Privacy policy for Firebase apps

What Firebase does on a live site

Firebase is in the auth and database category. On sites we scan, it shows up through firebaseapp.com, firebaseio.com, firestore.googleapis.com. Its role is to authenticate users and store app data.

Data that may be processed: Authentication identifiers, Firebase Installation IDs, and documents or files your app writes. The vendor describes the location as: Google Cloud regions you configure. Their public privacy or data-processing terms are at https://firebase.google.com/support/privacy.

A privacy policy for a Firebase app should name Firebase directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.

Firebase apps load firebasejs from gstatic and call identitytoolkit.googleapis.com or firestore.googleapis.com. Name Firebase Authentication and the specific product you use (Firestore, Realtime Database, or Storage). 'We use Google' is too vague for a visitor.

What you still have to type

The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.