WhichClick
Start free trial

Platform

Measurement infrastructure for paid media.

From the first redirect to the last offline import, every component is built to keep your Google Ads campaigns compliant and your attribution defensible.

Click tracking

A redirect engine that passes Google's review on the first try.

The tracking endpoint is deliberately minimal: parse the visible next-hop parameter, validate it, append our click id, respond 302. Everything else happens asynchronously.

  • Visible url transparency parameter with u, redirect and dest accepted as aliases
  • force_transparent=true disables all backend-configured destinations
  • Handles single-, double- and triple-escaped {lpurl}, {lpurl+2}, {lpurl+3}
  • Rejects non-http(s) schemes and un-expanded macros with explicit 4xx responses
  • Bot and crawler classification on ingest; no cookies or JavaScript on the redirect path
  • Domain binding: links only resolve on their certified hostname or its CNAME

Attribution

Deterministic matching on your identifier or Google's.

Conversions are matched to clicks by `wc_click_id` first and `gclid` second. Every conversion stores the ValueTrack dimensions of the originating click for reporting.

  • Idempotent conversions keyed by order id + event name
  • Value and currency per event, multi-event funnels (lead, purchase, subscription)
  • gclid / gbraid / wbraid preserved for offline conversion import
  • Campaign, ad group, creative, keyword, match type, network, device, geo breakdowns

Postbacks & API

Server-to-server in both directions.

Receive conversions via a GET postback or a JSON API. Fan out to any number of downstream endpoints with templated URLs and full delivery logs.

  • Inbound: GET /postback?api_key=…&click_id=…&value=…
  • Inbound: POST /api/v1/conversions with a bearer API key
  • Outbound endpoint templates with {click_id}, {gclid}, {value}, {currency}, {event}
  • Delivery status codes, latency and errors retained for 90 days
  • Click export API for BI warehouses and offline import pipelines

Mobile attribution (MMP)

AppsFlyer-class install attribution, without the AppsFlyer invoice.

Native SDKs, smart links and an attribution waterfall that prefers deterministic signals and explains every match.

  • iOS (Swift Package), Android (Kotlin, Install Referrer) and React Native SDKs; web snippet
  • Waterfall: click id → Install Referrer → gclid → probabilistic (IP + OS, 24h) → SKAdNetwork → organic
  • Smart links route by OS to App Store / Play / web and carry a deferred deep-link path into the app
  • In-app events with revenue; session_start powers D1/D3/D7/D14/D30 retention cohorts
  • Google Ads App Conversion Tracking API forwarding (first_open, purchases)
  • SKAdNetwork 4 postback ingestion with per-app conversion value schema
  • Cost import (API / CSV) for CPI, ROAS, LTV payback per campaign
  • Re-attribution windows, hashed device ids only, no IDFA unless the app provides it
  • Self-attributing networks: Meta (Install Referrer decryption + Conversions API), TikTok Events API, Snap CAPI, Apple Search Ads AdServices
  • View-through attribution (impression API + VAST pixel), household attribution for CTV, linear TV spike attribution
  • Re-engagement attribution for deep-link re-opens, uninstall detection by silent push (APNs/FCM), reinstall tracking
  • Subscriptions (App Store Server Notifications v2, Google Play RTDN) and ad-revenue events (AdMob, MAX, ironSource)
  • Android Privacy Sandbox Attribution Reporting endpoints (register-source / register-trigger / reports)
  • 60+ partner postback templates and automatic cost sync from Google Ads, Meta, TikTok and Apple Search Ads

Grow

The decision layer: alerts, audiences, incrementality and an analyst that answers.

Measurement is only useful if it changes budgets. WhichClick ships the tools the big MMPs sell as add-ons.

  • Alerts: threshold and anomaly (z-score vs 14-window baseline) rules on any metric, to Slack / webhooks / email
  • Audiences: behavioural segments (events, revenue, retention, subscription state, fraud) → CSV, webhook, Meta / TikTok custom audiences
  • Geo-lift experiments with pre-period calibration and confidence; marketing-mix model with adstock and saturation
  • TV & CTV: VAST impression pixel, household matching, post-log spike attribution, CPI per network
  • Assistant: Claude-powered analyst with tool access to your overview, pivots, cohorts, protection and alerts

Click protection

ClickGuard-class defence, wired into the same click record.

Every paid click is scored in real time after the redirect is served, so protection never adds latency. Invalid clicks are excluded from attribution and pushed to Google Ads.

  • IP reputation: VPN, proxy, Tor exit nodes, datacenter / hosting ASNs (provider or built-in heuristics)
  • Automation: bot and headless user agents, WebDriver flag, missing Accept-Language, obsolete browsers
  • Consistency: ValueTrack device vs user agent, missing gclid on Google Search, geo mismatches
  • Frequency: per-IP hourly and daily caps, gclid replay, multi-campaign sweeps
  • Engagement verification via cs.js: dwell, scroll, interactions and canvas fingerprint reuse
  • Automatic IP exclusions in Google Ads (500 per campaign, oldest evicted) and emergency campaign pause
  • Burst detection opens incidents, fires webhook alerts (Slack, PagerDuty) and records mitigations
  • Refund-claim CSV with gclid, timestamp, IP type and reasons for Google's invalid activity review

Enterprise

Governance your security team will sign off on.

Multi-tenant by design, with the controls a procurement review expects.

  • Roles: Owner, Admin, Analyst, Viewer
  • Hashed API keys with prefix display and revocation
  • Immutable audit log for every configuration change
  • IP addresses hashed with a daily salt at ingest; raw IPs never stored
  • Private tracking domains, SSO and data residency on Enterprise