Privacy and GDPR

appmetrica.online collects the minimum data needed for reports: the technical context of a session and opaque identifiers. The system stores no advertising identifiers, no IP addresses and no personal data in plain form.

What is storedCopy Anchor Link

The data lives in self-managed ClickHouse and Postgres on a dedicated server in the EU and is not shared with third parties.

What is not storedCopy Anchor Link

• IP addresses. The IP is used only in memory to determine the country and city and is discarded right away. It is not in the databases, logs, metrics or rejected events.
• Email addresses and phone numbers. The server rejects a user_id that looks like an email address or a phone number with the code user_id_looks_like_pii.
• Advertising identifiers (IDFA, GAID), browser fingerprints, third-party cookies.

It's the client's responsibility not to put public identifiers that make a person easy to find into user_id. An internal account ID is fine; a Telegram ID only as an HMAC (see Bots and backends).

Retention periodsCopy Anchor Link

If an installation stays silent for 25 months, its entire history is deleted, and a returning user counts as new.

Deletion on requestCopy Anchor Link

The right to erasure is exercised by install_id, by user_id or for the whole app. Deleting by user_id erases the events of that user and of all installations linked to them. The past days they were active on are recalculated by the next day-closing run after the deletion completes; it runs every 15 minutes.

You can start a deletion in two ways:

• in the dashboard: from the person's profile, with the Delete data button;
• through the Read API, with a key that has the delete scope:

curl -sS -X POST "https://api.analytics.example.com/v1/apps/$APP_ID/deletion-requests" \
  -H "Authorization: Bearer $AM_SK" \
  -H "Content-Type: application/json" \
  -d '{"subject_type": "user", "subject_value": "a3f9c2d1-77b4-4e0a-9c1e-2b5d8f6e1a90"}'

A 202 response returns the request with the pending status. Deletion runs in the background. Repeating the call with the same parameters before the request completes returns the same request. Check the status like this:

curl -sS "https://api.analytics.example.com/v1/apps/$APP_ID/deletion-requests/$REQUEST_ID" \
  -H "Authorization: Bearer $AM_SK"

The done status means the data has been deleted from all tables. If deletion still fails after several attempts, the status becomes failed, and the owner gets a notification in Telegram.

Merging appsCopy Anchor Link

If one app is connected as two (for example, iOS and Android separately), you can merge them: Settings → Danger zone → Merge… in the app that stays. Events, rejected events and write keys are moved into it, the source app is deleted, and people with the same user_id in both apps become one person. The source app's keys keep working, so released app versions don't need an update.

A merge doesn't change what data is stored: only the owner's events move between the owner's own apps, and IPs are still not stored. Moved events keep their date, so the 25-month retention period counts from that date, not from the date of the merge.

While a deletion request is running for either of the two apps, a merge can't be started: wait for the done status first. After a merge, request user data deletion in the app that stayed. A merge can't be undone, so make a backup before you start.

Exporting user dataCopy Anchor Link

For a data access request, open the person's profile in the dashboard or call getProfile through the Read API: it shows the first-seen and last-seen dates, installations, devices and the session feed.

AttributionCopy Anchor Link

IP geolocation uses the IP Geolocation by DB-IP database (CC BY 4.0 license).