Collection of sensitive data—such as software usage data or other telemetry data—over repeated collection cycles in satisfaction of privacy guarantees

1. A computing device implemented method comprising:

obtain partition information for a domain into which original values obtained from a user device fall, the partition information partitioning the domain into a plurality of segments of uniform size;

randomly selecting for the user device an upward-rounding window having a window size smaller than the segment size, the upward-rounding window size is added to each original value determined for the user device;

randomly determining a mapping of each segment of the domain to a segment identifier value;

determining a first original value for the user device, wherein the first original value represents a first private value falling within the domain and which describes an operation of the user device;

adding the upward-rounding window size selected for the user device to the first original value to obtain a first window-augmented original value;

identifying a first segment containing the first window-augmented original value;

using the determined mapping to identify a first segment identifier value mapped-to from the first identified segment;

determining a first privacy-preserving value based at least in part on the identified first segment identifier value, wherein the first privacy-preserving value does not include private information associated with the user device; and

transmitting, to a remote computing device, a first reporting communication on behalf of the user device, the first reporting communication reporting the first privacy-preserving value.

2. The method of claim 1 wherein the original value determined for the user device is a value measuring how much time within a distinguished time period an application executed, an application received input, or output generated by an application was displayed on the user device.

3. The method of claim 1 wherein the reporting communication reports the identified segment identifier value as the first privacy-preserving value associated with the user device.

4. The method of claim 1 , further comprising:

randomly selecting a value in a range, wherein the value randomly selected for the user device is within a perturbation subrange of the range;

based at least in part on the value randomly selected for the user device is within a perturbation subrange of the range, perturbing the segment identifier value identified for the user device,

and wherein the first privacy-preserving value reported by the reporting communication transmitted on behalf of the user device is the perturbed segment identifier.

5. The method of claim 1 wherein the random selection of an upward-rounding window size is within a uniform probability across a range between zero and one fewer than the segment size.

6. The method of claim 1 , further comprising:

receiving, at the remote computing device, reporting communications for a plurality of user devices;

applying an aggregation function to aggregate the values reported by the received reporting communications to obtain an aggregation result; and

storing aggregation results on behalf of the plurality of user devices collectively.

7. The method of claim 1 , further comprising:

determining a second original value for the user device, wherein the second original value represents a second private value falling within the domain and describes the operation of the user device;

adding the upward-rounding window size to the second original value determined for the user to obtain a second window-augmented original value;

identifying a second segment containing the second window-augmented original value;

using the determined mapping to identify a second segment identifier value mapped-to from the second identified segment;

determining a second privacy-preserving value based at least in part on the identified second segment identifier value, wherein the second privacy-preserving value does not include private information associated with the user device; and

transmitting, to the remote computing device, a second reporting communication on behalf of the user device, the second reporting communication reporting the first privacy-preserving value.

8. One or more memories collectively having contents configured to cause a computing system to perform a method comprising:

obtain partition information for a domain into which original values obtained from a user device fall, the partition information partitioning the domain into a plurality of segments of uniform size;

randomly selecting for the user device an upward-rounding window having a window size smaller than the segment size, the upward-rounding window size is added to each original value determined for the user device;

randomly determining a mapping of each segment of the domain to a segment identifier value;

determining a first original value for the user device, wherein the first original value represents a first private value falling within the domain and which describes an operation of the user device;

adding the upward-rounding window size to the first original value determined for the user device to obtain a first window-augmented original value;

identifying a first segment containing the first window-augmented original value;

using the determined mapping to identify a first segment identifier value mapped-to from the first identified segment;

determining a first privacy-preserving value based at least in part on the identified first segment identifier value, wherein the first privacy-preserving value does not include private information associated with the user; and

transmitting, to a remote computing device, a first reporting communication on behalf of the user device, the first reporting communication reporting the first privacy-preserving value to the remote device.

9. The one or more memories of claim 8 wherein the reporting communication reports the identified segment identifier value as the first privacy-preserving value associated with the user device.

10. The one or more memories of claim 8 , the method further comprising:

randomly selecting a value in a range, wherein the value randomly selected for the user device is within a perturbation subrange of the range;

based at least in part on the value randomly selected for the user device is within a perturbation subrange of the range, perturbing the segment identifier value identified for the user device,

and wherein the first privacy-preserving value reported by the reporting communication transmitted on behalf of the user device is the perturbed segment identifier.

11. The one or more memories of claim 8 , the method further comprising:

receiving, at the remote computing device, reporting communications for a plurality of user devices;

applying an aggregation function to aggregate the values reported by the received reporting communications two obtain an aggregation result; and

storing aggregation results on behalf of the plurality of the plurality of user devices collectively.

12. The one or more memories of claim 8 , the method further comprising:

determining a second original value for the user device, wherein the second original value represents a second private value falling within the domain and describes the operation of the user device;

adding the upward-rounding window size to the second original value determined for the user to obtain a second window-augmented original value;

identifying a second segment containing the second window-augmented original value;

using the determined mapping to identify a second segment identifier value mapped-to from the second identified segment;

determining a second privacy-preserving value based at least in part on the identified second segment identifier value, wherein the second privacy-preserving value does not include private information associated with the user device; and

transmitting, to the remote computing device, a second reporting communication on behalf of the user device, the second reporting communication reporting the first privacy-preserving value to the remote computing device.

13. A computing system comprising:

a processor; and

a memory having contents executable by the processor to perform a method, the method comprising:

obtain partition information for a domain into which original values obtained from a user device fall, the partition information partitioning the domain into a plurality of segments of uniform size;

randomly selecting for the user device an upward-rounding window having a window size smaller than the segment size, the upward-rounding window size is added to each original value determined for the user device;

randomly determining a mapping of each segment of the domain to a segment identifier value;

determining a first original value for the user device, wherein the first original value represents a first private value falling within the domain and which describes an operation the user device;

adding the upward-rounding window size selected for the user device to the first original value to obtain a first window-augmented original value;

identifying a first segment containing the first window-augmented original value;

using the determined mapping to identify a first segment identifier value mapped-to from the first identified segment;

determining a first privacy-preserving value based at least in part on the identified first segment identifier value, wherein the first privacy-preserving value does not include private information associated with the user device; and

transmitting, to a remote computing device, a first reporting communication on behalf of the user device, the first reporting communication reporting the first privacy-preserving value.

14. The computing system of claim 13 wherein the reporting communication reports the identified segment identifier value as the first privacy-preserving value associated with the user device.

15. The computing system of claim 13 , the method further comprising:

receiving, at the remote computing device, reporting communications for a plurality of users;

applying an aggregation function to aggregate the values reported by the received reporting communications two obtain an aggregation result; and

storing aggregation results on behalf of the plurality of user devices collectively.

16. The computing system of claim 13 , the method further comprising:

determining a second original value for the user device, wherein the second original value represents a second private value falling within the domain and which describes the operation of the user device, the second original value to be transformed into a second privacy-preserving value be reported;

adding the upward-rounding window size to the second original value determined for the user device to obtain a second window-augmented original value;

identifying a second segment containing the second window-augmented original value;

using the determined mapping to identify a second segment identifier value mapped-to from the second identified segment; and

determining a second privacy-preserving value based at least in part on the identified second segment identifier value, wherein the second privacy-preserving value does not include private information associated with the user device; and

transmitting, to the remote computing device, a second reporting communication on behalf of the user device, the second reporting communication reporting the first privacy-preserving value to the remote computing device.

17. A computing device-implemented method comprising:

obtain partition information for a domain into which original values obtained from a user device fall, the partition information partitioning the domain into a plurality of segments of uniform size;

randomly selecting, for the user device, an upward-rounding window having a window size smaller than the uniform size of the plurality of segments, the upward-rounding window size comprising a value added to each original value determined for the user device;

randomly determining, for the user device, a mapping of each of the plurality of the segments of the domain to a segment identifier value;

determining a first original value for the user device, the first original value representing a first private value falling within the domain and which describes the operation of a remote system operated on behalf of the user device;

determining a first privacy-protected value representative of the first original value, wherein the first privacy-protected value does not include private information associated with the user device, wherein determining the first privacy-protected value includes operations of:

adding the upward-rounding window size selected for the user device to the first original value to obtain a first rounded value;

identifying a first segment of the plurality of segments of the domain which the includes first rounded value;

determining a first segment identifier associated with the first segment using the mapping; and

determining the privacy-preserving value representative of the first original value based on the first segment identifier; and

transmitting a first reporting communication to a remote computing device, the first reporting communication providing the first privacy-preserving value to the remote computing device.

18. The method of claim 17 , further comprising:

determining a second original value for the user device, the second original value representing a second private value falling within the domain and describes the operation of the user device;

determining a second privacy-protected value representative of the second original value, wherein the second privacy-protected value does not include private information associated with the user device, wherein determining the second privacy-protected value includes operations of:

adding the upward-rounding window size selected for the user device to the second original value to obtain a second rounded value;

identifying a second segment of the plurality of segments of the domain which the includes second rounded value;

determining a second segment identifier associated with the second segment using the mapping; and

determining the privacy-preserving value representative of the second original value based on the second segment identifier; and

transmitting a second reporting communication to a remote computing device, the second reporting communication providing the second privacy-preserving value to the remote computing device.