Skip to content
FortressFlag Docs

Device identity and billing

FortressFlag bills per device, not per app: the model is that one phone running three of your apps is one seat, not three. This page explains the identity that makes that work, what it means for your bill, and the platform facts — including where the one-seat promise needs setup, and where it doesn’t hold yet — you’ll want to know before they show up in a number.

A seat is a monthly-active device

Section titled “A seat is a monthly-active device”

Your usage for a month is the number of distinct devices that asked for flags that calendar month (UTC), across all your environments and apps. A device that polls once counts once; a device that polls ten thousand times counts once. Efficient polling doesn’t inflate your bill, and quiet months cost less.

The identity is minted, not derived

Section titled “The identity is minted, not derived”

The first time one of your apps starts the SDK on a device, the SDK mints a random identifier — dev_ followed by 22 characters — and stores it on the device. That’s the whole identity:

  • Random, never derived. It’s not the advertising ID, not a hardware serial, not a hash of anything about your user. It can’t be reversed into a person, and it doesn’t link activity across different vendors’ apps. Under GDPR it’s a pseudonymous identifier — we treat it as personal data, and it’s designed to carry as little as an identifier can.
  • Stable per device. On iOS, your apps can share one identity through a shared keychain access group, so three of your apps on one iPhone count as one device — the per-device promise, kept by construction. On Android, identity is per app today: each of your apps mints its own, and counts separately.
  • Resettable. Every SDK exposes a reset that deletes and re-mints the identity — the erasure path for the identifier. The honest consequence: after a reset, the device counts as a new one.

Simulators are served, never billed

Section titled “Simulators are served, never billed”

Builds running in a simulator or emulator mint a sim_ identity instead. FortressFlag serves them flags exactly like real devices and excludes them from metering entirely — your team’s simulators, your CI, and your automated browser tests never cost you a seat. (On the web, an automated browser announcing itself via navigator.webdriver gets a sim_ identity — your Playwright and Cypress suites are covered.)

Your Usage screen shows the daily ratio of real to simulator traffic, so a misconfigured build that’s billing simulators as devices — or hiding devices as simulators — is visible, not silent.

Platform facts, stated plainly

Section titled “Platform facts, stated plainly”

Each platform stores the identity as durably as the platform allows, and no platform allows forever. These are the consequences you’ll actually observe:

  • iOS: the identity lives in the keychain and survives app uninstalls. It’s never synced to iCloud — an identity that rode a backup onto a second iPhone would bill one device as two.
  • Android: the identity is wiped when your app is uninstalled — reinstalling mints a new identity, which is a new billable device. A platform fact, priced in.
  • Web: the identity lives in the browser’s origin-scoped storage. A private/incognito window mints a throwaway identity that counts as a device for that session, and a user clearing site data is a new device. Also: one person using your website, iOS app, and Android app is up to three devices — one per platform. There’s no cross-platform linkage, by design.

The trial, and what happens at the edge of it

Section titled “The trial, and what happens at the edge of it”

Every trial includes 1,000 monthly-active devices, and trials never expire by time — you can evaluate for as long as you need. If a month’s device count grows past the tier, enforcement arrives in stages, never as a cliff:

  1. Right away: a banner in the dashboard for everyone on your team.
  2. After 14 days over: the dashboard becomes read-only — flags keep serving, you just can’t change things until you buy or usage drops.
  3. After 28 days over: devices beyond the first 1,000 receive flag defaults. The first 1,000 devices keep real values throughout — your earliest users are never the ones degraded.

Buying the paid plan clears all of it instantly.

What we keep, and for how long

Section titled “What we keep, and for how long”

Metering needs to count distinct devices, so raw device identifiers are kept for 13 months — enough for a year of usage history plus the month in flight — then dropped. Your Usage screen shows the current period and 12 months of history. What crosses to our payment processor is device counts, never device identifiers.

Where to next

Section titled “Where to next”