Reconstruction

When an install arrives with no readable receipt and no handoff token, CLItrail can still find the visit it most likely came from, using the public network and other signals the visit and the install share. Such a match is never proof: it is always labelled probable, with its confidence and the signals behind it.

#When it runs

On the Standard and Enterprise plans, on by default for every website. Turn it off, or choose its window (24 hours, 3 days, the default, or 7 days), in Settings → Attribution.
Only for installs with no valid receipt and no handoff token. An invalid or expired handoff token is recorded as unattributed; it never falls back to reconstruction.
Never on Free, and never for installs on a paused install path.

#What it compares

While reconstruction is on, each visit keeps a few signals until its window ends: keyed hashes of its public network (the exact IPv4 address or IPv6 /64, and the IPv4 /24) and of its User-Agent, plus its OS family, time zone, language and CPU architecture where the browser tells. An install brings the matching facts from the hook’s report. Candidates are the visits of the same website on the same network within the window; each gets an additive score:

Signal	Points
Same exact network (required, or the weaker /24)	+40, or +10 for the same IPv4 /24 only
Recency: newer visits score more, falling to 0 at the window’s end	up to +20
Same OS family	+15, or −15 when they differ (0 for a phone visit)
Same time zone	+10, or −15
Same primary language	+5, or −10
The visit’s browser is present on the installing machine	+10, or −10
Same CPU architecture	+5, or −10
The visit already credited another installation on the same install path	−15
Each extra browser seen on the network in the window	−10

A match needs the network and at least one corroborating signal (OS, time zone, language, browser or architecture) that agrees, and a score of 50 or more.
Confidence is high at 75 or more when the network is exact, the OS family matches and no signal disagrees; otherwise medium. A /24-only match is never high.
When more than three different browsers visited from the network in the window, it looks like an office, a campus or a mobile carrier, and nothing matches.
The best corroborated candidate wins: the higher score, then the more recent visit. Without one, the install stays unattributed.

The install is recorded with resolution probable and method reconstructed, and its detail keeps the score, the window and the list of signals, which the dashboard shows as “why”.

#Where reconstructed installs appear

The dashboard counts them apart from attributed installs, in every total and chart, and shows their confidence and signals.
GA4 and the ad platforms receive them only from destinations with Include reconstructed installs turned on. It is off by default.
Webhooks receive every install, with resolution: "probable", the confidence and the signals.

#Privacy

Raw IP addresses are never stored. The address is used for the keyed hashes and for rate limits, then dropped.
The hashes cannot be compared across websites: the key is specific to your website and to the service’s encryption key.
Every signal stops matching when its window ends and is deleted within about a minute after that. Turning reconstruction off, or moving to Free, deletes them all.
A shared network is not proof of the same person. Mention it in your website’s privacy notice.