Respectlytics Respect lytics
Menu
Kotlin (Android) No third-party trackers

How to add Kotlin (Android) analytics with no third-party trackers

The biggest hidden-PII surface in most analytics integrations is not the SDK you picked — it's the SDKs that SDK depends on transitively. A typical Firebase / AppsFlyer / Branch install pulls in dozens of advertising and attribution dependencies that read identifiers, contribute manifest permissions, and ship their own network calls. Respectlytics's Kotlin (Android) SDK has zero third-party tracker dependencies in its dependency tree. Below: how to verify, the supply-chain difference, and the FAQ.

Install the Kotlin (Android) SDK

kotlin Respectlytics
// build.gradle.kts (app module)
dependencies {
    implementation("com.respectlytics:respectlytics-kotlin:3.0.0")
}

Pure Kotlin coroutines implementation. No Java dependencies, no Google Play Services dependencies. ~300KB DEX overhead — compare to roughly 3.8MB for Firebase Analytics (a measurable cold-start improvement on lower-end devices).

Initialize Respectlytics in Kotlin (Android)

kotlin Respectlytics
import com.respectlytics.android.Respectlytics

class MyApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        Respectlytics.configure(this, appKey = "<YOUR_APP_KEY>")
    }
}

Initialize once in Application.onCreate. No additional permissions in the manifest — INTERNET is sufficient. The SDK does not request AD_ID, does not query AdvertisingIdClient, and does not declare ACCESS_NETWORK_STATE.

Privacy & implementation notes

Firebase Analytics on Android typically ships ~15–25 transitive dependencies, including ad-tech libraries (Google Mobile Ads, play-services-ads-identifier) that contribute permissions to the merged manifest. Most teams discover this only after Google Play flags the Data Safety form. Respectlytics's dependency-light architecture means the merged manifest doesn't grow.

A useful audit habit: search your build output for any User-Agent string emitted by SDKs you didn't intentionally install. Branch, AppsFlyer, Adjust, Singular, mParticle, and others emit identifiable User-Agents — if your build has them and you didn't add the SDK, something transitive pulled it in.

Many teams discover the com.google.android.gms.permission.AD_ID permission in their merged manifest only after Google Play flags them — usually because a transitive dependency dragged it in. Respectlytics's Kotlin SDK has no Google Play Services dependency at all, so it cannot contribute to that merge.

The SDK is implemented as pure Kotlin coroutines with no Java sources, no RxJava, and no platform channels. Events are queued in a Channel<Event> buffered to a small ring (RAM-only), drained by a coroutine that flushes every 30 seconds or on backgrounding. There is no SharedPreferences usage.

How this compares to other analytics SDKs

SDK supply chainFirebase AnalyticsMixpanelAppsFlyerRespectlytics
Direct ad/tracking dependenciesMany (FCM, Google Mobile Ads, …)FewMany (Branch, partner SDKs)Zero
Pulls Google Play ServicesYes (mandatory)NoYesNo
Adds `AD_ID` to merged manifestYes (auto)ConditionalYesNo
Network calls outside the analytics pathYes (FCM, Crashlytics, …)Yes (campaign tracking)Yes (referrer SDKs)No
Number of HTTP endpoints contacted5+2–33+1

Frequently asked questions

How do we verify the dependency tree?

On iOS: swift package show-dependencies (Swift Package Manager) lists the entire transitive tree. On Android: ./gradlew :app:dependencies --configuration releaseRuntimeClasspath shows everything in the release classpath. On RN: npm ls --all. On Flutter: flutter pub deps. Respectlytics's tree should be a single node with no children outside the standard library.

What about `URLSession` / `OkHttp` / `fetch`?

Those are platform standard libraries, not third-party trackers. They ship with the OS or the framework. Respectlytics uses them directly and doesn't introduce additional HTTP libraries on top.

Is open-sourcing the SDK enough to verify this?

Helpful but not sufficient. The dependency manifests (Package.swift, build.gradle, package.json, pubspec.yaml) are the authoritative source — those say what gets pulled at build time. Reading those is a 5-minute audit; reading the source is helpful for behavioral verification but not necessary for the dependency claim.

Are there any optional dependencies (Crashlytics-style) we'd need?

No. Respectlytics doesn't bundle crash reporting, push notification, feature flags, or experiments — those are separate concerns with their own SDKs (e.g., Sentry, OneSignal, GrowthBook). You can pair Respectlytics with whichever you need; we don't bundle them in to inflate the surface.

Related guides

Track what matters. Collect nothing you don't.

Five-field event schema, RAM-only event queue, no IDFA, no AAID, no persistent user IDs. Helps developers avoid collecting personal data in the first place.