Skip to main content

Analytics

What it is​

Product analytics records what users do (screens viewed, sign-ups, purchases) so the client can see funnels and usage. We usually use Google Analytics 4 with Firebase Analytics in the mobile app. Attribution tools (which ad brought this install) are a separate SDK with stricter privacy rules.

Why we do it carefully​

Analytics is personal data. It needs consent where the law requires it, a line in the privacy policy, and the right answers in the store privacy labels. Getting any of those wrong has caused store rejections and declaration mismatches for us.

Before you start​

  • The consent model is decided. See The consent model.
  • The client has agreed which events matter. Write them in an event plan before adding SDKs.

Steps​

  1. One GA4 property for prod, plus one for dev and staging together, so test traffic never pollutes real numbers.
  2. Write the event plan: event names in snake_case, parameters, and which screen or action sends each. Keep it in the repo.
  3. In GA4 Admin: set data retention to the minimum that meets the client's needs, turn off Google signals and ads personalisation unless consent covers them.
  4. Gate the SDK on consent: do not initialise analytics collection until the user has agreed, where consent is required.
  5. Purchases and sign-ups that matter are sent from the server, after the payment or account is confirmed, never only from the browser. A tab can close before the browser sends.
  6. Update the privacy policy, the App Store privacy labels and the Google Play Data safety form before the build that adds the SDK.

Check it worked​

Use GA4 DebugView with a debug build: each event in the plan appears with its parameters. With consent declined, nothing appears.

Rules​

Rule

No personal data in event parameters: no emails, phone numbers, names or free text.

Rule

An attribution or advertising SDK changes the store declarations (device and advertising ids, tracking). Update them before the upload, and add the tracking prompt on iOS.

Done when​

  • Separate prod and non-prod properties.
  • Event plan in the repo.
  • SDK gated on consent; retention and ads settings checked.
  • Key events sent from the server.
  • Privacy policy and store declarations updated first.
Last updated on