Research guide
Firebase privacy disclosures
Firebase is a family of products, and your privacy policy should name the ones you enabled and describe what each processes. Firebase's documentation states that customers are responsible for obligations such as fulfilling individuals' rights, and the Crashlytics terms require a readily accessible policy that discloses what information is collected and that it is processed by third-party providers like Google. Google Analytics for Firebase is subject to separate terms.
Name the enabled products
Authentication processes email addresses, phone numbers, sign-in provider identifiers, and IP addresses. Google Analytics for Firebase collects app events, installation identifiers, device information, and approximate location. Crashlytics collects crash traces, device state, and installation identifiers. Cloud Messaging processes registration tokens. Firestore, Realtime Database, and Cloud Storage hold whatever content your app writes, and Hosting and Cloud Functions process request logs. A universal Firebase paragraph copied from another app will usually be wrong for yours.
What the Crashlytics terms require
The Firebase Crashlytics and App Distribution terms require developers to make their privacy policy readily accessible to users, to fully and accurately disclose what information is collected, and to state that the information is disclosed to and processed by third-party providers like Google. For end users in the European Union, the terms also require notice of, and consent to, transfer of the information to the United States. If you use Crashlytics, check that your policy includes these points.
Roles and responsibilities
Firebase's privacy documentation describes the Firebase customer as typically the controller of end-user data and states that customers are responsible for obligations such as fulfilling individuals' rights. Google processes data on your behalf under the data processing terms for most Firebase services. Google Analytics is a separate service with its own terms and data sharing settings, so review its configuration separately.
Identifiers, retention, and settings
Firebase installation IDs, analytics app instance IDs, advertising identifiers when collected, messaging tokens, and crash identifiers should be described in the policy and in store forms. Analytics retention settings, advertising ID collection, and data sharing options change what you should disclose. Record the settings used in each release so you can update the policy when they change.
Matching Google Play and Apple disclosures
Firebase publishes guidance for completing the Google Play Data safety form and Apple's App Privacy details for each Firebase product, including which data types each SDK collects. Use that guidance together with your own configuration so your store answers and your policy describe the same data. If you disable a product, remove it from both.
Consent and children
Where analytics or advertising identifiers require consent, for example in the EU and UK, configure Firebase to wait for consent before collection and describe that behavior. Apps directed to children must follow platform family policies and COPPA, which may restrict analytics and advertising identifiers. Firebase includes settings to disable analytics collection until consent is given.
Location and transfers
Project location settings determine where some Firebase data is stored, but other services process data globally. Describe international processing honestly and name the safeguard relied on, such as standard contractual clauses in Google's data processing terms, rather than claiming all data stays in one country.
Authentication and sign-in providers
Firebase Authentication can sign users in with email and password, phone numbers, anonymous accounts, or federated providers such as Google, Apple, Facebook, and GitHub. Federated sign-in brings profile information from the provider, and phone sign-in sends verification codes by SMS. The policy should list the sign-in methods offered, the data received from each provider, and the fact that verification messages are sent through Google's infrastructure. If you use reCAPTCHA or App Check to protect sign-in, disclose that device and interaction signals are processed for abuse prevention.
Cloud Messaging and in-app messaging
Push notifications through Firebase Cloud Messaging depend on registration tokens tied to an app installation. In-app messaging and Remote Config can target messages using analytics audiences. Explain what notifications you send, whether they are marketing or service messages, how users can switch them off in the app or operating system, and whether analytics data is used to select recipients.
How the generator covers Firebase
Selecting Firebase as an analytics provider or as a third-party service in the questionnaire names it in the relevant sections, and the app platform choice adds app-store purchase and provider questions. Clauses describe what you confirm, so if you only use Firebase Authentication and Hosting, the policy does not claim analytics collection.
Official sources checked for this guide
Platform rules and legislation can change. Verify the current text before publishing or making a high-risk decision.
Common questions
Is Firebase GDPR compliant?
Firebase offers data processing terms and settings, but compliance depends on how you configure and use it, including consent, retention, transfers, and your privacy notice.
Do I need to disclose Firebase if I only use Hosting?
Hosting processes request information such as IP addresses in logs, so a short disclosure of hosting and logging is still appropriate.
Does turning off analytics remove Firebase from my policy?
Only the analytics disclosure. Other enabled products such as Authentication, Crashlytics, or Cloud Messaging still process data and remain in the policy.