I created a publicly accessible web application that allows me to remotely control the heating system in my home.
The only data the app itself collects is logs of user activity (e.g.: logging when I turn on the heating) which I don't believe constitutes personal information.
However, so as to limit access only to authorized users, I implemented third party authentication using Google. One can only try and log in with a Google account and it will fail if you are not registered, but one can also sign up for an account. When this happens, the app sends me an email with the email address and the name of the person that wishes to register. This information is given to me by Google. Based on this information I then decide if that user can create his account. The name and the email address are stored to remember if the user was allowed to register or not.
The GDPR regulation states that:
This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
I should be ok, since control of my home's heating is pretty much a household activity. Would this still be the case given that I use Google for authentication?