Install Attribution

WarpLink uses two tiers of attribution matching to connect app installs to the links that drove them.

Match Cascade

Tier	Method	iOS	Android
1	Deterministic	IDFV (re-engagement)	Play Install Referrer
2	Probabilistic	Enriched fingerprint	Enriched fingerprint

Deterministic Matching

iOS (IDFV): Used for re-engagement when the app was previously installed. IDFV is exempt from App Tracking Transparency. Confidence: 1.0.

Android (Play Install Referrer): The Play Store passes the click referrer through the install process. Confidence: 1.0. Falls back to fingerprint if unavailable (sideloaded apps, no Play Services).

Probabilistic Matching

Used when deterministic signals are unavailable. The SDK collects the device's preferred language and timezone, and the server derives the request's IP address and computes the fingerprint from all three.

Fingerprint Variants

Variant	Timezone component	Sent by
enriched_tz	IANA zone name, for example America/Toronto	SDKs that collect a zone name
enriched	Minute offset	Older SDKs, and devices that cannot resolve a zone
basic	None	Fallback when neither matches

The zone name carries far more entropy than the offset (roughly 340 zones against 38 offsets) and does not shift at a daylight-saving boundary, which previously broke a click-then-install pair across the change. It therefore earns a higher confidence ceiling.

Confidence by Elapsed Time

Time Since Click	enriched_tz	enriched	basic
< 1 hour	0.85	0.80	0.70
< 3 hours	0.65	0.60	0.50
< 6 hours	0.50	0.45	0.35
< 24 hours	0.30	0.25	0.20

Past 24 hours there is no match at all. The 24 hour band only applies to links whose match window is set past the 6 hour default.

Two further signals can only reduce the score, because a confident wrong answer is worse than an honest uncertain one:

• Bucket ambiguity. More than one claimable click shared the fingerprint: x0.6
• IP sharing. Carrier-grade NAT or a private address: x0.6. A household IPv4 address: x0.9. IPv6: x1.0

Reinstalls

A reinstall counts as an install. When a device removes your app and installs it again, the native SDK runs attribution again on both platforms and the result lands in your install numbers like any other install.

The attribution request carries is_reinstall: true in that case. It comes from a device-level marker that outlives the uninstall: the Keychain on iOS, SharedPreferences on Android. The marker that stops a duplicate check inside one install is a separate, install-scoped one that no backup restores. The flag labels the install and never blocks the request. See App Reinstall.

Using Attribution Data

import { WarpLink, type AttributionResult } from '@warplink/react-native';

const attribution = await WarpLink.getAttributionResult();
if (attribution) {
  console.log('Link ID:', attribution.linkId);
  console.log('Match type:', attribution.matchType);
  console.log('Confidence:', attribution.matchConfidence);
  console.log('Guaranteed:', attribution.matchGuaranteed);
  console.log('Is deferred:', attribution.isDeferred);
}

matchGuaranteed is also present on WarpLinkDeepLink, so the same check works in an onLink callback.

Recommended Thresholds

const attribution = await WarpLink.getAttributionResult();
if (!attribution) {
  showOnboarding(); // Organic install
  return;
}

if (attribution.matchConfidence >= 0.5) {
  navigateToLink(attribution.linkId);
} else if (attribution.matchConfidence >= 0.3) {
  showSuggestion(attribution.linkId);
} else {
  showOnboarding();
}

Confidence	Recommended Action
1.0 (deterministic)	Route directly to content
> 0.5 (probabilistic)	Route to content: high confidence
0.3–0.5	Show content with confirmation
< 0.3	Show generic onboarding

Gate Sensitive Actions on matchGuaranteed

matchGuaranteed is true only for a deterministic match: IDFV on iOS, the Play Install Referrer on Android. Gate anything sensitive, such as auto sign-in or showing personal data, on this flag rather than on a matchConfidence threshold. A probabilistic match is a best guess made from a network-shaped fingerprint and can name the wrong user.

if (attribution.matchGuaranteed) {
  restoreSession(attribution.linkId);
} else {
  navigateToLink(attribution.linkId); // public content only
}

Privacy

Not Collected

• IDFA (iOS Advertising Identifier)
• GAID (Google Advertising ID)
• Android ID
• Location data
• Contacts or personal data
• Cross-app identifiers

Collected

Signal	Purpose	Platform
Preferred language	Fingerprint (server normalizes to the primary subtag)	Both
Timezone name	Fingerprint, sent as timezone by SDKs that collect a zone name	Both
Timezone offset	Fingerprint, the fallback for older SDKs	Both
IDFV	Deterministic match	iOS only
Play Install Referrer	Deterministic match	Android only

The IP address is the third fingerprint component and is derived server-side. The SDK does not collect a User-Agent or screen dimensions.

ATT Compliance (iOS)

• No IDFA access: no ATT prompt needed
• IDFV is exempt from ATT
• Does not interfere with your app's ATT strategy

All signals are sent over HTTPS and used solely for attribution matching.