Join Datasets While Protecting Anonymity
If you're okay with getting statistics that are not perfectly exact but noisy, a variant of randomized response could solve your problem. Instead of sending you real information about their usage, your users will send you noisy data. For a given user, you can't know for sure whether their answer to a particular question is exact or is just random (and you get a very solid property to quantify that, differential privacy). But when aggregating all responses, you can get statistics that are close to the real ones.

If you need more than binary questions, take a look at RAPPOR and the related paper — if you have enough users, you can get much more complex statistics (numerical, strings…) with a very decent precision and strong privacy guarantees.

Note that implementing such a system in practice is not trivial: you need to make sure that if you ask the same question twice to the same user (in your case, if the statistics are collected periodically) their randomized answer stays the same — otherwise, the noise cancels itself out over time and you end up learning sensitive information about them.