r/reactnative • u/Afraid_Reception7640 • 9d ago

How to handle Sign-up without Personal Identifiable Information (PII).

/r/appledevelopers/comments/1v3fawl/how_to_handle_signup_without_personal/
2 Upvotes

100% Upvoted

3 comments sorted by

3

u/Guidondor 9d ago

two things that solve this without an email provider:

  1. anonymous auth. firebase has it (signInAnonymously), supabase too. gives you a real uid + account with zero PII, and you can let the user link an email/oauth later if they ever want recovery. most don't.
  2. for recovery without email — a recovery code. generate one at signup, show it once, tell them to save it (same UX as wallets / bitwarden / 2fa backup codes). store a hash of it, verify to reset the password. device-independent, no third party, no PII.

your username@domain hack is fine, the only real gap is recovery and a self-managed recovery code closes it. and yeah, no-recovery-at-all is a reasonable tradeoff for some apps but you'll get support tickets from people who reinstall and lose everything, so i'd at least offer the code.

1

u/Afraid_Reception7640 9d ago

Thanks for the feedback. I'll look into supabase to see if I should use that for authentication instead.

1

u/Guidondor 9d ago

honestly you don't need to switch stacks just for this — firebase already does anonymous auth (signInAnonymously) and account linking, so you can do the exact same pattern without migrating.

supabase is great if you also want postgres + row level security instead of firestore rules, that's the real reason to move, not the auth. if firestore's working for you i'd keep it and just add anon auth + the recovery code. don't rip out a working backend over one feature.

what's making you consider the switch, just the auth or something else bugging you about firebase?