Crash reporting and analytics can accidentally become secondary stores for sensitive data. Mobile breadcrumbs, screen names, network failures, and extras often travel automatically.
Define stable event names and allow-listed metadata:
logger.event(
name = "health.sync.completed",
properties = mapOf(
"stage" to "upload",
"record_count" to count,
"duration_ms" to duration,
),
)
Do not include raw health values, chat messages, notes, email addresses, request bodies, access tokens, or provider payloads.
Use a stable one-way user identifier when correlation is necessary. Clear user context on sign-out. Sanitize Sentry breadcrumbs, tags, extras, request headers, and exception context before upload.
Analytics should record product actions, not every implementation event. “Report shared” may be useful; “Room query completed” belongs in diagnostics if anywhere.
Build redaction as a shared client so features cannot bypass it accidentally. Test with sentinel secrets and assert no serialized event contains them.
Observability is useful when it answers operational and product questions. Collecting less, with stronger names and context, usually produces better answers.