Mosaic turns on-device location and Wi-Fi signal into queryable population datasets via a single API. The SDK does the privacy math on the device — H3 Res-10 binning (~150m cells), Apache Theta Sketches (k=4096), 24h ephemeral IDs — so raw GPS never reaches our servers, let alone yours.
Drop the SDK into your app. Identifiers are hashed on-device, aggregates ship to our pipeline, and we share revenue on the cleared output. The privacy posture moves to us, in code.
Query foot traffic, audience reach, and competitive share through one API. Every result is pre-aggregated and ships with panel composition and confidence intervals — so legal signs off and analysts trust the answer.
The SDK collects opt-in location events inside the publisher's app. Identifiers are k-hashed on-device. No raw device IDs ever leave the phone.
Hashed events land in Mosaic. We bucket them into H3 hex cells, audience segments, and category counts before anything is queryable.
Identifier graphs are dropped, opt-out syncs within minutes, and every aggregate carries panel composition and a confidence interval.
Customers query the result through typed SDK, REST, or SQL. The smallest unit they ever receive is a cell, segment, or count — never a path, never a person.
Daily visit counts, dwell time, and trade-area shape for any place or chain in the country. Refresh daily, not next quarter.
Most location SDKs collect first and ask later. Mosaic inverts the order — identifiers are hashed before they leave the device (H3 Res-10 + Theta Sketches, k=4096) and only aggregates ever land server-side. You ship one library; we carry the legal posture.
ATT-compliant prompt, GDPR + CCPA notice, and a user-facing audit screen — themed to your app, not a generic modal.
k-anonymous hashing happens before any payload is composed. No raw MAID or location string ever crosses the wire.
Per-aggregate accounting. You can reconcile your statement against the rolled-up cells we sold.
Open changelog, signed releases, and a public threat model. We document what we drop, not just what we keep.
Most location feeds were built on raw device records, then patched with policy. Mosaic was built the other way around — we ship aggregates because aggregates are all the pipeline ever holds.
App partners integrate the SDK to capture opt-in signals. Customers access the same data model via typed client, REST API, or direct warehouse query. Every response carries panel composition and a confidence interval — so you can show your work.
// Customer query: POI visitation for an H3 cell, last 7 days
const res = await fetch(
"https://api.mosaicsdk.com/v1/analytics/poi-visitation?" +
new URLSearchParams({
h3_index: "8a2a1072b59ffff",
date_from: "2026-04-24",
date_to: "2026-04-30",
consent_tier: "all",
}),
{ headers: { Authorization: "Bearer $MOSAIC_TOKEN" } }
);
const data = await res.json();
// { h3_index, visits, panel_size, ci_low, ci_high }We can't leak what we never held. Identifiers are hashed on-device inside the SDK, aggregated inside our perimeter, and shipped as counts at the API — never paths, never device IDs.
Read the privacy whitepaperTell us whether you're embedding the SDK or querying the API. We'll route you to the right team and the smallest, cleanest version of the answer.
Drop the SDK in, ship the consent flow, share revenue on cleared aggregates.
Talk to publisher relationsFoot traffic, audience reach, competitive share — aggregates only, panel + CI on every response.
Talk to our data team