Replace Kochava: fewer SDKs

Q: How do we audit our current dependency tree?

iOS: `swift package show-dependencies` (SPM) or `pod outdated` (CocoaPods) lists the tree. Android: `./gradlew :app:dependencies --configuration releaseRuntimeClasspath`. RN: `npm ls --all`. Flutter: `flutter pub deps`. Our [Dependency Privacy Scanner](/tools/dependency-privacy-scanner/) parses lockfiles from any of these and tells you which deps are forcing which privacy labels.

▸Example Kochava call (the "before")

swift Respectlytics

import KochavaTracker

KochavaTracker.shared.registerWithAppGUID("YOUR_APP_GUID")

let event = KochavaEvent(eventTypeEnum: .purchase)
event.appStoreReceiptBase64EncodedString = receiptBase64
event.priceDoubleNumber = NSNumber(value: price)
event.currencyString = "USD"
event.userIdString = userId
KochavaTracker.shared.send(event: event)

Every third-party SDK is a supply-chain surface — manifest permissions, network endpoints, transitive dependencies. The biggest reduction in privacy footprint often comes from simply shipping fewer SDKs. Respectlytics has zero ads, attribution, or routing dependencies — it's one HTTPS endpoint.

☑Remove Kochava cleanly

1
Remove pod 'KochavaTracker' from Podfile
2
Remove implementation 'com.kochava.tracker:tracker:...' from build.gradle
3
Remove react-native-kochava-tracker from package.json if used
4
Remove KochavaTracker.shared.registerWithAppGUID(...) and sendEvent(...) call sites
5
Remove NSUserTrackingUsageDescription from Info.plist if Kochava was the only ATT-needing SDK
6
Remove AD_ID permission from the merged Android manifest if no remaining SDK contributes it

⇋Kochava vs Respectlytics — fewer third-party sdks

	Kochava	Respectlytics
Direct ad / tracking dependencies	— see tool note above	Zero
Pulls Google Play Services	— typically yes	No
Auto-merged manifest permissions	Often (AD_ID, ACCESS_NETWORK_STATE, etc.)	None added
Number of HTTP endpoints contacted	Multiple (varies)	One (Respectlytics API)
Open-source SDK	— varies by tool	Yes (MIT-licensed)

❓Frequently asked questions

How do we audit our current dependency tree?

iOS: swift package show-dependencies (SPM) or pod outdated (CocoaPods) lists the tree. Android: ./gradlew :app:dependencies --configuration releaseRuntimeClasspath. RN: npm ls --all. Flutter: flutter pub deps. Our [Dependency Privacy Scanner](/tools/dependency-privacy-scanner/) parses lockfiles from any of these and tells you which deps are forcing which privacy labels.

What if we still need install attribution?

First-party alternatives without an SDK: Apple SKAdNetwork (iOS), AdAttributionKit (iOS 17.4+), Google Play Install Referrer API (Android). These are built into the OS — your ads platform reads them directly. No mobile SDK required.

What about crash reporting and push notifications?

Those are separate concerns with their own SDKs — Sentry / Crashlytics / Bugsnag for crashes; OneSignal / FCM / APNs for push. Respectlytics doesn't bundle them in; you pick the dedicated SDK for each surface.

Does shipping fewer SDKs measurably improve app size or cold start?

Often, yes — measurably. Removing Firebase + AppsFlyer + Segment from a typical RN app can shave several megabytes of bundle and 100-300ms off cold start. See the [SDK Bundle-Size Comparator](/tools/sdk-bundle-size-comparator/) for specific numbers.

⇢Related migration guides

Replace Kochava: no att prompt Same tool, No ATT prompt Replace Kochava: no pii collected Same tool, No PII collected Replace Kochava: no phi collected Same tool, No PHI collected Replace Kochava: 5-field event schema Same tool, 5-field event schema Replace Kochava: ram-only event queue Same tool, RAM-only event queue Replace Kochava: smaller app binary Same tool, Smaller app binary Replace Kochava: faster cold start Same tool, Faster cold start Replace Kochava: eu data residency Same tool, EU data residency Replace Kochava: self-hosted deployment Same tool, Self-hosted deployment Replace Kochava: open-source sdk + server Same tool, Open-source SDK + server Replace Firebase Analytics: fewer third-party sdks Same outcome, Firebase Analytics Replace Google Analytics for Firebase: fewer third-party sdks Same outcome, Google Analytics for Firebase

Replace Kochava to ship fewer third-party SDKs