Visitor IDs, Confidence and Returning Visitors

Every identification returns a visitor_id: a stable identifier for the device, resolved by the server. The same device returns the same visitor ID on its next visit, whether or not it kept its cookies.

The visitor ID

Twenty letters and digits, such as X9pL2mRc7KvT4bQw8NdF. Treat it as an opaque string.
Issued by Fingerly and never derived from the device's data, so it reveals nothing about the device.
Scoped to your organization. The same device on another customer's site has a different visitor ID. Visitor IDs cannot be used to follow people across companies.
The same across your development, staging and production keys.
Always present on a successful identification.

In browsers, the ID is designed to survive the changes devices go through: browser and operating system updates, new fonts, a different monitor, travel between networks.

In apps

In an iOS or Android app, including React Native, Flutter and Lynx apps, Fingerly recognises the device only by the random install ID the SDK stores, never by its hardware. The device signals are used for integrity checks and the score. So in apps:

visitor_confidence is 100 for an install seen before and 0 for a new one. There is no partial match.
On iOS the install ID survives the app being deleted, so a reinstall on the same device keeps its visitor ID.
On Android the install ID is removed with the app and never restored from a backup, so a reinstall gets a new visitor ID.
Calling deleteStoredIdentity() starts a new visitor ID on the next identification. See account deletion and erasure.

Visitor confidence

visitor_confidence says how the ID was reached, from 0 to 100.

Value	Meaning	How to treat it
`100`	This exact device has been seen before.	A confident returning visitor.
`85` to `99`	Recognised after the device changed, such as after an update.	A returning visitor. Lower values mean more change.
`0`	Nothing matched, so a new visitor ID was issued.	A new visitor, or one Fingerly could not recognise.

New visitors

visitor_is_new is true the first time your organization sees a visitor. Use it for new-account and first-purchase decisions, such as whether a welcome offer should apply.

When a device cannot be identified

Some browsers and clients give away almost nothing, whether through hardened privacy settings or deliberately. When there is too little to identify anyone, the response has identifiable: false:

A fresh visitor ID is issued each time, so these clients appear as a stream of new visitors. Do not count them as returning or unique.
The request is still scored, and the fingerprint_suppressed signal is added.
A production request that is not identifiable costs $0.0005 instead of the identification price.

Using visitor IDs

Pattern	Example
Limit accounts per device	Refuse a fifth sign-up from one visitor ID in a day.
Recognise a returning customer	Skip a second factor for a known visitor with confidence `100` on their usual account.
Link accounts that share a device	Store the visitor ID with each account, and review accounts that share one.
Enforce one-per-customer offers	Allow one promotion redemption per visitor ID.