-1

I am building a mobile messaging application. I am using Firebase to store and collect user's data including their name, email, as well as their contacts and messages. At the moment, since I am the administrator on Firebase, I could log in to firebase and see all the data if I wanted to--including the messages users have sent and received from other users.

So my questions: 1. Is is required by law to encrypt data? 2. If I don't use encryption, is this something I need to explicitly include in the Privacy Policy for my application. 3. Any other advice you have on the legal aspects of this would be greatly appreciated!

Improve this question
2
  • 3
    Jurisdiction critically matters. Mobile apps often are worldwide, so you need to consider multiple laws.
    – MSalters
    Oct 14, 2019 at 7:29
  • Hello Lynn, welcome to Law.SE. Please read our tour page.
    – isakbob
    Oct 17, 2019 at 18:52

1 Answer 1

Reset to default
-1

It's a big subject with no single clear answer. You should look in to the GDPR regulations. It's an area I need to brush up on myself.

Regarding encryption, no you don't encrypt it and then send it of for storage. The database system should handle all of that for you. Firebase stores the data encrypted, and unlocks it for you so it's a seamless experience. If I remember correctly Firebase uses symmetric-key encryption. Doing encryption at application level before storage would mean you can't query any of your data.

On your privacy policy you just mention that you have taken reasonable steps to ensure their data is securely stored.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .