Matching installs without asking for the IDFA.

What we do not collect

• No IDFA or advertising ID. We never ask for it, so your app does not need an App Tracking Transparency prompt on our account. That prompt is refused by most people, and an SDK that needs it is an SDK whose accuracy collapses in practice.
• No device fingerprint that identifies a person. The signals we use are coarse by design and are compared inside a short window against clicks on your links only.
• No cross-app or cross-customer graph. Your clicks match your installs. There is no shared identity pool, and building one is not on the roadmap.

What a match is made from

When a link opens an app that is already installed, nothing is inferred at all — the link came through, and the attribution is exact.

When somebody installs first, the link cannot cross that boundary on iOS, and the install has to be tied to a recent click. The strongest available signal is used first, and there is a real hierarchy:

• Android can carry the click through the install directly, using the install referrer from the Play Store. It needs an install-referrer plugin in your app, and when the referrer arrives the match is exact rather than inferred. Without one, an Android install falls back to the same inference iOS uses. That is why the platforms differ in the report, and the Android setup page names the plugin for Capacitor and for Cordova.
• A clipboard handoff, where the person’s own action carries a token we issued. It is only ever read when the server is expecting one, and anything that is not unmistakably ours is discarded on the device. How that boundary works is written up, including what it refuses to do.
• Coarse signals inside a short window otherwise — enough to distinguish plausible candidates, not enough to identify anybody.

What it costs

Accuracy. A method without a device identifier cannot be certain about every install, and the useful form of that statement is a number you can plan around. The measured rates are published — including the case that goes worst, a busy shared network where several people genuinely look alike.

Every attributed install carries the confidence it was matched at, so an uncertain match is visible as an uncertain match rather than counted silently alongside the certain ones. Installs we could not match at all appear beside the ones we could, in the same total.

For your privacy review

What to declare in your privacy manifest lists the fields, so the answer to “what does this SDK collect” is a document rather than a conversation. The rest of the security position — what protects the data and where it is held — is on the security page.