Features #

• The hosted payment page can now ask the SDK for device facts a webview cannot see, and attaches them to the payment as fraud-prevention signals: device model and manufacturer, OS version, physical-vs-simulator, the iOS vendor identifier (IDFV), battery level and charging state, network transport, and whether a VPN tunnel is active. Collection is best-effort — each probe has an 800 ms budget, and a fact that cannot be read in time is reported absent. A payment is never delayed or failed by telemetry, and the page proceeds with what the browser alone can see if the SDK answers nothing.

• The page may also read a coarse location fix on its consent screen, so geolocationEnabled is now set on the payment webview. Grants are scoped to the Spare hosted origin by the same navigation policy that governs every other request the webview makes.

  This one needs a decision from you. It is opt-in per app: the SDK declares no location permission and shows no dialog of its own, so nothing changes until you declare ACCESS_COARSE_LOCATION (Android) or NSLocationWhenInUseUsageDescription (iOS) and your app holds the grant. Payments complete normally without it. See "Location signal (optional)" in the README.

Privacy #

• The README now documents every signal the SDK collects and its source, so your App Store disclosure can account for it. Your aggregate disclosure should list Device ID — and Coarse Location if you enable the location signal — both as "not linked to you" and "not used for tracking", for app functionality. This is a pure-Dart package with no native target, so it carries no PrivacyInfo.xcprivacy; the required-reason API declarations ship in the manifests of the plugins below.

Dependencies #

• Added battery_plus: ^6.2.0 and connectivity_plus: ^6.1.0 for the battery and network signals. Both are native plugins, so a rebuild picks up new platform code.
• Removed http and uuid, which nothing in the package used any more.

Bug Fixes #

• The bank authorization URL now opens in an external user-agent. It is handed to the operating system first, so where the bank's app is installed and claims the URL the payer lands in that app; a refusal retries in platform-default mode (Chrome Custom Tabs or SFSafariViewController). 1.0.0 opened it in an in-app browser view, which kept the routing decision inside the app and meant app-to-app redirection could not happen. Required by the UAE Open Finance redirection guide.

First stable release.