Firebase: why is one name not one kind of data collection?

Which Firebase component are we discussing?

Firebase is Google's collection of app services. Analytics measures events and user properties and can define audiences. Crashlytics reports failures and can receive custom logs, keys and user identifiers. These are different collection systems, with different controls. Firebase Analytics, customising crash reports.

Other components deliver push notifications, provide installation identity or fetch remote configuration. An installation ID identifies an installation for a service; a push token lets a service address notifications to it. Keeping those functions means continuing identifiable exchanges even when optional analytics is disabled. Firebase In-App Messaging, which displays marketing messages inside an app, is also distinct from Cloud Messaging notification delivery.

Why do diagnostic records need attention?

Hypothetical example: a crash report contains a failure location, the previous screen name and a custom account reference. That may help reproduce a bug, but it describes more than “the app crashed”. A technical purpose does not decide the sensitivity of every attached field. This example is illustrative; our audits do not claim that all apps attach account details to every crash.

What did the inspected apps do?

Buienalarm 4.32.0 has app event, property and user-ID paths, Crashlytics logging/exception/custom-key sinks, Sessions and notification measurement. Its patch stops those inventoried optional paths while retaining Installations, Remote Config and notification delivery. The audit keeps these components separate explicitly. Pinned Buienalarm audit.

In Weeronline 3.61.0, startup force-enables Crashlytics and forwards app logs. The control therefore covers the runtime collection decision as well as manifest settings. Performance wrappers remain around functional HTTP code, with collection deactivated. The advice API still receives a Firebase installation ID. firebase-settings.crashlytics.com is a configuration host, not evidence of the crash-upload destination. Weeronline audit, destination clarification.

What should “disabled” mean?

It means the named control stops the audited analytics, diagnostic or notification-measurement boundaries for that version. It does not mean every Firebase component is deleted. Flitsmeister likewise suppresses optional Firebase collectors while retaining operational token interfaces; the news apps retain functional installation, configuration and push paths.

Evidence reviewed 28 October 2026. No new packet capture establishes complete silence. See identifiers, the glossary and methodology.