I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely.
As it stands, these applications can run without processing data and storing everything locally on the device. However, if I want to save the users data to a server in order for them to load the same information on multiple devices, I will be storing and processing data.
The reason I'm hitting a brick wall in trying to track down the legal issues involved here are twofold:
- If the developer is based in the EU and the server is based in the US, which jurisdiction does this fall under?
- If I'm storing just an e-mail address and unique identifier key in the database for login, would this in itself, be identifiable information? Would a user storing the text string "Mop floor tonight" be considered personal data? I ask because as this is free text, I'm aware a user could essentially type "My name is Dave Smith and I live at 742 Evergreen Terrace" and suddenly that's very personal data.
I'm just trying to get my head around the risks/efforts involved in having a simple "sync to all devices" command that can be manageable by a 1 person developer team. Are there perhaps exemptions for small businesses who's IP is the code itself and not the data (ie, I'm just collecting a username/email for login, no other data, not writing to the e-mail or using that data to generate revenue etc), and the self-supplied data is essentially just there to enable a feature? Or is this a legal framework I'll have no choice but to consider globally for all users?
