Skip to main content

Kotzilla SDK data processing

Version 2.0, 21 August 2026. This page is a contractual document. It is referred to by Article 6.1 of the Kotzilla Terms and Conditions, in the version in force at the date of the Order Form or of the Order Confirmation. In the event of a contradiction between this page and Article 6.2 of the Terms and Conditions, Article 6.2 prevails.

The Kotzilla SDK is not designed to collect the personal data of the end users of your application, and Kotzilla does not intentionally collect any. This page describes precisely what is collected, so that you can verify that statement yourself.

Scope​

The SDK supports Android, Kotlin Multiplatform, Compose Multiplatform and iOS targets. The data described below is transmitted to the Kotzilla Platform and made available in the Console, in the Koin IDE Plugin and through the Kotzilla MCP Server.

What the SDK collects​

Application structure

  • the type, scope and binding relationships of components, including child dependencies;
  • injection relationships and resolution paths;
  • the component tree for each session;
  • the data computed for each application version.

Component statistics

  • creation counts, call counts and dependency tree depth;
  • average creation and call times, and time spent resolving components already created;
  • the kind of each definition, singleton, factory or other, and its memory behaviour over time;
  • the thread on which each resolution takes place.

User interface and stability

  • the lifecycle of Activities, Fragments and Compose Navigation screens;
  • the identifiers and the types of the screens traversed;
  • screen rendering times and ANR detection;
  • crash type, timing and stack traces, including frame origins;
  • execution time of the function calls covered by code tracing.

Technical environment

  • device type, operating system version, application version and version code.

Authentication

  • the API key identifying your application, and the session tokens used to authenticate requests.

What the SDK does not collect​

The SDK does not collect:

  • source code, method bodies or business logic;
  • screen contents, screenshots or screen recordings;
  • the attributes or the values of user interface elements;
  • input field data;
  • network request or response payloads.

The SDK records the structural hierarchy of screens, namely the identifiers and types of Activities, Fragments and Compose Navigation destinations. It does not record what those screens display.

Custom technical data​

Your responsibility

The SDK API lets you add your own technical data. Anything you add is transmitted as it stands and is outside the exclusions listed above. Never include personal data of your end users, and never include special category data within the meaning of Article 9 of the GDPR, data relating to criminal convictions or offences, or data relating to children.

The content of custom technical data is determined by you alone and under your sole responsibility, under Article 6.2 of the Terms and Conditions and Article A.15 of the Data Processing Terms.

The same applies to the third-party libraries with which you integrate the SDK. Kotzilla does not control what those libraries supply. Check what they transmit before enabling the integration.

Obfuscation mapping files​

The upload of R8 or ProGuard mapping files, and of iOS dSYM files, is optional and controlled by you. It allows class, method and stack trace names to be displayed in readable form. Mapping files are treated as your confidential information, are used for that sole purpose, and are deleted under the conditions set out in Article 9.8 of the Terms and Conditions. Do not include personal data in a mapping file.

Retention​

Raw Data and Final Data are retained for the periods set out in your Order Form or Order Confirmation, and for fifteen (15) days on the Starter Plan. Beyond that period, the static indicators described in the Documentation remain accessible for the term of the Agreement. The detailed rules are set out in Articles 6.6 and 6.7 of the Terms and Conditions.

Security​

All traffic between your application and the Kotzilla Platform is encrypted in transit using HTTPS. Data is encrypted at rest. Access to production environments is restricted, subject to multi-factor authentication, and logged. The measures in force are described on our security page.

Roles and personal data​

For the data of the users of your Console account, and for billing and support data, Kotzilla acts as controller, under the conditions set out in its privacy policy.

For the data collected by the SDK in your application, you act as controller and Kotzilla acts as processor. That processing is governed by the Data Processing Terms set out in Annex A to the Terms and Conditions, which apply to every subscription, or by a Data Processing Agreement where one has been signed. A negotiated agreement is available on request at contact@kotzilla.io.

Where you instrument an application on behalf of a third party, you act as processor for that third party and Kotzilla acts as subprocessor. You are responsible for holding the authorisation required in order to engage Kotzilla in that capacity.

Version history​

VersionDateMain changes
2.021 August 2026Collection of user interface element attributes removed, that statement being inaccurate. Structural description of the screen hierarchy substituted. Warning added on custom technical data and on third-party libraries. Confusion between special category data and personal data removed. Scope extended to Kotlin Multiplatform, Compose Multiplatform and iOS. Retention periods, roles and mapping files added. Page versioned and dated.
1.02023Initial version.