Firebase Studio

GDPR overview

Firebase publishes a Privacy and Security in Firebase page (last modified 18 February 2026) carrying a 'Firebase support for GDPR and CCPA' section. Concrete measures are named: the Firebase Data Processing and Security Terms, a Cloud Data Processing Addendum for services under the Google Cloud terms, and Google LLC's certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework with the UK Extension. A subprocessor list is published (Accenture LLP, EPAM Systems Inc, Fastly Inc., Firebase Inc., last modified 23 September 2021), plus the Google Cloud subprocessors. ISO 27001 and SOC 1, 2 and 3 are claimed for Firebase services, ISO 27017 and ISO 27018 for some of them, but the table contains no Firebase Studio row. Google names no Article 27 representative of its own; the dedicated page explains how the customer appoints theirs. Recourse runs through the FTC, then a local supervisory authority, then binding arbitration.

Who owns the data?

Use of Firebase Studio is governed by the Google Terms of Service, with generative features also covered by the Gemini API Additional Terms of Service (Unpaid Services) and the Generative AI Prohibited Use Policy. Under the Firebase Data Processing and Security Terms, Firebase customers typically act as data controller (GDPR) or business (CCPA/CPRA) for end-user personal data, while Google generally operates as data processor or service provider, so the data stays under the customer's control. The contracting entity is Google LLC, Google Ireland Limited or Google Asia Pacific Pte. Ltd. depending on the case; where Google is itself controller, Google Ireland Limited covers the EEA and Switzerland, Google LLC the United Kingdom.

Reuse rights

Firebase's retention table describes the data Firebase Studio processes as the customer inputs and outputs exchanged with the AI model. Google states that it uses submitted content and generated responses to provide, improve and develop its products, services and machine learning technologies. That is the default behaviour, not an opt-in. The documented way out is demanding rather than convenient: you must avoid the App Prototyping agent and Gemini assistance entirely, and turn off code completion and code indexing in the Firebase Studio settings. An .aiexclude file can keep chosen files or directories out of Gemini's context. Google adds two explicit warnings: do not type personally identifiable information or end-user data into the chat, and treat Gemini output as unverified, because it can be plausible yet factually wrong and should never reach production untested. On the user's side, the code itself remains freely reusable and exportable at any time, as a zip archive or a push to GitHub, with no permission to request.

Data retention & training

Hosting summary

Firebase ties Firebase Studio to no particular jurisdiction. The Privacy and Security in Firebase page states that unless a service or feature offers data location selection, Firebase may process and store data anywhere Google or its agents maintain facilities, and that potential facility locations vary by service. Firebase Studio is not among the services offering data location selection, so no hosting country or region is published for it; workspaces themselves run on Google Cloud Workstations virtual machines. In practice the data follows Google's global infrastructure, with the contracting entity, Google LLC, Google Ireland Limited or Google Asia Pacific Pte. Ltd., set by the Firebase Data Processing and Security Terms, and international transfers covered by Google LLC's EU-U.S. and Swiss-U.S. Data Privacy Framework certification. On protection, Firebase services encrypt data in transit over HTTPS and keep customer data logically isolated, but Firebase Studio does not appear in the list of services encrypting data at rest, so encryption at rest cannot be assumed for it.