Firebase Console for Google Privacy Policy

This policy describes how m23n (“we,” “us”; listed on the App Store as M23N) handles information when you use Firebase Console for Google, our native iOS app (Apple App Store) for working with your Firebase projects: Google Analytics reports, Authentication users, Cloud Firestore, Remote Config, Hosting, Cloud Functions and Cloud Messaging. Firebase Console for Google is an independent product and is not affiliated with, endorsed by or sponsored by Google LLC. By using the app you acknowledge the then-current version of this policy.

Your data stays yours: Firebase Console for Google reads your Firebase and Google Cloud data directly from Google’s APIs on your device and shows it to you. We do not operate a server that receives or stores your Google user data or your projects’ data, and we never sell or share it with advertisers or anyone else.

You can delete your data at any time from the app (Settings → Delete account & data) or by e-mail (see section 5).

1. Who we are

Firebase Console for Google is developed by m23n (M23N). For privacy requests and questions, contact us at support@m23n.com.

2. Categories of information

The list below describes categories of information that may be involved depending on which features you use. Not all categories apply to every user; the app also offers a demo mode with sample data that involves none of your Google data. The app has no separate app account or password: the only sign-in is with your own Google account.

2.1 Google sign-in & Firebase data

To show your projects, the app asks you to sign in with Google using OAuth 2.0 with PKCE and requests the following scopes:

• “See, edit, configure and delete your Google Cloud data” (https://www.googleapis.com/auth/cloud-platform) – to call the Firebase and Google Cloud admin APIs on your behalf: Firebase Management (list your projects and apps), Identity Toolkit (Firebase Authentication users), Cloud Firestore, Firebase Remote Config, Firebase Hosting, Cloud Functions, Cloud Logging (function logs and error counts) and Firebase Cloud Messaging (test messages).
• “View and administer all your Firebase data and settings” (https://www.googleapis.com/auth/firebase) – to list your Firebase projects and their registered apps.
• “See and download your Google Analytics data” (https://www.googleapis.com/auth/analytics.readonly) – read-only access to the Google Analytics property linked to a project, to show active users, new users, sessions, events, screens, countries, platforms, devices, app versions, traffic sources and realtime users.
• Basic profile (openid, email, profile) – your name, e-mail address and profile picture, used only to label the connected account in the app.

With your consent the app retrieves from these APIs, for the projects your Google account can access: project and app metadata; aggregated Google Analytics reports for the date ranges and filters you select; Firebase Authentication user records (which can include your app’s end users’ e-mail addresses, display names, phone numbers, user IDs, sign-in providers, sign-up and last sign-in dates, disabled status and custom claims); Cloud Firestore databases, collections and documents you browse or query; Remote Config templates, conditions and version history; Hosting sites, channels and releases; Cloud Functions configuration, state, error counts and log entries. This data is fetched over HTTPS directly from Google to your device, kept in memory and in the app’s local cache, and displayed to you.

Changes you make: when you choose to disable, enable or delete a user, create a password reset link, edit custom claims, create, edit or delete Firestore documents, publish or roll back Remote Config, roll back a Hosting release or send a Cloud Messaging test message, the request is sent from your device directly to Google through the same APIs and applied to your project. We do not receive a copy of it.

Your app’s end users: if your Firebase projects hold personal data of your own users, you remain the controller of that data. The app only displays it to you on your device at your request and never sends it to us or to any third party.

Tokens: OAuth access and refresh tokens are stored only in the iOS Keychain on your device and are never transmitted to us. You can revoke the app’s access at any time from the app’s settings (signing out or deleting your account and data revokes the tokens with Google) or from your Google Account’s third-party access page (https://myaccount.google.com/permissions).

Limited Use disclosure: Firebase Console for Google’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data obtained through these scopes is:

• used only to provide and improve the user-facing features described in this policy (viewing and managing your Firebase projects, Analytics reports, Authentication users, Firestore data, Remote Config, Hosting, Cloud Functions and Cloud Messaging test messages);
• not transferred to third parties, except as necessary to provide those features, to comply with applicable law, or with your explicit consent;
• not used or transferred for serving advertisements, including retargeting, personalised or interest-based advertising;
• not sold, and not provided to data brokers or information resellers;
• not used to determine credit-worthiness or for lending purposes, and not used to build databases or profiles about you or your app’s users;
• not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not use any Google API, including Google Workspace APIs, for that purpose, and we do not transfer Google user data to third parties for that purpose;
• not read by humans, except with your explicit permission for support, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

2.2 On-device AI insights

On devices that support Apple’s on-device language models (Apple Foundation Models), the app can summarise your Analytics trends and project health and suggest insights. This processing happens entirely on your device; your Firebase and Analytics data is not sent to us or to any cloud AI service for this purpose, and it is not used to train any model.

2.3 Alerts, widgets & data stored on your device

If you enable alerts, the app uses iOS Background App Refresh to check your projects on the device (for example a drop in active users, a sign-up spike or a failing function) and shows local notifications; no push server of ours is involved. Summary numbers are cached in an App Group container shared only with the app’s own home-screen and Lock Screen widgets so they can show your latest figures. Your preferences, notification settings, recently opened documents, unpublished Remote Config drafts and the history of test messages you sent are stored only on the device. This data is not uploaded to any server we operate.

2.4 Anonymous identifier & analytics

We use Mixpanel to understand how the app is used. On first launch the app generates a random anonymous device identifier that is used as your analytics user id; it is not derived from your Apple ID, Google account, advertising identifier or hardware serial number. Mixpanel collects product usage events (for example which screens are opened, whether a feature was used or a purchase completed), counts and coarse buckets (for example the number of projects), coarse device and app information (model, OS version, app version, language, country derived from IP address by Mixpanel) and that anonymous identifier. Analytics events never contain your e-mail address, project names or IDs, your app’s users’ data, document paths or contents, Remote Config keys or values, event names from your app, or any other content of your Google data. We do not use the advertising identifier (IDFA) and do not track you across other companies’ apps or websites.

2.5 Purchases & subscriptions

Firebase Console for Google offers the auto-renewing Firebase Console for Google Pro subscription billed through Apple In-App Purchase. Payments are processed by Apple under its policies; we never receive your payment card details. Subscription status is managed by RevenueCat, which receives the App Store purchase receipt, the products you bought, purchase and renewal dates, an anonymous app user id and basic device information (such as platform, OS and app version, and country/currency from the store), so the app can tell which plan is active. RevenueCat does not receive your Google data or e-mail address.

2.6 Support communications

If you contact us by e-mail, we receive the content of your message and the address you use. We use this information only to respond to you.

3. How we use information

• Show your Firebase projects, Analytics reports, Authentication users and console data
• Apply the changes you make in the app to your projects
• Send Cloud Messaging test messages you compose
• Generate on-device insights, local alerts and home-screen widgets
• Validate your subscription
• Measure usage and improve the product
• Comply with law and respond to lawful requests

4. Sharing, transfer & disclosure

Your Firebase and Google Cloud data is exchanged only between your device and Google. The parties that process information from the app on our behalf or under their own terms are:

• Google LLC – the Firebase, Google Cloud, Google Analytics and OAuth endpoints that the app talks to on your behalf, under your own Google terms.
• Apple Inc. – App Store purchases, Background App Refresh, local notifications and on-device AI processing, under Apple’s policies.
• RevenueCat, Inc. – subscription status for App Store purchases.
• Mixpanel, Inc. – usage analytics keyed by the anonymous identifier, never containing your Google data or e-mail address.
• Authorities – only where required by applicable law or a valid legal request.

We do not show ads, do not sell your information and do not share it with advertisers, data brokers or any other third party. If m23n is ever involved in a merger or acquisition, Google user data will continue to be handled in accordance with this policy and the Limited Use requirements, and you will be notified before any change takes effect.

5. Retention & deletion

Google user data (your projects’ data, Analytics reports and your basic profile) is held only on your device, in memory, in the app’s local cache and in the widget App Group container, and is removed when you sign out, delete your account and data in the app, or delete the app. Cached data is refreshed from Google as you use the app. You can revoke the app’s access from your Google Account’s third-party access page at any time, after which the app can no longer retrieve any data. Settings, drafts and test-message history live only on your device. Analytics data is retained by Mixpanel according to our project settings (no longer than five years) and is not linked to your name, e-mail or Google account. Subscription records are kept by Apple and RevenueCat as required for billing, tax and legal purposes.

In the app, Settings → Delete account & data revokes your Google tokens with Google, removes them from the Keychain, resets your analytics and subscription identity and wipes all data stored by the app on the device, including the widget cache and scheduled notifications. To have your analytics history deleted, or to exercise access, correction or deletion rights without the app, contact support@m23n.com. We respond within 30 days.

6. Security

All traffic between the app and Google, RevenueCat and Mixpanel uses HTTPS (TLS). OAuth tokens are stored in the iOS Keychain, which is encrypted by the operating system and protected by your device passcode or biometrics, and Google sign-in uses the system web authentication session with PKCE. The app never sees your Google password. Because Google user data is not copied to any server we operate, there is no server-side database of your projects’ data to be breached. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children

Firebase Console for Google is a professional tool for app developers and is not directed to children under 16. We do not knowingly collect information from children.

8. Changes

We may update this policy as Firebase Console for Google evolves. We will post the current version on this page and may provide additional notice for material changes (for example in the app).

9. Related policies

Our website and WristChat (Slack) are covered by a separate policy: Privacy Policy (WristChat & m23n.com). Terms for this app: Firebase Console for Google Terms of Use.