We wrote an App where private data can be sent from one phone to another phone one by temporarily storing the encrypted data file on our database server. The data file will sit there for less than a few hours, maybe just a few seconds, and will then be deleted. We do not log this. All data (but the usernames) is encrypted (asymmetric cryptography, RSA) and can only be decrypted by the receiving user's private key which never leaves his phone. Therefore, we cannot decrypt it. The users also need to publish their public keys in our database to make this technically work.
We think this is GDPR relevant, since we still can theoretically see on our server who (theoretically identifyableby IP number) is sending data to whom (theoretically identifyable by IP number). We are not sure if the public key is 'private data', since it is technically 'public' per definition.
My question is what to answer to a user request about his data (which is an important point for GDPR). Are we just providing a print out of the file in its encrypted state? And only in case there is one there at the time of the request? The print out is anyway only readable for this user since the private key never left his phone, and, therefore, we cannot decrypt it. If there are no files, do we just tell so?
