Measuring mobile behaviour without ever seeing your apps
The brief required centralised mobile analytics without exposing identifiable app usage. I joined as the Backend Infrastructure Engineer and later built the Android app, backend and analytics dashboard independently.
Role
Backend Infrastructure Engineer
Organisation
CSE Connect
Industry
Mobile · Privacy · Analytics
Focus
Android · Backend · Dashboard
/ Problem
The project began as an industry programme where our team explored how Android usage data could support behavioural analytics.
I joined as the Backend Infrastructure Engineer.
The challenge became obvious quickly. A central server needs enough information to understand behaviour, but sending exact package names would reveal precisely which applications somebody uses.
The programme ended while we were still gathering requirements, before implementation began. I later returned to the brief and built the full system myself.
The question guiding the architecture became:
How much useful behaviour can the server understand without knowing which apps created it?
/ Solution
App identity is removed on the phone before anything reaches the backend.
Package names are transformed using HMAC-SHA256 with a per-user secret that never leaves the device. This prevents the server from reversing common package names or correlating the same app across different users.
But the analytics still needed useful categories.
So the phone identifies the app category before anonymisation.
The phone can know Instagram, two hours. The server only needs to know Social, two hours.
Retention is also enforced at three levels: local Android pruning, MongoDB TTL indexes and backend query cutoffs.
The result is a system that can measure patterns, categories and anomalies without the server ever receiving readable application identities.
/ What I learned
Privacy becomes meaningful when it changes what the system is technically capable of doing.
The backend does not avoid displaying app names because of a policy or interface decision. It never receives them.
That distinction changed how I think about privacy engineering.
The strongest guarantee is often not telling a system what it should avoid doing. It is designing the architecture so the sensitive action is impossible in the first place.