I am building a mobile messaging application. I am using Firebase to store and collect user's data including their name, email, as well as their contacts and messages. At the moment, since I am the administrator on Firebase, I could log in to firebase and see all the data if I wanted to--including the messages users have sent and received from other users.

So my questions: 1. Is is required by law to encrypt data? 2. If I don't use encryption, is this something I need to explicitly include in the Privacy Policy for my application. 3. Any other advice you have on the legal aspects of this would be greatly appreciated!

  • 3
    Jurisdiction critically matters. Mobile apps often are worldwide, so you need to consider multiple laws. – MSalters Oct 14 '19 at 7:29
  • Hello Lynn, welcome to Law.SE. Please read our tour page. – isakbob Oct 17 '19 at 18:52

It's a big subject with no single clear answer. You should look in to the GDPR regulations. It's an area I need to brush up on myself.

Regarding encryption, no you don't encrypt it and then send it of for storage. The database system should handle all of that for you. Firebase stores the data encrypted, and unlocks it for you so it's a seamless experience. If I remember correctly Firebase uses symmetric-key encryption. Doing encryption at application level before storage would mean you can't query any of your data.

On your privacy policy you just mention that you have taken reasonable steps to ensure their data is securely stored.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.