LGPD · Legitimate interest assessment

Anonymous usage measurement

How Compre Barato Alagoas estimates how many people use the app, anonymously and in aggregate, and why that is lawful under the LGPD.

← Back to documentation

This document is the legitimate interest assessment (LIA) expected by the ANPD for audience measurement. Keep it accurate as the code evolves.

Purpose

We want to know how many distinct people use the app per day, how often, and at which times, so we can prioritize improvements and size infrastructure. This is audience measurement — not advertising, not personalized recommendations, not selling data.

Legal basis

Legitimate interest (LGPD, Art. 7, IX and Art. 10). Per the ANPD Guidance Guide: Cookies and Personal Data Protection, audience measurement may rely on legitimate interest when it runs in a restricted configuration. We meet every condition of that configuration (below).

Data processed and minimization

The app generates a measurement-only random identifier (frontend/lib/data/analytics_id.dart, key analytics_id_v1 in shared_preferences). It is separate from the device identity token (the one used for "save to the cloud") and is never linked to the user's lists, location, or any identity.
It contains no name, email, phone number, or other direct identifier.
It is sent in the X-Analytics-Id header only on searches, and only when measurement is enabled.
On the server, the id is salted and added to a HyperLogLog (a probabilistic structure that stores only a cardinality — a number). There is no per-device record, no row that can be recovered for an individual.
IP address does not enter measurement data.

Anonymized result (Art. 12)

What is stored is only an aggregate total (estimated unique devices per period). Aggregation is a recognized anonymization technique; the result is not reversible by reasonable means and is therefore not personal data (Art. 12). The Art. 12, §2 exception (behavioral profiling) does not apply: we do not build profiles.

Restricted configuration (conditions met)

Aggregated data only — HyperLogLog stores counts, not trails.
No user profiling.
No combination with other trackers or databases.
No sharing with third parties — self-hosted Redis.
No IP in measurement data.

Necessity and proportionality

There is no less invasive way to deliver unique-device counts and retention: a stable per-device id is the minimum needed to distinguish "same device returned" from "new device". User expectation is compatible (basic usage measurement on a free app), impact is minimal (anonymized data, no profile), and safeguards are clear (id separation, opt-out, anonymization).

Data subject rights and opt-out (Art. 18, §2)

Measurement can be turned off at any time in Settings → "Anonymous usage statistics". When turned off, the app stops sending the id and forgets the identifier locally. Because the stored result is already anonymized, there is no individual record to delete on the server.

Transparency

This measurement is described in plain language in the Privacy Policy (section "Anonymous usage measurement"), matching the in-app privacy screen.

References

LGPD — Art. 7, IX and Art. 10 (legitimate interest); Art. 12 (anonymized data); Art. 18, §2 (objection/opt-out).
ANPD — Guidance Guide: Cookies and Personal Data Protection (audience measurement in restricted configuration).