network connections to the outside world. The business code you paid for is sometimes the smallest share of outbound traffic.<\/p>\n
![\"Mobile](\"https:\/\/storage.googleapis.com\/arrowlancer-prod.firebasestorage.app\/blog-ma\/cndp-application-mobile-maroc-permissions-sdk-2026\/1.jpg\")
<\/p>\n
Firebase Analytics records automatic events by default, along with device model, OS version, a coarse location derived from the IP address and a pseudonymous installation identifier. Crashlytics uploads stack traces containing exactly what your developers logged, and I have seen email addresses and order numbers surface in crash reports. Cloud Messaging stores the device token. The Facebook SDK logs app events automatically as soon as it initialises, often before any consent screen appears, and matches them against an existing Meta account. Attribution SDKs such as AppsFlyer or Adjust exist precisely to build an installation fingerprint.<\/p>\n
All of this leaves Morocco. A cross-border transfer of personal data is not something you improvise: it has to appear in your filing and rest on a framework the CNDP accepts, and the SDK vendor is your processor, which implies a contract and security commitments. The rules evolve, so check the applicable procedure on the CNDP website rather than reusing an old filing template.<\/p>\n
Third-party SDKs and personal data is a question you verify, not one you take on trust: run the binary behind an inspection proxy and look at the domains contacted on the very first launch. Note too that the technical stack changes the list you have to audit, since a Flutter or native project<\/a> pulls in a very different dependency tree, and community plugins rarely get a security read.<\/p>\n To send a notification, the app registers with Firebase Cloud Messaging or APNs and receives a token. That token identifies one installation on one device. As soon as you store it next to a customer ID, a phone number or an order history, it stops being an abstract string: you are holding an identifier tied to a person.<\/p>\n What happens in practice is always the same. The token table grows, nobody prunes it, and it ends up holding installations uninstalled two years ago along with the profile attached to them. Retention logic here is no different from any other dataset, and the retention periods the CNDP expects<\/a> apply to the table nobody looks at as much as to your customer database.<\/p>\n Three fixes usually cover it: delete the token on logout and on account deletion, purge the tokens FCM reports as invalid, and separate service notifications (order shipped, appointment confirmed) from marketing notifications, which rest on consent and must be switchable inside the app itself, not only in the phone settings.<\/p>\n Two things that quotes routinely conflate deserve to be pulled apart. Using Face ID or a fingerprint through the system API to unlock the app asks the operating system for a yes or no: the template never leaves the device’s secure enclave and you never receive it. Building your own facial recognition, for instance a selfie compared against the photo on a national ID card, means collecting and processing a biometric template on your servers.<\/p>\n The second case changes category. Biometrics under Law 09-08 sit in prior-authorisation territory rather than ordinary declaration, with a review that covers purpose, security measures, how long the template is kept and what alternative you offer users who refuse. Continuous location tracking of employees or couriers calls for comparable care, with labour law added on top. Before costing that kind of feature, check the current form and processing times on the CNDP website, because this is the line item that most often moves a launch date.<\/p>\n Apple requires an App Privacy card, Google Play a Data safety form, and both demand a reachable privacy policy URL. Google additionally expects a prominent disclosure screen for background location, and both stores now require an account deletion path accessible from inside the app. These forms remain self-declared: nobody checks line by line what your SDKs actually transmit.<\/p>\n What they do not cover at all: the CNDP formality itself, the basis for each processing activity, retention periods, the identity of the controller, how users exercise access, rectification and objection rights, and your processor contracts. Filling in the Apple card properly is a useful mapping exercise, but treating it as Moroccan compliance is a common mistake. Preparing a store submission<\/a> and preparing a CNDP filing are two parallel tracks, validated by different people.<\/p>\n On a reasonably sized app the work takes between half a day and two days. The order of the steps matters more than the tooling.<\/p>\n The reasoning mirrors website CNDP compliance<\/a>, with two differences: there are far more collection points, and a good share of them are invisible from the interface.<\/p>\n These points are negotiated at quote stage, not at acceptance testing. Including them in the initial scope costs almost nothing; adding them afterwards is paid for in development days.<\/p>\n In most cases yes, because the formality covers a processing activity and its purposes, not a channel. If the app creates new collection points (location, notifications, biometrics) or new recipients, your existing receipt does not cover them. Reread the exact scope of what you declared before concluding otherwise.<\/p>\n No. The system dialog grants technical access to a device resource. Law 09-08 also expects clear information about the purpose, the recipients, the retention period and the user’s rights, plus a way to change their mind. In practice that means an explanation screen shown just before the permission prompt.<\/p>\n Many Moroccan apps do. It means hosting outside Morocco, so a cross-border transfer to handle in your filing, a processor contract with the vendor, and a deliberately reduced configuration: switch off automatic event collection you have no use for, and never allow direct identifiers into crash logs.<\/p>\n At scoping, not at acceptance. Removing an attribution SDK or reworking a biometric flow after development costs several days, and the fix always lands at the worst possible moment, right before store submission.<\/p>\n At Arrowlancer, mapping permissions, third-party SDKs and location or biometric flows is part of the scoping phase for every iOS, Android, Flutter or React Native app we build, before the integrations are locked in. You can see the scope of the mobile practice among our services<\/a>. If you are preparing a launch or a rebuild, send us a note<\/a> with the list of permissions your app currently requests: it is the most useful starting point for the conversation.<\/p>\n","protected":false},"excerpt":{"rendered":" System permissions, Firebase and Facebook SDKs, push tokens: where your mobile app’s data actually goes, and what Law 09-08 requires before launch.<\/p>\n","protected":false},"author":0,"featured_media":247,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[63,273,279,222,109,934],"class_list":["post-246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech_et_development","tag-cndp-en","tag-compliance-en","tag-law-09-08-en","tag-mobile-app-en","tag-morocco-en","tag-third-party-sdks-en"],"_links":{"self":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/comments?post=246"}],"version-history":[{"count":1,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/246\/revisions"}],"predecessor-version":[{"id":249,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/posts\/246\/revisions\/249"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media\/247"}],"wp:attachment":[{"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/media?parent=246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/categories?post=246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arrowlancer.ma\/blog\/wp-json\/wp\/v2\/tags?post=246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The push token, the personal data nobody declares<\/h2>\n
Biometrics and continuous location: the strictest regime<\/h2>\n
What the stores already require, and what goes well beyond their forms<\/h2>\n
What a mobile app CNDP compliance audit covers before launch<\/h2>\n
\n
The checklist to put in the contract before you sign<\/h2>\n
\n
Frequently asked questions<\/h2>\n
Does the app need its own CNDP filing if the website is already declared?<\/h3>\n
Is the consent shown by iOS or Android enough?<\/h3>\n
Can a Moroccan app use Firebase?<\/h3>\n
When should the audit happen?<\/h3>\n
Where this audit sits in a mobile project<\/h2>\n