Based on your security page, data is stored on Google Cloud (Firebase/Firestore) with AES-256 encryption at rest and TLS in transit. You also state you only access data with user permission or if legally required. However, I want clarification:

Since data is processed via Google Cloud, does this mean third-party providers have infrastructure-level access?
Do you offer end-to-end encryption, or can your team technically access readable user data?
Are internal access events logged and visible to users?
As you state you are not yet GDPR compliant, how should EU users interpret data protection guarantees?

I’m trying to understand the difference between “private by policy” vs “private by architecture” before storing sensitive data.