Shoppers and identity

The SDK knows a shopper by up to two ids: an install id it creates itself, and an opaque customer id your app passes when the shopper signs in. This page explains both, how profiles attach to an identified customer, and what to do on logout or an erasure request. Read it before you wire sign-in and sign-out, because the ids decide which campaigns a shopper can see and which arm they get.

The install id

On first launch the SDK creates a random UUID, the install id. It identifies this installation of your app, not a person. The SDK uses it to assign shoppers in campaigns that assign by install, and it stamps it on every event.

• The SDK owns the install id. Your app never sets it.
• It is stored in the SDK’s own app-private storage, which the SDK excludes from backups on both platforms. On Android this also covers device transfers, so a restored or transferred device gets a new install id. iOS treats backup exclusion as a hint, so a restored device may keep its install id. Deleting the app removes it on both platforms.
• The SDK never reads the advertising identifier or any other device identifier.
• The install id changes when your app calls the reset call (below).

Signed-out shoppers have only an install id, so they see only campaigns that assign by install.

The customer id

When a shopper signs in, your app passes their customer id to the SDK with the identify call. Use the same internal id your backend uses for that customer, for example cus_7Hq2Lm9x. Grona uses it to:

• assign the shopper in campaigns that assign by customer, so they get the same arm on Android, iOS and in your backend;
• fetch grants for offers, which your backend requests from Grona for this customer id (see the Mobile grants API);
• mark the shopper as signed in for audience rules;
• stamp customer_id on events.

The customer id must be opaque: an internal id that means nothing outside your systems. Customer ids must match [A-Za-z0-9._:-]{1,128}: letters, digits and ., _, : or -, at most 128 characters. The SDK ignores an identify call with any other id and keeps its current customer.

Never pass personal data as the customer id

Never pass an email address, a phone number or a national id number. The SDK cannot tell an opaque number from a phone number, so it accepts an all-digit id of 9 or more characters but logs a warning. Treat that warning as a bug in your integration.

Campaigns that assign by customer skip shoppers who are not identified. Every campaign that carries a money treatment (every offer) assigns by customer, so signed-out shoppers never see offers. See Assignment and bucketing.

Profiles

A profile gives audience rules data about an identified customer: opaque segment ids, named lists of product ids (for example a list of the shopper’s usual products), and short attributes. Rules read them as profile.segments, profile.lists.<name> and profile.attributes.<name>.

• Profiles come only from your app. Your app builds the profile from its own authenticated session, for example from your backend’s response after sign-in, and passes it to the SDK. Grona never serves profiles to the device by customer id, because the workspace key in your app is public and anyone could ask.
• A profile is bound to one customer. Each profile names the customer id it belongs to. The SDK ignores a profile that does not match the identified customer.
• Until a matching profile arrives, profile rules are unknown. A campaign whose audience depends on the profile stays inactive, even through a not, and logs no eligible. When the profile arrives, live placements re-evaluate.
• Signed-out shoppers have no profile, so a profile-targeted campaign never shows to them.

Segment ids are opaque labels such as returning_buyer, not descriptions of a person. Keep names, contact details and free text out of profiles.

Sign-in, sign-out and switching accounts

Event in your app	What to call	What the SDK does
Shopper signs in	Identify with the customer id, then set the profile	Fetches grants for this customer; profile rules become known
Shopper switches account	Identify with the new customer id, then set the new profile	Clears the old profile and grants, fetches grants for the new customer
Shopper signs out	Identify with null	Clears the customer id, profile and grants. Keeps the install id
Erasure request, or a full reset on a shared device	The reset call	Clears everything below and issues a new install id

Identifying with null keeps the install id, so the shopper keeps their arms in install-based campaigns. That is usually what you want for a plain sign-out.

Reset

The reset call returns the SDK to the state of a fresh install. Use it when a shopper asks for their data to be erased, when they delete their account, or when you want a signed-out device to stop being linked to the previous shopper.

It clears:

• the event queue, in memory and on disk;
• the customer id and profile;
• grants;
• the basket snapshot;
• preview pins;
• the session;

and it deletes the install id and creates a new one. Because the install id changes, the shopper is reassigned in campaigns that assign by install.

Next steps

• Consent and data minimisation
• Android: Identify shoppers
• iOS: Identify shoppers