UNDA — Analytics Event Allowlist

Status: Empty (by design). No product analytics SDK is wired in the current build.

Hard rules (from §5)

• Never send sensitive menstrual, reproductive, symptom, or health-state values to any analytics, advertising, or marketing system (RULE 1).
• Never monetise intimate user data via advertising, remarketing, ad-audience creation, cross-service profiling, or sale to brokers (§5.5).
• Any new event or property not on this list requires review before it lands in a production build.

Allowed events (empty)

None. When the first event is added, its row must include:

Event name	Trigger surface	Properties (allowed)	Contains PII?	Contains health?	Approved by	Approval date

Explicitly prohibited event patterns

The following event shapes are banned regardless of the SDK. If a PR proposes anything matching these, review must reject it:

• Any property named or containing: cycle_day, phase, symptom(s), expected_period, period_start, period_length, hrv, pregnancy, fertility, contraception, mood, energy, flow, felt_score.
• Any property carrying free-text health notes.
• Any property carrying HealthKit / Health Connect payloads.
• Any property carrying OAuth tokens, refresh tokens, or emails.
• Any user identifier that would let a third party correlate UNDA with another product (e.g. IDFA/GAID as event property).

When we do wire analytics

We will:

1. Add the vendor to processors.md first.
2. Configure a scrubber for the properties above regardless of caller intent.
3. Prefer interaction-only events (Recommendation Viewed, Onboarding Completed) with {screen} and {source} only.
4. Consider whether the vendor is truly needed vs. running a self-hosted counter.