Key findings
- People arrived with different intentions, but the app did little to tell them apart.
- Permission requests appeared before the product had explained why they mattered.
- The payment request was disconnected from the first useful result.
- Engagement was a poor substitute for service health.
More free users upgrading.
The number they watched most, app opens, couldn’t tell happy customers from lost ones.
At a glance
The product was a consumer security app with a free scanner and paid protection. We covered onboarding, permission requests, the first useful scan, the payment decision and the measures used to judge subscription performance. Our role connected research, product experimentation and customer communications.
The central question was whether the app helped people solve the problem that brought them to it, and whether that value lasted beyond the first conversion. We treated refunds, renewal and store ratings as part of the decision, not as problems for a later team.
The brief
The client asked us to rebuild onboarding so that more free users upgraded. Trial starts and weekly activity were the familiar success measures. Those measures made the first screens look like the obvious place to intervene: explain the benefits better, get people through setup and encourage another visit.
But a security product is unusual. Someone can receive its value without opening it, while someone else can open it repeatedly because they are worried or confused. Before deciding which screens to change, we examined the assumptions behind the brief. More activity would only be useful if it represented better protection or a clearer understanding of the service.
Why the problem extended beyond onboarding
Many people arrived after a specific trigger: a suspicious message, an unexpected pop-up, a slow device or a breach alert. They were looking for an answer, not a product tour. A free scan could answer their immediate question and remove the reason to pay before the subscription offer had become relevant.
That created a business-model question inside what initially looked like a screen-design task. The free tier also supported favourable reviews and store visibility. Removing it might improve conversion while damaging another part of the business. We needed to investigate that trade-off instead of treating either freemium or a hard paywall as inherently better.
Short-term conversion was also an incomplete measure. A trial that later became a refund was different from one that became a renewing subscription. The work needed a longer evaluation window and an agreed view of the costs and behaviours that mattered.
How we ran the research
We analysed install cohorts by acquisition source and first-session intent. This helped separate people responding to an urgent concern from those looking for continuing protection or simply exploring the app. Cohort analysis showed where behaviour differed; it did not explain the person's reasoning, so we paired it with moderated onboarding sessions.
In those sessions we watched the sequence of explanation, permissions, scan and payment. We looked for the point at which a person could explain what the product would do for them. Completing a setup step was not enough if they had denied the permissions the scanner needed or misunderstood what remained unpaid.
An in-app intent question helped the team connect what people did in the app to the reason they installed it. We also reviewed store listings and permission requests against the promise made before installation. Product and customer-communications teams worked together because notifications and emails continued the onboarding experience after the screens ended.
What we found
People arrived with different intentions, but the app did little to tell them apart. Someone worried that something was wrong needed a different explanation from someone buying ongoing protection. Treating both as a generic new user made the first sequence less relevant.
Permission requests appeared before the product had explained why they mattered. People could deny access and continue, leaving a scanner that appeared ineffective. The problem was not simply a low permission-grant rate: the sequence made the product's first result harder to trust.
The payment request was disconnected from the first useful result. It arrived after setup effort but before a person had seen enough value to judge the subscription. That made paywall timing a question to test alongside the wording of the offer.
Engagement was a poor substitute for service health. Existing retention work showed that renewing subscribers did not necessarily open the app often. Alarm-style prompts could increase opens without improving the relationship. We therefore kept activity data as a clue to investigate, rather than assuming that more visits meant more value.
What we tested and recommended
We tested explanations immediately before permission requests, so the request followed a reason the person could understand. We tested routing around the reason for installation and moving the payment decision relative to the first scan result. Each change addressed a gap seen in the research rather than adding another general benefit screen.
We also tested the subscription model: an open freemium route against a trial-led route with a limited first scan demonstrating value. The comparison followed paid conversion, refunds and revenue over time, with store ratings as a guardrail. Fewer trial starts could still be a better result if the people who continued understood the service and stayed.
Our recommendation was to connect the payment decision to demonstrated value, route the first experience by intent and judge the model beyond initial sign-up. We recommended reducing alarm-led engagement pushes and evaluating protection through renewal and refunds alongside conversion.
The principle
For a service people buy to stop worrying, attention is not automatically a sign of value. Research needs to connect the reason for arriving, the first useful result and the economics of staying. Sometimes the most consequential onboarding experiment is a change to the business model, not a shorter screen.