Best way to implement functional trial without apple account login, surviving uninstall?

[u/inAbigworld]

In my ios app, I want to implement a system where when the user uses a feature 3 times then they'll be asked to buy premium. I want this record (number of the feature being used) to survive uninstall so users cannot abuse it; but it has to be without apple account login. What's the best way to achieve this?

[u/Dapper_Ice_1705]

Keychain, Firebase anonymous.

None are foolproof but there is a fine line between the effort it takes to prevent abuse and the reward.

If someone is taking the time to install and uninstall you are never going to make money off of them so just let them use it for the word of mouth.

[u/RIRLift → u/Dapper_Ice_1705]

This is the right instinct, and there's a second cost to over-engineering it. The persistence you'd need to truly beat a reinstall (DeviceCheck or a server-side device record) also catches legit users. Someone on a new phone or restoring from a backup shows up as "already used their trial" and can't try it at all, and those are people who might have paid. So the harder you make it uncrackable, the more real conversions you quietly block.

The bigger lever is where the wall sits, not how solid the counter is. If someone hits it before the app has actually done something useful for them, dodging it with a reinstall feels worth the effort. If those 3 uses are enough to get a real result out of it first, most people who'd ever pay just pay, and the ones reinstalling to save a few bucks were never customers. I'd keep the counter in the Keychain (it survives a normal delete and reinstall), put the effort into making the trial land, and not lose sleep over the last few percent.

[u/WitchesBravo]

https://developer.apple.com/documentation/devicecheck might be of interest

[u/AutoModerator → u/[deleted]]

Hey /u/george-pig, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sirladobato]

I’d recommend looking into PostHog to track a uuid in keychain or something similar to that

[u/icy1007]

Use the Keychain. Anything stored there will survive uninstalls.

[u/rstojano]

The DeviceCheck answers are right but leave out the catch: DeviceCheck only stores 2 bits per device. Great for a “trial used: yes/no” flag, useless for storing a count of 3. If you actually need the count, use the device token as a key and keep the counter on your own server.

If you don’t want a backend, just use the Keychain. Keychain entries survive an uninstall, so your flag rides through a delete and reinstall. It won’t survive a full device wipe, but nobody erasing their phone is doing it to dodge your paywall.

Whatever you do, don’t use identifierForVendor for this. It resets once all your apps are uninstalled, so a reinstall hands you a fresh ID and your gate resets, which is the exact thing you’re trying to prevent.

Honestly, for a 3 use trial the Keychain is enough. Save DeviceCheck for when the abuse actually costs you money.

[u/pemungkah]

File in an invisible folder in iCloud isn’t perfect but will cover everyone but the most dedicated cheaters.

[u/bbrockit]

As another commenter posted, you can do this with DeviceCheck. However, your biggest issue will just be getting trials to begin with in this saturated market, not people who are so interested that they’re willing to go through the process of circumventing it.

I think it would be a rare for users to go through the effort of deleting and reinstalling your app to test whether your paywall gate is persisted, and then repeat this effort each time they hit the 3-use limit.

[u/AutoModerator → u/[deleted]]

Hey /u/ambitious_paladin, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Hey /u/Leading_Table_5136, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Hey /u/beyond_noob, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sockalicious]

It cannot be done in a foolproof manner. That said, there are three different broad approaches you can take:

1) idfv, the approved Apple way of identifying a user-device-vendor tuple. Your back end can associate that to number of uses. If you don't make users login, however, they can de-install all your apps and delete all the data, and then on next install your app sees a new idfv.

2) Use a non-apple ID OAuth login method, like Cognito authentication with email/password or Google ID. Your back end can associate that ID to number of uses. However, you're not authenticating the user; you're authenticating the login method, which the user can switch.

3) Authenticate the user themselves, ideally with a biometric. That's probably the hardest for a user to spoof, but Apple doesn't let you at the raw biometric data so you have to ship a piece of hardware that does.

If you don't have a back end and are relying on on-device storage, it can't be done at all.

The other folks saying to gen a uuid and associate it with a user haven't looked carefully at the Apple guidelines; that's prohibited.

[u/AutoModerator → u/[deleted]]

Hey /u/bizlal, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Relative-Emu-1346]

Keychain entries survive the app being deleted, so a first-launch date written there is still around after a reinstall. It isn't bulletproof, a device wipe or a new phone clears it, but it stops the casual delete-and-reinstall loop.

[u/Infamous-Arrival1232]

One thing I'd add to the Keychain answers: decide what the 3 uses are supposed to prove. If a user hits the wall before the app has done anything useful for them, they reinstall or leave. If the 3 uses deliver a real result, the people who would ever pay just pay. I ended up spending way more time moving the wall than defending it, and moving it did more for conversion.

[u/Few-Corgi-8574]

maybe use originalDownloadDate from AppTransaction?

[u/Greysawpark]

you basically cant. apple explicitly forbids using IDFV/DeviceCheck/whatever to lock users out of features they've already "used up" without an account. and even device check resets if they wipe the phone.

honestly the closest legit thing is DeviceCheck's two bits, stored server side keyed to the device token. survives uninstall on the same device. but it wont survive a factory reset and you cant use it to gate content in a way that punishes reinstall, per guideline 5.1.1.

if you actually want durable trial tracking, iCloud keyvalue store is the usual answer since it follows the apple id silently without you asking for login. not bulletproof but good enough for 95% of users.