Analytics privacy: keep PII and financials off PostHog

__tests__/analytics.test.ts

@@ -0,0 +1,18 @@
+import { priceBucket } from "@/lib/analytics";
+
+describe("priceBucket", () => {
+  it("bands monthly amounts without exposing exact values", () => {
+    expect(priceBucket(2.99)).toBe("under_5");
+    expect(priceBucket(9.99)).toBe("5_15");
+    expect(priceBucket(15)).toBe("15_50");
+    expect(priceBucket(49.99)).toBe("15_50");
+    expect(priceBucket(77.49)).toBe("50_plus");
+  });
+
+  it("handles boundaries and invalid input", () => {
+    expect(priceBucket(5)).toBe("5_15");
+    expect(priceBucket(50)).toBe("50_plus");
+    expect(priceBucket(0)).toBe("unknown");
+    expect(priceBucket(NaN)).toBe("unknown");
+  });
+});

app/(tabs)/index.tsx

@@ -8,6 +8,7 @@ import images from "@/constants/images";
 import { useCurrency } from "@/context/CurrencyContext";
 import { useSubscriptions } from "@/context/SubscriptionsContext";
 import "@/global.css";
+import { priceBucket } from "@/lib/analytics";
 import { getDaysUntilRenewal, getMonthlyEquivalent } from "@/lib/billing";
 import { formatCurrency } from "@/lib/utils";
 import { useClerk, useUser } from "@clerk/expo";
@@ -84,14 +85,19 @@ export default function App() {
 
   const handleCreate = (draft: SubscriptionDraft) => {
     const created = addSubscription(draft);
+    // Non-identifying signal only: no name, no exact price, no currency.
     posthog.capture("subscription_created", {
       subscription_id: created.id,
-      name: created.name,
-      price: created.price,
-      currency: created.currency ?? "USD",
       billing_cycle: created.billingCycle ?? "monthly",
       category: created.category ?? "Uncategorized",
       is_trial: !!created.isTrial,
+      price_bucket: priceBucket(
+        getMonthlyEquivalent(
+          created.price,
+          created.billingCycle ?? "monthly",
+          created.customIntervalDays,
+        ),
+      ),
     });
   };
 

app/(tabs)/settings.tsx

@@ -2,11 +2,14 @@ import PickerSheet, { type PickerItem } from "@/components/PickerSheet";
 import { CURRENCY_CODES, currencyName } from "@/constants/currencies";
 import { useCurrency } from "@/context/CurrencyContext";
 import images from "@/constants/images";
+import { getKv, setKv } from "@/db/subscriptionsRepo";
+import { ANALYTICS_OPTOUT_KEY } from "@/lib/analytics";
 import { useClerk, useUser } from "@clerk/expo";
 import dayjs from "dayjs";
 import { styled } from "nativewind";
+import { usePostHog } from "posthog-react-native";
 import { useState } from "react";
-import { Image, Pressable, ScrollView, Text, View } from "react-native";
+import { Image, Pressable, ScrollView, Switch, Text, View } from "react-native";
 import { SafeAreaView as RNSafeAreaView } from "react-native-safe-area-context";
 
 const CURRENCY_ITEMS: PickerItem[] = CURRENCY_CODES.map((code) => ({
@@ -20,7 +23,21 @@ const Settings = () => {
   const { signOut } = useClerk();
   const { user } = useUser();
   const { baseCurrency, setBaseCurrency } = useCurrency();
+  const posthog = usePostHog();
   const [showCurrencyPicker, setShowCurrencyPicker] = useState(false);
+  const [analyticsEnabled, setAnalyticsEnabled] = useState(
+    () => getKv(ANALYTICS_OPTOUT_KEY) !== "1",
+  );
+
+  const toggleAnalytics = (enabled: boolean) => {
+    setAnalyticsEnabled(enabled);
+    setKv(ANALYTICS_OPTOUT_KEY, enabled ? "0" : "1");
+    if (enabled) {
+      posthog.optIn();
+    } else {
+      posthog.optOut();
+    }
+  };
 
   const displayName = user?.firstName || user?.fullName || user?.emailAddresses[0]?.emailAddress?.split("@")[0] || "User";
   const email = user?.emailAddresses[0]?.emailAddress || "No email";
@@ -80,6 +97,18 @@ const Settings = () => {
               {baseCurrency} · {currencyName(baseCurrency)} ▾
             </Text>
           </Pressable>
+
+          <View className="flex-row items-center justify-between py-2 border-t border-border/50 mt-2 pt-4">
+            <View className="flex-1 pr-3">
+              <Text className="text-sm font-sans-medium text-muted-foreground">
+                Share anonymous analytics
+              </Text>
+              <Text className="text-xs font-sans-medium text-muted-foreground/70 mt-0.5">
+                Usage only — never your subscription names, amounts, or email.
+              </Text>
+            </View>
+            <Switch value={analyticsEnabled} onValueChange={toggleAnalytics} />
+          </View>
         </View>
 
         <View className="mt-10">

app/_layout.tsx

@@ -9,12 +9,23 @@ import { PostHogProvider, usePostHog } from "posthog-react-native";
 
 import { CurrencyProvider } from "@/context/CurrencyContext";
 import { SubscriptionsProvider } from "@/context/SubscriptionsContext";
+import { getKv } from "@/db/subscriptionsRepo";
+import { ANALYTICS_OPTOUT_KEY } from "@/lib/analytics";
 
 SplashScreen.preventAutoHideAsync();
 
 function PostHogUserIdentifier() {
   const posthog = usePostHog();
   const { isLoaded, isSignedIn, user } = useUser();
+
+  // Apply the persisted analytics opt-out on launch (before any capture).
+  useEffect(() => {
+    if (getKv(ANALYTICS_OPTOUT_KEY) === "1") {
+      posthog.optOut();
+    } else {
+      posthog.optIn();
+    }
+  }, [posthog]);
   // Tracks the previous auth state so we only capture on real transitions.
   // `null` means "not yet known" (initial mount), which must not count as a
   // sign-in/sign-out event (e.g. reopening the app while already signed in).
@@ -26,15 +37,10 @@ function PostHogUserIdentifier() {
     }
 
     if (isSignedIn && user) {
-      const properties: Record<string, string> = {};
-      const email = user.primaryEmailAddress?.emailAddress;
-      if (email) {
-        properties.email = email;
-      }
-      if (user.fullName) {
-        properties.name = user.fullName;
-      }
-      posthog.identify(user.id, properties);
+      // Identify by the opaque Clerk id only. PII (email/name) intentionally
+      // stays out of analytics — it lives in Clerk (auth) and, later, the
+      // marketing list. PostHog holds behavior keyed to this id.
+      posthog.identify(user.id);
 
       // Fire only on a genuine signed-out -> signed-in transition.
       if (wasSignedIn.current === false) {

app/subscriptions/[id].tsx

@@ -102,11 +102,9 @@ const SubscriptionDetail = () => {
   const isPaused = subscription.status === "paused";
   const isCancelled = subscription.status === "cancelled";
 
+  // Opaque id only — no subscription name in analytics.
   const captureStatus = (event: string) =>
-    posthog.capture(event, {
-      subscription_id: subscription.id,
-      name: subscription.name,
-    });
+    posthog.capture(event, { subscription_id: subscription.id });
 
   const handleEdit = (draft: SubscriptionDraft) => {
     updateSubscription(subscription.id, draft);

lib/analytics.ts

@@ -0,0 +1,17 @@
+/**
+ * Coarse, non-identifying spend bucket for analytics. We never send exact
+ * amounts to analytics — only which band a subscription falls into — so we
+ * keep pricing insight without exposing a user's actual financials.
+ *
+ * @param monthly - monthly-equivalent amount in the user's base currency.
+ */
+export const priceBucket = (monthly: number): string => {
+  if (!Number.isFinite(monthly) || monthly <= 0) return "unknown";
+  if (monthly < 5) return "under_5";
+  if (monthly < 15) return "5_15";
+  if (monthly < 50) return "15_50";
+  return "50_plus";
+};
+
+/** kv flag key for the analytics opt-out preference. */
+export const ANALYTICS_OPTOUT_KEY = "analytics_optout";