Event dictionary
Names, triggers, properties, retention, and a “do not collect” list. This is the spine of Privacy-First Mobile Telemetry.
Approach
Privacy-First App Analytics as a shipping discipline
We do not treat privacy as a toggle on a vendor dashboard. At Proxy Servicehub, Privacy-First App Analytics means every property has a purpose, a retention clock, and a path that actually stops when someone rejects optional measurement.
Three tests before an event ships
Necessity. If the roadmap question can be answered with a coarser grain — daily counts instead of user rows — we collect the coarser grain. Vanity properties do not get a sympathy pass.
Reversibility. Deletion and export have to be runnable jobs, not policy sentences. If you cannot delete it, you should not store it under a name that implies you can.
Purpose match. Consent copy, SDK flags, and warehouse gates must describe the same activity. A reject button that only hides UI is a defect in this studio.
What we still measure
Activation, retention, crash-adjacent session health, and funnel completion can all be built from first-party events and aggregates. We teach hashed cohort keys, on-device rolls, and sampling windows so a PM is not left with a blank dashboard after a PDPA review.
What we usually drop: persistent device graphs, cross-app identity, city-level maps nobody used in a launch, and third-party pixels that quietly reopen purpose. If a stakeholder needs those, we ask them to fund a separate, explicitly consented research track — not to hide it inside product analytics.
Where this shows up in the programmes
Consent map
Copy states lined up with SDK flags and server jobs. Practised in the flagship and the PDPA seminar.
Aggregate jobs
On-device or warehouse rolls that keep activation curves without a user table. Covered in sampling vs hashing notes.