docs: explain the anonymous device identifier in the FAQ - #648
Merged
Conversation
eseidel
force-pushed
the
faq-device-id
branch
from
September 5, 2026 00:13
e11486c to
282f50e
Compare
eseidel
changed the title
eseidel
force-pushed
the
faq-device-id
branch
19 times, most recently
from
September 5, 2026 00:50
b853706 to
0d7733a
Compare
eseidel
enabled auto-merge (squash)
September 5, 2026 00:53
Customers ask what the anonymous device identifier named in our privacy policy actually is, and whether it can be tied back to one of their users. We had no single place to point them. Adds two FAQ entries under Teams, access, and privacy, each leading with a direct answer before the detail: - What it is: a random ID Shorebird creates and stores inside their app, to allow Shorebird to count how many copies are active. A random v4 UUID created on first run, stored in state.json in the app's own storage, per-install rather than per-device, not the IDFA, IDFV or Android advertising ID, and gone on uninstall or a clear-data. - What Shorebird does with it: counts, and nothing else. Shorebird collects nothing it could be correlated against, and the counts are produced as aggregates. Never shown to anyone, never returned by an API, never sold or shared for advertising. Standardizes on "anonymous install identifier" as the name, since it is the most accurate description of the value, and lists the other names for it once. Links the privacy policy and the DPA, and points anyone who needs more detail at privacy@shorebird.dev. Also links the source that creates and sends the value, so customers can verify the payload themselves, and adds IDFA and IDFV to the spell-check dictionary.
eseidel
force-pushed
the
faq-device-id
branch
from
September 5, 2026 00:55
0d7733a to
25f32f8
Compare
AbhishekDoshi26
approved these changes
Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Customers reviewing our privacy policy ask what the "anonymous device identifier" is, whether it can be tied back to one of their users, and what we do with it. We had no single place to point them — just one bullet under "What information is sent to Shorebird servers?"
What's here
Two new entries under Teams, access, and privacy, each leading with a direct answer before the explanation:
What is the anonymous install identifier? — a random ID Shorebird creates and stores inside your app, to allow Shorebird to count how many copies of your app are active. Then the detail: a random v4 UUID created on first run, stored in
state.jsonin the app's own storage, per-install rather than per-device, not the IDFA/IDFV/Android advertising ID, and gone on uninstall or a clear-data. Closes on what Shorebird cannot do with it, and the one thing it can, which is count.What does Shorebird do with the anonymous install identifier? — counts, and nothing else. Shorebird collects nothing the identifier could be correlated against, and the counts are produced as aggregates. Never shown to anyone, never returned by an API, never sold or shared for advertising. Points onward to the privacy policy, the DPA, and privacy@shorebird.dev.
Naming
Standardizes on "anonymous install identifier", since that is the most accurate description of the value, and lists the other names for it once so customers arriving with any of them land in the right place.
client_idnow appears only where it is literally the field name.Verified against the source
Every factual claim is checked against
shorebirdtech/updater@mainrather than paraphrased:generate_client_id()isuuid::Uuid::new_v4()SerializedState.client_idis documented there as "Stable per-install ID. Survives release-version changes; only reset when the app is uninstalled."PatchCheckRequest.client_id: "a random UUID generated by Shorebird and not the device's UUID or any other identifier that has meaning outside of Shorebird"Both entries link to that source so customers can verify the payload themselves.
Also adds IDFA and IDFV to the spell-check dictionary.