Does my Personal Web App need to comply to GDPR?
<p>I am building an app where I have some concerns about GDPR and user data. </p>

<p>First of all this is a personal app, no company behind. </p>

<p>What the app does: </p>

<ul>
<li>Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) </li>
<li>Allows a user to upload a GPX file (a route or some other activity) </li>
<li>Stores the above file to Google's database</li>
<li>Allows the user to analyze that file. </li>
</ul>

<p>I do know what needs to be done if the app was not a personal app, but I am not sure if I really need to do all the actions (consent, deletion, takeout data) in my case where this is just a personal website/app and nothing more. </p>

<p>An app(lication program) is software run on the end-users machine. That does not fall under the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/" rel="nofollow noreferrer">GDPR</a>.</p>

<p>Any processing (including storage) you do on user data has to be compliant with the GDPR.</p>

<blockquote>
  <ul>
  <li>Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) </li>
  </ul>
</blockquote>

<p>Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data.</p>

<p>Providing this "basic data" as a JSON or CSV file should meet <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/" rel="nofollow noreferrer">data portability</a> requirements.</p>

<blockquote>
  <ul>
  <li>Allows a user to upload a GPX file (a route or some other activity)</li>
  <li>Stores the above file to Google's database</li>
  <li>Allows the user to analyze that file. </li>
  </ul>
</blockquote>

<p>Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to <a href="https://cloud.google.com/security/gdpr/" rel="nofollow noreferrer">do this under the GDPR</a>. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission.</p>

<p>Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent).</p>

<p>Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data.</p>

<p>Finally, make sure there is a "Close my account and delete all my data" option.</p>

gdpr