0

So I am about to publish a mobile app and I need a privacy policy, although my app doesn't really collect any type of user information, is there some kind of definition about what it means to "collect" in these cases?

Is it considered collecting if I log the user onto her social media and show her some social media api informations and I only save locally (inside her mobile) her social media authentication cookie? My app (and I) would have practically no knowledge of anybody's personal data as soon as I don't send anything outside the device (to a remote database or else)

Improve this question
1

1 Answer 1

Reset to default
1

Her social media authentication is personal data.

Improve this answer
8
  • uhmm does not look any personal: it is just a meaningless one time token that is useless without her username and password (which does not get collected by apps, only apple / google / facebook / twitter has those)
    – Edoardo
    Nov 17, 2017 at 7:06
  • @Edoardo for the period of its validity, it's not meaningless at all - and if it's a JWT, then it could contain plenty of personally identifiable information available to anyone who wants to read it (most JWT tokens are signed but not encrypted - their payload may contain email addresses, usernames, real names and other information related to the account holder).
    – user4210
    Apr 11, 2019 at 11:28
  • @Moo please look here developer.twitter.com/en/docs/basics/authentication/overview/… oauth tokens afaik are not JWT, they do not carry any type of user information, they are part of the authentication flow to make sure that the the guy who initiated the whole process has access to the data
    – Edoardo
    Apr 11, 2019 at 16:45
  • @Edoardo sorry, but you aren't exactly correct - oauth.net/2/jwt - I'm a software developer and I work with oauth and JWT all the time.
    – user4210
    Apr 11, 2019 at 20:21
  • @Moo uh! I stand corrected then, although from your oauth link it says that "JWTs can be used as OAuth 2.0 Bearer Tokens..." that does not mean that they are using it, moreover, in twitter case at least, oauth2 with the bearer token is used only for Application-only authentication which gives you access to public data only.
    – Edoardo
    Apr 12, 2019 at 5:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .