Firebase services that need disclosure
- Analytics — usage events, advertising IDs, audiences
- Crashlytics — crash reports, device state, custom keys
- Cloud Messaging (FCM) — push tokens, topic subscriptions
- Remote Config — installation IDs for variant assignment
- Authentication — email, phone number, OAuth identifiers
- App Check — device attestation tokens
- Performance Monitoring — network and rendering metrics
Where Firebase processes data
Firebase services are hosted on Google Cloud — primarily us-central1, with regional options for Firestore and Realtime Database. If you have EU users, your policy should reference Google's EU-US Data Privacy Framework certification and the Standard Contractual Clauses included in the Firebase Data Processing Addendum.
Children and Crashlytics
Crashlytics collects an Installation ID by default. For apps in the Designed for Families program, you must disable advertising-related features and configure Crashlytics with setCrashlyticsCollectionEnabled(false) until consent is granted. The generated policy describes this when you mark the app as kids-directed.