CODEWITHSUNDEEP
androidfirebasecrashlyticsfirebase-analyticsprivacy-policy
Soroush Lotfi
Soroush Lotfi

Reputation: 602

Is it OK to use user phone number as Crashlytics user id?

There are two types of user id you can set while using firebase in your app. Firebase Analytics user id and Firebase Crashlytics user id. Analytics user id can be set in code like this:

mFirebaseAnalytics.setUserId("123456");

and crashlytics user id can be set like this:

FirebaseCrashlytics.getInstance().setUserId("12345")

According to Analytics documentations:

Your user ID must not contain information that a third party could use to determine the identity of an individual user. For example, you cannot use a user's email address or social security number as a user ID.

I'm currently not setting analytics user id in my code at all. But I set the phone number used by user to sign up in my app, as their crashlytics user id so if they report a crash, I ask them their phone number and see what crashes exactly they have experienced.

The only explanation I can find in Crashlytics documentations is this:

To diagnose an issue, it’s often helpful to know which of your users experienced a given crash. Crashlytics includes a way to anonymously identify users in your crash reports. To add user IDs to your reports, assign each user a unique identifier in the form of an ID number, token, or hashed value:

My question is, does the same policy like analytics, apply to crashlytics? Is it OK to use user phone number as their crashlytics id or not?

Upvotes: 1

Views: 865

Answers (1)

Tony
Tony

Reputation: 2451

Ideally in any form of digital analytics, you must avoid collecting any sort of Personally Identifiable Information (PII). This could land you in legal trouble in countries where privacy laws are taken very seriously. However, as per Google's Best Practices on PII,

You can send Google Analytics an encrypted identifier or custom dimension that is based on PII, as long as you use the proper encryption level. Google has a minimum hashing requirement of SHA256 and strongly recommends the use of a salt, with a minimum of 8 characters. Notwithstanding any of the foregoing, you may not send Google Analytics encrypted Protected Health Information (as defined under HIPAA), even if it is hashed or salted.

Upvotes: 2

Related Questions