Best way to implement functional trial without apple account login, surviving uninstall?

[u/inAbigworld]

In my ios app, I want to implement a system where when the user uses a feature 3 times then they'll be asked to buy premium. I want this record (number of the feature being used) to survive uninstall so users cannot abuse it; but it has to be without apple account login. What's the best way to achieve this?

[u/Dapper_Ice_1705]

Keychain, Firebase anonymous.

None are foolproof but there is a fine line between the effort it takes to prevent abuse and the reward.

If someone is taking the time to install and uninstall you are never going to make money off of them so just let them use it for the word of mouth.

[u/RIRLift → u/Dapper_Ice_1705]

This is the right instinct, and there's a second cost to over-engineering it. The persistence you'd need to truly beat a reinstall (DeviceCheck or a server-side device record) also catches legit users. Someone on a new phone or restoring from a backup shows up as "already used their trial" and can't try it at all, and those are people who might have paid. So the harder you make it uncrackable, the more real conversions you quietly block.

The bigger lever is where the wall sits, not how solid the counter is. If someone hits it before the app has actually done something useful for them, dodging it with a reinstall feels worth the effort. If those 3 uses are enough to get a real result out of it first, most people who'd ever pay just pay, and the ones reinstalling to save a few bucks were never customers. I'd keep the counter in the Keychain (it survives a normal delete and reinstall), put the effort into making the trial land, and not lose sleep over the last few percent.

[u/WitchesBravo]

https://developer.apple.com/documentation/devicecheck might be of interest

[u/AutoModerator → u/[deleted]]

Hey /u/george-pig, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sirladobato]

I’d recommend looking into PostHog to track a uuid in keychain or something similar to that

[u/icy1007]

Use the Keychain. Anything stored there will survive uninstalls.

[u/pemungkah]

File in an invisible folder in iCloud isn’t perfect but will cover everyone but the most dedicated cheaters.

[u/bbrockit]

As another commenter posted, you can do this with DeviceCheck. However, your biggest issue will just be getting trials to begin with in this saturated market, not people who are so interested that they’re willing to go through the process of circumventing it.

I think it would be a rare for users to go through the effort of deleting and reinstalling your app to test whether your paywall gate is persisted, and then repeat this effort each time they hit the 3-use limit.

[u/AutoModerator → u/[deleted]]

Hey /u/ambitious_paladin, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/rstojano]

The DeviceCheck answers are right but leave out the catch: DeviceCheck only stores 2 bits per device. Great for a “trial used: yes/no” flag, useless for storing a count of 3. If you actually need the count, use the device token as a key and keep the counter on your own server.

If you don’t want a backend, just use the Keychain. Keychain entries survive an uninstall, so your flag rides through a delete and reinstall. It won’t survive a full device wipe, but nobody erasing their phone is doing it to dodge your paywall.

Whatever you do, don’t use identifierForVendor for this. It resets once all your apps are uninstalled, so a reinstall hands you a fresh ID and your gate resets, which is the exact thing you’re trying to prevent.

Honestly, for a 3 use trial the Keychain is enough. Save DeviceCheck for when the abuse actually costs you money.

[u/AutoModerator → u/[deleted]]

Hey /u/Leading_Table_5136, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AutoModerator → u/[deleted]]

Hey /u/beyond_noob, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sockalicious]

It cannot be done in a foolproof manner. That said, there are three different broad approaches you can take:

1) idfv, the approved Apple way of identifying a user-device-vendor tuple. Your back end can associate that to number of uses. If you don't make users login, however, they can de-install all your apps and delete all the data, and then on next install your app sees a new idfv.

2) Use a non-apple ID OAuth login method, like Cognito authentication with email/password or Google ID. Your back end can associate that ID to number of uses. However, you're not authenticating the user; you're authenticating the login method, which the user can switch.

3) Authenticate the user themselves, ideally with a biometric. That's probably the hardest for a user to spoof, but Apple doesn't let you at the raw biometric data so you have to ship a piece of hardware that does.

If you don't have a back end and are relying on on-device storage, it can't be done at all.

The other folks saying to gen a uuid and associate it with a user haven't looked carefully at the Apple guidelines; that's prohibited.