It’s always been possible to implement an application-level opt-out for Pinch Analytics, simply by giving the user a preference and only initializing the analytics library when the user has not opted-out. In response to some of our developers’ requests, we’ve completed two initiatives to make it easier for device owners to opt-out of Pinch Analytics’ anonymous data collection.

First, we’ve released a new version of our Pinch Analytics library that makes it even easier to add application-level opt-outs. When the device owner opts out, no anonymous usage data is collected, and all anonymous usage data for that application cached on the phone is deleted. We’ve made the opt-out code as flexible as possible, so the opt-out mechanism can be placed inside the application itself or within the Settings application. Developers who wish to add these optional opt-outs can find full documentation and sample code within our developer portal.

Second, we reached out to one of the main developers in the jailbroken community and asked if the system-wide opt-out not possible on unaltered iPhones could be implemented for jailbroken iPhones. We don’t recommend jailbreaking your iPhone, but since a significant minority of iPhone users do (about 8% at the moment), we wanted to provide the opt-out for that community. Many thanks to the iPhone Dev Team, who made this possible on short notice.

As saurik described it in the package release notes,

Developers integrate these systems for much the same reason people use Google Analytics: to better understand how their customers use their products.

This extension was a team effort, and was able to be executed as quickly as it was thanks to the help and interest of the companies involved.

We anticipate a modest decrease in the reliability of our jailbroken iPhone statistics due to this new application – developers who use Pinch Analytics to evaluate whether to build new features specifically for jailbroken users should take this into account, as should developers using the overall statistics in our newsletter to decide whether to build applications for the jailbroken ecosystem.

System-wide opt-outs for non-jailbroken-phones will be implemented should they become technically possible.

Pinch Media’s analytics product has recently been described as ’spyware’ by an anonymous critic, who has attracted some public attention. We want to address this directly. Spyware and analytics are quite distinct – spyware is software that tracks personally-identifiable information with a malicious or deceptive intent, while analytics tracks anonymous information for benign, useful purposes. Pinch Media’s services are the latter – nothing personally-identifying is ever tracked.

When Pinch Analytics is installed within an application, the following information is sent back on each application run:

• a hardware identifier not connectable to any personal information
• the model of your phone (3G, 3GS, etc.) and operating system (2.2, 3.0, 3.0.1, etc.)
• the application’s name and version
• the result of a check to see if the device has been jailbroken
• the result of a check to see if the application’s been stolen and the developer hasn’t been paid
• the length of time the application was run
• if the user explicitly agrees to share it, the user’s location
• if the application uses Facebook Connect, the gender & age of the user

None of this information can identify any individual. No names, phone numbers, e-mails, or anything else considered personally-identifiable information is ever collected.

The information sent from applications, when it arrives at our servers, is quickly converted to aggregated reports – unprocessed data is processed as quickly as we possibly can. The aggregated reports show counts and averages, not anything user-specific. For instance, a developer can see the following information:

• the number of distinct users who’ve accessed the application
• the average length of time the application was used
• the percentage of phones using each operating system
• the percentage of each model of phone (3G, 3GS, etc.)
• a breakdown of user locations by country, state, and major metropolitan area (for example, 20,000 in USA, 700 in New York state, 500 in New York City)
• the percentage of users of each gender
• the percentage of users by ‘age bucket’ (21-29, 30-39, etc.)

It’s these aggregated reports that are stored and accessible to developers. I recently saw a suggestion on Twitter that Pinch Media ‘do right by its users’ by sharing all data we’ve got collected about them. I’m proud to say we’re already doing that – because we’ve got absolutely nothing here we can connect to any individual.

Consent to collect data is also worth discussing. Just like the web analytics industry, Pinch Media requires notifications in terms of service or privacy policies before data can be collected. There are two ways to do this – an opt-in policy, where all users must click on an agreement consenting to the collection and use of data, or an opt-out policy, where no agreement is necessary but users have the option to remove themselves. On the iPhone, Pinch Media uses an opt-in policy. Data collected by Pinch Media is covered by Licensed Application End-User License Agreement, which all users agree to through iTunes before applications can be installed. We understand that this is not particularly transparent to end-users, although the notice prior to data collection is far more transparent than the opt-out strategy used by the now-ubiquitous web analytics industry. We would prefer to offer an opt-out policy as well, where users can remove themselves from the system through activating a simple preference, but due to the security restrictions placed on iPhone applications, this isn’t technically possible. We are committed to (and have always been committed to) implementing a system-wide opt-out should this become technically possible in the future. In the meantime, individuals concerned about Pinch Media can ensure no data is ever received by us by running their applications in ‘airplane mode’.

Finally, it’s important to note that this aggregated data is not used for anything malicious – it’s used to help developers make better decisions about their applications. Developers have used Pinch Media to adjust game balance and improve the experience for their users. Developers have used Pinch Media to identify under-used features and devote additional time to their improvement. Developers have used Pinch Media to identify the most-popular portions of their applications and make them better. Developers have used Pinch Media to determine what device models and operating system versions to support. Developers have used Pinch Media to determine what regions of the world to provide translations for. Developers have used Pinch Media to decide whether or not to support the jailbroken community. Developers have used Pinch Media to determine where to add additional local content to their apps. Developers have not, will not, and can not use Pinch Media to access any individual user or violate a user’s privacy in any way – because they (and we!) are simply not able to. While there have been many complaints about Apple’s review process, Apple has quite effectively policed the gathering of personally-identifiable information. Pinch Media is the most popular analytics product for iPhone applications in part because it is entirely benign to device owners.

Running a business as a iPhone developer is difficult – competition is high, and price points are low. In order to continue to produce applications, developers need all the tools they can to make better decisions. Pinch Media is an essential part of many developer’s toolkits, and we’re proud to offer the functionality we do – we see it as playing a small but important role in the success of the AppStore as a whole. If you have additional questions about Pinch Media, feel free to contact us.

UPDATE: Improved opt-out methods for Pinch Analytics are now available – details here.