How we track our own iOS app installs

ASC API + ct= campaign tokens, per-source attribution, and zero personal data on the install funnel.

SHORT ANSWER

Every App Store link on hundo-hunter.com has a ct= campaign token. Apple's App Analytics aggregates installs per token and surfaces them via the App Store Connect Analytics API. We pull daily totals, never per-user data.

THE CT= CAMPAIGN TOKEN

Apple's iTunes Store URL accepts a ?ct=<token> parameter. Anyone who taps a link with the token, then downloads the app within the next ~24 hours, is attributed to that token in App Store Connect Analytics.

We use one token per content source: storage-system page = ct=storage, blog post = ct=blog-<slug>, monthly recap = ct=recap-2026-05, etc. The tokens never leave Apple's servers in raw per-user form — only aggregate daily counts are returned.

URL SHAPE

https://apps.apple.com/app/hundo-hunter/id6766415258?ct=<source>&pt=<provider>

ct = content/campaign token              // up to 100 chars, alphanumeric
pt = provider token                      // omitted; we are the developer

The full implementation lives at lib/asc/url.ts. All AppStoreLink components in the site render through a single buildAppStoreUrl(source) helper so we never hand-type tokens.

We never include user IDs, session IDs, IP fragments, or any other identifier in the ct token — only the abstract source surface name.

WHAT WE DO AND DO NOT COLLECT

Attribution is intentionally minimal:

▸We DO: pull daily aggregate install counts per ct token via the ASC Analytics API on a nightly cron.
▸We DO: surface 30-day rolling totals per source on the internal /admin/analytics dashboard.
▸We do NOT: drop any cookie, fingerprint, or per-user pixel on app store link clicks.
▸We do NOT: pair ct tokens with any user table — there is no user table on the site at all (no accounts).
▸We do NOT: share or sell the aggregated counts with any third party.

WHY WE PUBLISH THE METHODOLOGY

App-install attribution is one of the few places a site can quietly add tracking and most users would never notice. We list the exact mechanism here so anyone curious can verify by network-tapping a link.

The full client code is in the repo at lib/asc/url.ts. The server-side pull script is a thin wrapper around the ASC API using the same ES256 JWT signer we use for App Store releases.

∞ · TOOLS THAT USE THIS METHODOLOGY

Privacy & analytics methodology →