How the app measurements work.

What is measured

Since 0.9.10, collection starts by default on the first measured run, including after an upgrade. The local control can stop it. There is no in-app analytics switch. Your website analytics choice does not control these app measurements.

The purpose is to understand whether Roadie’s routing features become available and remain available during early use. The app keeps progress locally and sends at most eleven different contributions from that local state. Removing that state can restart measurement, so these contributions do not count unique people or installations.

Each report contains four fields. These are a format version, a random retry identifier, a fixed 28-day group date, and one predefined milestone. Reports contain no stable installation or device identifier. They contain no browser identifier, trial hash, license key, device names, audio, app names, email, acquisition source, or precise observation time. Different milestones do not share a report identifier.

Initial milestones cover first observation, routing availability, changed routing rules, accepted automatic device changes, and successful corrections within the first 72 hours. Return observations cover app-running and routing availability during one-day windows starting on days 3, 7, and 14. App-running means an awake, active user session, not interaction with Roadie. Routing availability also requires permitted access, unpaused routing, and a usable device. An accepted device change does not prove that another app used that device.

Where reports go

Roadie uses Cloudflare Workers for the website, trial service, license-management service, and app measurement collector. A separate Worker uses SQLite Durable Object storage for hashed duplicate-check records and aggregate state. That storage service has no public URL. Cloudflare handles reports and connection metadata. Commercial trial storage remains on Upstash, separate from app measurements.

Only aggregate reports go to PostHog. They contain counts in multiples of ten, group dates, milestones, batch identifiers, and format and test-environment labels. Individual report identifiers do not reach PostHog. We disable person profiles and location enrichment for these aggregate events. Ten contributions do not establish ten different people.

What the safeguards do not do

These safeguards reduce detail but do not guarantee anonymity. Hosting infrastructure handles source IP addresses and request timing, which can associate reports even without a stable identifier. The app delays reports and uses constant language and user-agent headers. Roadie’s collector does not add request bodies or client IP addresses to application logs. Aggregate app-measurement events exclude client IP addresses and are not joined to website, trial, or payment identities.

These measurements cannot show an individual’s journey from website visit to purchase. Missing reports do not prove uninstall, inactivity, or a reason for not buying. Small totals can be too imprecise to support a useful rate.

How the stop control works

The stop command creates an empty marker folder. Any file, folder, or symbolic link at that exact path disables these measurements. Roadie checks the marker before initializing measurements. If the marker exists, Roadie does not open measurement state, observe app activity for analytics, start analytics timers, or send app measurements. If Roadie cannot determine whether the marker exists, it also leaves these measurements off.

The change takes effect after you quit and reopen Roadie. Creating the marker while Roadie runs does not stop that running process. The marker does not erase previous measurements or change trial and license checks.

Turn the measurements back on

1. Quit Roadie.
2. Remove only the empty marker folder created by the stop command:

   rmdir "$HOME/Library/Application Support/Roadie/DisableAnonymousAnalytics"

3. Reopen Roadie.

The removal command leaves Roadie’s other files intact. If you used a different marker type, remove only that marker. Existing measurement state stays on your Mac. Its pending reports may resume after re-enabling, if they have not expired.

Limits and retention

Reports start after a random 5–60 minute delay. The app sends at most two requests per delivery cycle and six per UTC day. Collector limits permit at most 100 new contributions per UTC day, with 300 processing attempts per day and 60 per minute. These are shared service limits, not per-person allowances. Limits and expired retries can prevent reports from arriving.

The app keeps its measurement state on your Mac until that state is removed. Uninstalling Roadie may leave its Application Support files. Pending first-observation reports expire after 28 days. Other pending reports expire after seven days. Expired reports do not regenerate, and expired first-observation reports stop further reports from that state.

The collector accepts reports only before day 56 from their group date. Application reads ignore hashed duplicate-check records 70 days after first acceptance. Retries do not extend this period. Group counters and export records expire 112 days after the group date. Global request-budget records expire after two days without processing. Fixed operational counters expire after seven days without an update.

These are logical expiry limits. Scheduled cleanup tasks can run late or fail, which delays physical deletion. Expiry does not make retained data unreadable to raw-storage operators or immediately delete provider recovery history.

Our current PostHog Free plan uses a one-year query window for aggregate events. This query window is not a promise that PostHog physically deletes them after one year. Hosting providers can retain request and connection metadata under their own policies. A dashboard’s visible log window does not establish when every provider record is deleted. The provider policies are linked on the privacy page.