Observed behavior versus documented behavior
This page separates two kinds of claim. Observed behavior is what Attribloom's own runtime does and what we have exercised directly against the public API. Documented behavior is what Apple and Shopify state in their platform documentation, which we rely on but do not control.
Where a claim is about our runtime, it maps to an operation in the public OpenAPI contract. Where a claim is about a platform, it maps to that platform's own documentation. We do not present a documentation-derived claim as something we have observed.
iOS: StoreKit 2 and App Store Server Notifications v2
On iOS, Attribloom issues an appAccountToken, a UUID your app binds to the StoreKit 2 purchase. Apple returns that token on the signed transaction and on App Store Server Notifications v2, which lets Attribloom confirm an attributed purchase and eligible renewals server-side.
What Attribloom observes directly: the bind, purchase, and forwarded-notification operations in the runtime contract. What we rely on from Apple's documentation: that the appAccountToken is preserved on the transaction and on server notifications, and the renewal notification semantics. Those are documented Apple behaviors, not Attribloom internals.
Shopify: validated codes and preserved referral
On Shopify, a paid order is attributed through a validated affiliate discount code or a referral preserved in a Shopify cart attribute, confirmed against Shopify order and checkout webhooks.
What Attribloom observes directly: the conversion and refund operations in the runtime contract. What we rely on from Shopify's documentation: the order and webhook payload shapes and cart attribute preservation.
The no-fingerprinting boundary
Attribloom does not use device fingerprinting, and iOS attribution does not depend on a browser cookie surviving the App Store handoff. Device fingerprinting for tracking is disallowed by Apple, and probabilistic fingerprinting is not part of this design.
Attribution is deterministic: an Attribloom-issued token on the StoreKit 2 purchase, a validated Shopify code or preserved referral, or an HMAC-signed server postback for custom checkouts. If none of those signals is present, a conversion is not attributed rather than guessed.
The public contract
Every runtime claim on this site maps to the public OpenAPI 3.1 contract, which defines the conversion, refund, App Store bind, deferred bind, and signed notification operations. Use it as the authoritative description of the runtime behavior Attribloom controls.