9 November 2025 · SDK
Aggregating sessions on the device
On-device aggregation is not a slogan you print on a privacy page. It is a small local job that turns many tap-level records into a few numbers before they leave the phone. Done badly, it is just a delay before you upload the same user table.
In the flagship studio this is week five, and it is where release trains matter. You cannot critique a local roll that never shipped. Arisa’s rubric is simple: after the roll, can a warehouse row still point at a person? If yes, you aggregated the display, not the data.
What belongs in the local roll
Session length bands, count of a named screen class, crash-adjacent “session ended unexpectedly”, and binary flags such as “completed activation task”. These answers are useful at the day × app-version grain. They do not need a user id to change a release.
What usually does not belong: every tap coordinate, every search string, every scroll depth percentile. Those fields recreate a person when combined, even if you deleted the explicit id. They also inflate the SDK and the battery budget, which is its own privacy cost because users then disable measurement entirely.
What still goes to the server
Authenticated product actions that the backend already knows — a transfer, a purchase, a lesson completion — can stay as first-party server events with account-level retention. Duplicating them from the client as “analytics” is how dictionaries bloat. Privacy-First App Analytics prefers one source of truth per action.
Consent state itself should be visible to the server. A local roll that continues after reject is a defect. The consent map in our approach page exists so this failure is obvious in critique.
Payload discipline
A daily summary packet should be boring: a few integers, an app version, a schema version. If your “aggregate” still carries twenty diagnostic strings, you have not finished the exercise. See also why SDK size matters.
Limitation we repeat in class: low-end devices and aggressive OS battery rules may drop local jobs. Design the warehouse to tolerate missing days rather than backfilling from a hidden identified log “just in case”.