I'd like to notify my users if a login happens from a new device. Like Google does for Gmail logins. Android ID and IMEI usage for tracking is discouraged by google. How can I track devices without using hardware identifiers? What is the best way to track devices without violating users privacy?
From your description it seems that for your purposes, a persistent file in your app will be enough. You will get some 'false positives' when users wipe the app data, or uninstall your app and reinstall it later, but this should not be a big problem if it only results in a private mail notification, as for Google logins.