Metrics and usage reporting
The SDK sends two kinds of usage data, and neither carries location. Aggregate metrics counters are on by default and turn off with OctetConfig.telemetryEnabled = false. The daily usage record, one per device per UTC day, is always on, because Octet counts active devices.
Metrics counters
When telemetryEnabled is on (the default), the SDK reports counters to {activationServerUrl}/v1/metrics, indexed by your license: how many proofs were generated, uploaded, or could not be produced, by coarse level and region type. The counters are buffered in an encrypted file in the app's private storage and uploaded at most once a day, plus a best-effort flush when the app enters the background.
The counters carry no location data. No coordinates, no region ids, no proof contents leave the device in a metrics report.
| Sent | Not sent |
|---|---|
| Counts of proofs generated / uploaded / not produced, by coarse level and region type | Coordinates, region ids, or proof contents |
| SDK version, platform, OS version, app id | Any identifier that resolves to a person |
A pseudonymous deviceKey (a one-way HMAC of the install UUID) |
The install UUID itself |
Turning metrics off
Set OctetConfig.telemetryEnabled = false. That disables the metrics upload and deletes any buffered report. It does not affect the daily usage record.
Daily usage record
New in 3.0. To count active devices, the SDK sends one usage record per device per UTC day:
- The app generates its first proof of the UTC day.
- The SDK queues a single
device_activerecord. This needs no network, and the proof is already complete. - The SDK sends the record with the next background heartbeat. Later proofs that day send nothing more.
What it contains. The operation name, a timestamp and a record ID. The record ID is a one-way SHA-256 hash of the device's opaque activation fingerprint and the date, so it changes every day and lets the server ignore duplicates. The device is counted from the activation credentials the SDK already holds. The record carries no location, no coordinates, no proof data, no user or account identity, and no new device identifier.
It never affects a proof. The record is written after the proof exists. A failed send is retried on later heartbeats, and a record that could not be sent within 30 days is dropped. A sandbox session sends nothing.
It is always on. Reporting cannot be switched off. OctetConfig.creditServiceUrl defaults to https://credits.octetproof.com (OctetConfig.defaultCreditServiceUrl on iOS, OctetConfig.DEFAULT_CREDIT_SERVICE_URL on Android). Set it only to point a test build at another environment. Setting it to nil / null does not disable reporting.
In a gateway mode, the record goes through your gateway under /v1/credits/….
Where to go next
- Data collection: how to declare this data in the App Store and Play Console.
- License & Activation: how the SDK reaches the backend.