I am developing a mobile application that will be pretty similar to Instagram. Now this app will be available for free and I will be offering it on the Stores as an individual not as a business. So first aspect of this question that might get quite long is: Can you offer an app as an individual at the stores (iOS and Android) if you are going to store some user data in a cloud database?

For simplicity I will outline the other questions bellow in a numbered list:

  1. Is it legal to store user's email address in your database (MySQL Digital Ocean hosted) if you asked the user for permissions to do so, that is you have Terms and Conditions and Privacy Policy agreement checked by the user?

  2. I am going to store pictures the user uploads similarly to Instagram, is it legal to do so again if the user accepts that his images might be publicly available (uploaded to Amazon S3)?

  3. The app will also have Chat functionality between two users, now the chat messages will again be stored in the very same MySQL database, how is this protected by law? Is it legal to store private messages between users in database?

  4. What should I offer to the enduser beside the option to always delete his/hers account together with all his data and always be able to contact me by email and check all the data I have on him in the database and on Amazon S3 too (his/hers uploads)?

I appreciate any feedback as I am a little bit stuck on these legal issues as a solo developer with no registered business which is so far not a possibility because this app might prove a total disaster on both financial and developer aspect...


Regarding questions 1-3, the answer is 'yes' provided that you obtain user's consent, inform him of his rights pursuant to GDPR, and implement sufficient measures to provably comply with the GDPR.

As for 3 & 4, you are strongly encouraged to first get acquainted with the GDPR itself and then narrow down any questions you might have, since the ones here are too broad.

If you prefer, you could skip the recitals --i.e., the lengthy preamble-- and go straight to the articles, since recitals largely paraphrase the articles and are relevant only for purposes of clarifications of the legislative intent.

  • And how do you obtain consent of other people who might be in photographs? – Dale M Jun 5 '20 at 23:08
  • @DaleM "And how do you obtain consent of other people who might be in photographs?" If anything, this burden is something the OP might have to shift to the user in the T&Cs. Don't think that Instagram, Facebook, etc. have to seek consent of each and every individual whose image appears in pics a user uploads. That said, the OP would have to comply with requests for removal submitted by those other people. – Iñaki Viggers Jun 5 '20 at 23:24
  • Instagram and Facebook don’t need to do this because they don’t use consent as the legal basis for collecting this data. The OP is planning to. Also, you can’t shift GDPR obligations by contract. – Dale M Jun 5 '20 at 23:29
  • @DaleM "they don’t use consent as the legal basis for collecting this data. The OP is planning to." Hence the pertinence of shifting this issue to the user via the T&Cs. It is not even clear whether the OP's app entails the possibility of non-users appearing in images at all or whether his T&Cs would preempt that. – Iñaki Viggers Jun 5 '20 at 23:38
  • as a practical matter: how does the OP prevent that? If a user breaks the T&C, the OP has still broken GDPR. – Dale M Jun 5 '20 at 23:42

This can be done legally - lot’s of people do it

How you are proposing to do this isn’t legal - for example, if I’m in a photo uploaded by one of your users then you have just stored my personal data (the image of my face) without my permission.

You need to actually read and understand the GDPR. If you do, you will realise that using consent as the legal basis for data collection is the last reason you should be using.

Another problem you have is that GDPR compliance has to be built-in - it sounds like you have built your app and are now trying to bolt GDPR on. GDPR needs to be included in the software spec. It can’t be added at the end - for both legal (GDPR requires it) and practical reasons (for example, a DBA can see every part of the DB - is personal data encrypted before being stored? Hard to do after the code is written).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.