Any startups or apps needing or interested in add...

# random

[brandonmcansh]

Any startups or apps needing or interested in adding attribution (install and reengagement) and deferred deeplinks to their product? Working on a KMP SDK supporting native Android, native iOS, and KMP (to start) without all the overhead of Appsflyer, Branch, etc. Will be BYOK (bring your own key(salt) from the beginning and no raw IPs stored anywhere.

This unlocks contextual deeplinks when the user doesn't yet have the app installed - instead of them having to install app, login and then reclick your link.

[Stefan Oltmann]

Could you explain in more depth what kind of product you want to build and how it works? I don't know the other mentioned apps.

What is it for and how is privacy handled?
Will stuff be stored on US servers?

I like my apps to have minimal privacy policies, so if possible I go with no data collection at all. And if necessary I store everything at least on EU servers - preferably self hosted at Hetzner.

[brandonmcansh]

Great question.

Trace is a mobile attribution tool — it tells app developers where their users came from (ads, referral links, App Store search, etc.). Branch and AppsFlyer are large scale libraries made for enterprise and have gotten very complex and bloated. It includes things like deferred deep links, fraud detection, and SKAdNetwork support out of the box.

On privacy: no raw IPs are stored at any point — they're hashed immediately with a per-app salt and the original is discarded. BYOK is on by default, so even we can't reverse or cross-reference your users' data.

Servers are US-based right now, but I'm actively adding EU region support. The plan is automatic routing — EU traffic goes to Frankfurt without any SDK changes needed. On higher plans you'll also be able to force it explicitly, which means you can write it into your privacy policy and have it be fully EU isolated.

Plans are based on total installs across all your apps — free covers up to 3 apps, Growth up to 10, Scale is unlimited.

Growth and Scale also have webhook support for events.

[brandonmcansh]

There is data retention where necessary and there is a retention window that purges data (clicks, etc)

[Stefan Oltmann]

How long is retention? Is it fixed?

[Stefan Oltmann]

For Sentry.io you can always safely write „after 90 days“, because that's the longest they can hold data and it's unchangeable.

[Stefan Oltmann]

If I would offer a SaaS tool I‘d always take the perspective of the guy that needs to write the apps privacy policy - or the privacy aware user. The shorter the better.

My latest apps don't use Google analytics anymore because it’s difficult to declare.
(I prefer direct feedback in a forum anyway.)

In my mini app and photo util I didn't even add Sentry because I wanted the privacy policy to be super short and hope if these tools have errors I'd able to reproduce them form a description. (I can't do that for more complex apps, that's clear)

I'm privacy aware in private and bound to German privacy laws as a developer, so I'd very careful consider the value of a integration/ analytics insight vs the privacy tradeoff.

That's means as a customer I would need guarantees for servers in the EU - at best in Germany; Hetzner for example. Amazon AWS EU instances is way more difficult. Cloudflare is a no go in most cases. And of course we would need to sign a DPA as GDPR demands.

Alternatively you exclude the EU market.

That's the only hint I can give you right now.

[Stefan Oltmann]

That's just theoretical speaking. I guess I don't need that analytical data, because my apps barely have users. If they has and I would want that insight where they come from the above would apply.

[Stefan Oltmann]

As I understand GDPR hashing of IP addresses doesn't help. It's even after hashing still a stable identifier and qualifies as PII. You would need to cut the last part so that it still tells you the course location, but could apply to multiple users.

[Stefan Oltmann]

That is the difference between anonymization and pseudonymization.
Under the GDPR, anonymization takes data outside the regulation’s scope, whereas pseudonymization does not. Be aware.

[brandonmcansh]

For context: It’s BYOK per app salt and a global server pepper which is the practical ceiling for a two sided attribution system. WP29 guidance on pseudonymization was written with this constraint in mind.

[Stefan Oltmann]

What does that mean?

[brandonmcansh]

Which part?

[Stefan Oltmann]

I agree the setup is strong technically. My only point is that for EU customers it would still require full GDPR compliance handling.

[brandonmcansh]

Yes, I’m aware. Been built for this in mind

[brandonmcansh]

traceclick.io

Launching today

[Stefan Oltmann]

Nice to see you implemented my feedback. I just wonder if trace apps dpa --accept is enough?

From Hetzner & netcup by clicking the DPA button they generated a PDF to download for my documents as a proof.
This document also describes the security measures (your point 7).

[brandonmcansh]

DPA is available on the site

[Stefan Oltmann]

So there is a download link to a PDF file you generate with my address and so on?

[Stefan Oltmann]

In the docs it’s just described as a CLI command to see when it was accepted. I'm not sure if that's enough.