Skip to content

What Is Ephemeral Processing in the Data Safety Form?

Short answer: ephemeral processing means the data is used only while it sits in memory and is kept no longer than needed to serve one real-time request. You still declare it as collected, then answer yes to “Is this data processed ephemerally?” Google doesn’t show ephemerally processed data in your app’s Data safety section on the store.

Google’s Data safety help page defines it in two parts:

  • The data is only stored in memory while it is used.
  • It is retained no longer than necessary to serve the specific request in real time.

Google also says you can’t treat data as ephemeral if you use it to build advertising or user profiles.

Situation Ephemeral?
The app sends coordinates to a weather API that returns a forecast and stores nothing Yes, if nothing on the way stores them
The app sends a photo to a server that describes it and discards it Yes, if the server and any API it calls keep nothing
Your server writes request bodies to logs that are kept No, the data is stored
An AI provider keeps prompts for monitoring or abuse review No, check the provider’s retention terms
Location used to pick ads or build an interest profile No, Google excludes this

Take the AI case seriously. The Firebase AI Logic entry in this project’s SDK knowledge base notes that if AI monitoring is turned on in the console, prompts and outputs from sampled requests are retained.

The form asks the ephemeral question once for each data type you collect. So the answer should be yes only if every collection of that type is ephemeral. If one feature sends location to a stateless weather API and an analytics SDK also collects approximate location, location is not ephemeral.

The ephemeral question is a single row per data type, with a blank Response ID and true or false as the value:

PSL_DATA_USAGE_RESPONSES:PSL_APPROX_LOCATION:PSL_DATA_USAGE_EPHEMERAL,,true,MAYBE_REQUIRED,Data usage and handling (Approximate location) / Is this data processed ephemerally?

The pattern is PSL_DATA_USAGE_RESPONSES:<type>:PSL_DATA_USAGE_EPHEMERAL, where <type> is a data type ID such as PSL_APPROX_LOCATION or PSL_PHOTOS. It is MAYBE_REQUIRED: you answer it when the type is collected. The type also still needs PSL_DATA_USAGE_ONLY_COLLECTED, a required/optional answer and its purposes.

  • Leaving ephemeral data out of the form. It must still be declared as collected.
  • Answering yes because your code doesn’t store it, while your server logs or a third-party API keeps it.
  • Answering yes for a type that another SDK also collects in a non-ephemeral way.
  • Calling ad or profiling use ephemeral. Google rules it out.

The skill never assumes ephemeral processing. Data from SDKs defaults to not ephemeral, and a type stays ephemeral only if every source of it is. You or your agent mark a type as ephemeral in answers.json, for example "ephemeral": {"PSL_APPROX_LOCATION": true}, with the reason and file:line evidence recorded in the report. Get started.

Want the form filled from your own code, with evidence? Install the skill. If this page helped,star the repo on GitHub.

Built by Sanikant. Set in Google Sans Flex (SIL Open Font License), icons from Material Symbols (Apache 2.0). Google Play is a trademark of Google LLC; this project is not affiliated with Google. Output is a draft for review: you are responsible for your Data safety declaration.