Matching installs without asking for the IDFA.

What we do not collect

• No IDFA or advertising ID. We never ask for it, so your app does not need an App Tracking Transparency prompt on our account. That prompt is refused by most people, and an SDK that needs it is an SDK whose accuracy collapses in practice.
• No device fingerprint that identifies a person. The signals we use are coarse by design and are compared inside a short window against clicks on your links only.
• No cross-app or cross-customer graph. Your clicks match your installs. There is no shared identity pool, and building one is not on the roadmap.

What a match is made from

When a link opens an app that is already installed, nothing is inferred at all — the link came through, and the attribution is exact.

When somebody installs first, the link cannot cross that boundary on iOS, and the install has to be tied to a recent click. The strongest available signal is used first, and there is a real hierarchy:

• Android has an install referrer from the Play Store, which carries the click through the install directly. Those matches are exact rather than inferred, which is why the platforms differ in the report.
• A clipboard handoff, where the person’s own action carries a token we issued. It is only ever read when the server is expecting one, and anything that is not unmistakably ours is discarded on the device. How that boundary works is written up, including what it refuses to do.
• Coarse signals inside a short window otherwise — enough to distinguish plausible candidates, not enough to identify anybody.

What it costs

Accuracy, and we would rather say so than imply parity. A method without a device identifier cannot be certain about every install, and the honest form of that statement is a number. The measured rates are published — including the case that goes worst, a busy shared network where several people genuinely look alike.

Every attributed install carries the confidence it was matched at, so an uncertain match is visible as an uncertain match rather than counted silently alongside the certain ones. Installs we could not match at all appear beside the ones we could, in the same total.

For your privacy review

What to declare in your privacy manifest lists the fields, so the answer to “what does this SDK collect” is a document rather than a conversation. Data residency and the rest of the security position are on the security page, which also states what we do not have.