Install Attribution

WarpLink uses two tiers of attribution matching to connect app installs to the links that drove them.

Match Cascade

When the app opens, the SDK collects device signals and sends them to the WarpLink API. The server compares them against stored click signals.

Tier	Method	Signal	Confidence
1	Deterministic	IDFV	1.0
2	Probabilistic	Enriched fingerprint	Up to 0.85

Deterministic Matching (IDFV)

Used when the same install asks again, for example after the cached answer was lost or after an update from an older SDK. A reinstall is deliberately not answered from this tier. The SDK reports it as a reinstall, and the server records it as a new install through the probabilistic tier, so it is counted when that tier matches a click.

• Signal: UIDevice.current.identifierForVendor (IDFV)
• Match type: .deterministic
• Confidence: always 1.0
• Does not require ATT permission

IDFV is a UUID shared by every app from the same vendor on one device. Apple resets it when the last app from that vendor is deleted, so for a single-app vendor a reinstall gets a new IDFV. When another app from your vendor stays installed, the IDFV survives the delete, which is why the server never uses it to answer a reinstall the SDK reports as one.

Probabilistic Matching (Enriched Fingerprint)

Used for first-install attribution, and for a reinstall, which the IDFV tier deliberately leaves to this one. A match here records a new install either way, so a reinstall is counted like a first install.

• Signals: IP address (derived server-side) + normalized primary language + timezone
• Match type: .probabilistic
• Confidence: varies by fingerprint variant and elapsed time

Fingerprint Variants

Variant	Timezone component	Sent by
enriched_tz	IANA zone name, for example America/Toronto	SDKs that collect a zone name
enriched	Minute offset	Older SDKs, and devices that cannot resolve a zone
basic	None	Fallback when neither matches

The zone name carries far more entropy than the offset (roughly 340 zones against 38 offsets) and does not shift at a daylight-saving boundary, which previously broke a click-then-install pair across the change. It therefore earns a higher confidence ceiling.

Confidence by Elapsed Time

Time Since Click	enriched_tz	enriched	basic
< 1 hour	0.85	0.80	0.70
< 3 hours	0.65	0.60	0.50
< 6 hours	0.50	0.45	0.35
< 24 hours	0.30	0.25	0.20

Past 24 hours there is no match at all. The 24 hour band only applies to links whose match window is set past the 6 hour default.

Two further signals can only reduce the score, because a confident wrong answer is worse than an honest uncertain one:

• Bucket ambiguity. More than one claimable click shared the fingerprint: x0.6
• IP sharing. Carrier-grade NAT or a private address: x0.6. A household IPv4 address: x0.9. IPv6: x1.0

Reinstalls

A reinstall counts as an install. When a device deletes your app and installs it again, the SDK runs attribution again and the result lands in your install numbers like any other install.

The attribution request carries is_reinstall: true in that case. The SDK reads it from a Keychain marker that outlives an app delete, while the marker that stops a duplicate check inside one install lives in a backup-excluded file and does not. The flag labels the install and never blocks the request. See App Reinstall.

Interpreting Results

The WarpLinkDeepLink includes matchType, matchConfidence, and matchGuaranteed:

WarpLink.checkDeferredDeepLink { result in
    if case .success(let deepLink) = result, let deepLink = deepLink {
        let confidence = deepLink.matchConfidence ?? 0

        switch confidence {
        case 0.5...:
            navigateTo(deepLink.destination)
        case 0.3..<0.5:
            showSuggestion(deepLink.destination)
        default:
            showOnboarding()
        }
    }
}

Confidence	Recommended Action
1.0 (deterministic)	Route directly to content
> 0.5 (probabilistic)	Route to content: high confidence
0.3–0.5	Show content with confirmation ("Were you looking for...?")
< 0.3	Show generic onboarding

Gate Sensitive Actions on matchGuaranteed

matchGuaranteed is true only for a deterministic match, which on iOS means IDFV. Gate anything sensitive, such as auto sign-in or showing personal data, on this flag rather than on a matchConfidence threshold. A probabilistic match is a best guess made from a network-shaped fingerprint and can name the wrong user.

if deepLink.matchGuaranteed {
    restoreSession(for: deepLink)
} else {
    navigateTo(deepLink.destination) // public content only
}

App Tracking Transparency

The WarpLink SDK:

• Does not use IDFA (Advertising Identifier)
• Does not prompt for ATT permission
• Uses only IDFV, which is exempt from ATT
• Does not interfere with your app's own ATT strategy

Privacy

Signals Collected

Signal	Purpose	Source
Preferred language	Fingerprint component (server normalizes to the primary subtag)	Locale.preferredLanguages.first
Timezone name	Fingerprint component, sent as timezone by SDKs that collect a zone name	TimeZone.current.identifier
Timezone offset	Fingerprint component, the fallback for older SDKs	TimeZone.current.secondsFromGMT()
IDFV	Deterministic matching	UIDevice.current.identifierForVendor

The IP address is the third fingerprint component. The SDK never sends it: the server derives it from the request. User-Agent and screen dimensions are not collected. They never match reliably from a browser to a native app.

Not Collected

• IDFA (Advertising Identifier)
• Location data
• Contacts or personal data
• App usage data
• Cross-app identifiers

All signals are sent over HTTPS and used solely for attribution matching. No cross-app tracking is performed.