Attribution

What is attribution?

Attribution answers: “Which marketing campaign caused this user to install my app?”

When a user opens your app for the first time, the Trace SDK sends device signals to the server. Trace compares those signals against recent click records to find a match. If a match is found, the install is attributed to that campaign. If not, it’s recorded as organic.

Attribution methods

Trace tries three methods in order of reliability. The first match wins.

1. Install referrer (Android only)

The most reliable method. When a user clicks a link and installs from the Play Store, Google passes the original URL parameters through the install referrer. If the referrer contains a trace_click_id, Trace matches it directly to the click record.

Accuracy: Deterministic (exact match) Availability: Android only

2. Click ID

If the user opens the app via a Universal Link or App Link (i.e. the app was already installed), the SDK receives the click ID directly from the URL. Trace matches it to the click record.

Accuracy: Deterministic (exact match) Availability: Both platforms, but only for direct opens (app already installed)

3. Probabilistic fingerprinting

When neither referrer nor click ID is available (common on iOS), Trace falls back to fingerprint matching. The SDK collects device signals and the server looks for a recent click with similar characteristics.

Signals used:

Signal	Weight
IP address (hashed)	High — same network is a strong indicator
Screen dimensions	Medium — narrows the device model
OS version	Medium — eliminates older/newer devices
Device model	Medium — reduces candidate pool
Locale	Low — language/region hint
Timezone	Low — geographic hint

Trace scores each candidate click and picks the best match above a confidence threshold. If multiple clicks are close in score, the most recent one wins.

Accuracy: Probabilistic (high confidence but not 100%) Availability: Both platforms

4. Organic

If none of the above methods find a match, the install is recorded as organic — the user found your app without clicking a tracked link.

Attribution flow

┌─────────────────────────────────────────────┐
│ User clicks short link                      │
│   → Trace records click with device signals │
│   → User redirected to app store            │
└──────────────────┬──────────────────────────┘
                   │
┌──────────────────▼──────────────────────────┐
│ User installs and opens app                 │
│   → SDK collects device fingerprint         │
│   → SDK sends to Trace server               │
└──────────────────┬──────────────────────────┘
                   │
┌──────────────────▼──────────────────────────┐
│ Trace server attempts attribution           │
│   1. Check install referrer for click ID    │
│   2. Check explicit click ID from SDK       │
│   3. Fingerprint match against recent clicks│
│   4. No match → organic                     │
└──────────────────┬──────────────────────────┘
                   │
┌──────────────────▼──────────────────────────┐
│ Server returns result to SDK                │
│   → attributed: true/false                  │
│   → method: INSTALL_REFERRER / CLICK_ID /   │
│     FINGERPRINT / ORGANIC                   │
│   → campaignId (if attributed)              │
│   → deepLinkPayload (if link had one)       │
└─────────────────────────────────────────────┘

Deferred deep links

If the short link that was clicked had a deepLinkPath, and the install is successfully attributed, Trace returns the deep link payload with the attribution response. This is a deferred deep link — the user clicked the link before the app was installed, and the deep link is delivered on first open.

Link created with: deepLinkPath = "/product/123"
     ↓
User clicks link → installs app → opens app
     ↓
SDK receives attribution response:
  attributed: true
  method: INSTALL_REFERRER
  deepLinkPayload:
    path: "/product/123"
    isDeferred: true
     ↓
SDK delivers deep link to your listener
     ↓
App navigates to /product/123

Sandbox attribution

Links created with sandbox: true only match against debug builds of your app. This lets you test the full attribution flow without polluting production analytics.

Fraud detection

Trace includes built-in fraud signals:

Click-to-install time — unusually fast installs (< 1 second) are flagged
Device signal consistency — mismatched signals between click and install suggest spoofing
IP anomalies — high volume from a single IP with varied device signals
Sandbox isolation — debug-only links can’t be claimed by release builds

Fraud detection runs automatically. No configuration is needed.