Privacy policy clauses for Realm
Realm is a mobile-first embedded database that stores application data locally on users' devices with optional cloud synchronization through MongoDB Atlas. We use Realm to enable offline functionality and real-time data sync while maintaining data security and performance.
Free scan · No signup · Results in 60 seconds
What data Realm collects
Your privacy policy must disclose each of the following data types when you use Realm.
When does Realm trigger privacy obligations?
Installation & Data Flow
Adding Realm to your app triggers privacy obligations immediately because Realm stores application data on-device and—critically—can sync that data to MongoDB Atlas in the cloud. Even if you initially use only local storage, the capability to sync means you must assume data will eventually leave the device.
Regulatory Thresholds
GDPR (if users are in EU/UK): Any personal data processed through Realm is subject to GDPR. This includes data at rest on device and in transit to Atlas. You must establish a lawful basis (Article 6) before sync occurs. If Realm processes children's data, GDPR Article 8 applies (parental consent required for under-16s in most EU states).
CCPA (California residents): If you collect personal information via Realm and share it with MongoDB (Atlas), MongoDB becomes a service provider under CCPA Section 1798.140(ag). You must execute a Data Processing Agreement with MongoDB and disclose that data is shared with them.
HIPAA (health data): Realm is HIPAA-eligible, but this is a *capability*, not automatic compliance. You must sign a BAA with MongoDB before any PHI touches Atlas.
First Steps
1. Document what data Realm stores
