Firestore and data
- Document
- The unit of storage in Firestore: a JSON-like record with typed fields, capped at 1 MiB. Documents live in collections and can hold their own subcollections.
- Collection
- A named container of documents. Collections are not typed and not counted, so a query, not a directory listing, is how you find what is in one.
- Composite index
- An index across several fields, required for most queries that filter on one field and order by another. Firestore refuses the query rather than running it slowly, which is a feature.
- Read, write and delete operations
- The billed unit of Firestore work: one document touched is one operation. Cost is driven by documents returned, not bytes, which is why a wide query is expensive even when the payload is small. Model yours in the Firestore cost estimator.
- Snapshot listener
- A subscription that pushes changes to the client as they happen. Each initial attach bills a read per document, then only for changed documents.
- Offline persistence
- The local cache that lets a client read and write without a network and reconcile later. Enabled by default on mobile SDKs, off by default on web.
- Realtime Database
- The older JSON-tree database, billed on bandwidth and storage rather than per operation. Still the cheaper choice for very chatty small updates; latency is compared in Realtime Database vs Firestore latency.
Cost and quota
- Spark plan
- The free tier, with daily caps rather than a bill. Work stops when a quota is hit, which is safe for side projects and unacceptable in production.
- Blaze plan
- Pay as you go, with the free tier still applied first. No hard ceiling, so a runaway listener or loop becomes a bill rather than an outage.
- Egress
- Data leaving Google infrastructure to your users. Usually invisible in planning and then material on a media-heavy app.
- Cold start
- The delay when a Cloud Function instance has to boot before serving. Dominated by runtime and dependency size; the cost side is modelled in the Cloud Functions cost calculator.
- Invocation
- One execution of a Cloud Function, the billed event unit. Billed alongside compute time, so a fast function called constantly and a slow one called rarely can cost the same.
- GB-second
- Memory allocated multiplied by execution time, the compute unit for serverless billing. Doubling memory to halve runtime is often cost-neutral and latency-positive.
- Cost anomaly
- A spend pattern that breaks from the baseline, usually a bad query shipped to production. Catching it needs a daily look, not a monthly invoice.
Security
- Security rules
- The server-side expression language that decides who may read or write each path. They are the only real authorization layer, since client code is public. Test cases against them with the security rule tester.
- Open rules
- Rules that allow read or write to anyone, often left from a tutorial or a test-mode database. The most common serious Firebase misconfiguration, surveyed in Firebase misconfigurations.
- Rules simulator
- A tool that evaluates a rule set against a hypothetical request without touching live data. The only cheap way to know a rule denies what you think it denies.
- App Check
- Attestation that a request came from your genuine app rather than a script with your config keys. Complements rules; it does not replace them.
- Custom claims
- Key-value pairs set on an auth token, typically roles. Available inside rules without a database read, which makes role checks cheap.
- Least privilege
- Granting the narrowest access that still works, per collection and per role. Cheapest to apply at design time and painful to retrofit.
- Read-only console access
- Giving on-call staff visibility into project state without write permission. The reasoning is set out in read-only consoles in DevOps.
- Service account
- A non-human identity with its own key, used by servers and CI. Its key bypasses security rules entirely, which is why leaking one is a full compromise.
Delivery and messaging
- FCM (Firebase Cloud Messaging)
- The push delivery service for Android, iOS and web. It queues and delivers; it does not guarantee that a device is awake to receive.
- Registration token
- The per-install address a push is sent to. Tokens rotate and go stale, and stale tokens are the usual cause of a quietly falling delivery rate.
- Topic
- A named channel devices subscribe to, letting one send reach many installs without storing every token. Fan-out is server-side and slower than direct sends.
- Message priority
- Normal or high. High priority can wake a dozing device, and abusing it gets an app throttled by the platform.
- Data vs notification message
- A notification message is rendered by the system; a data message is handed to your code. Which one you send decides what happens when the app is backgrounded.
- Delivery rate
- The share of sends that reach a device, distinct from opens. Estimate the realistic figure for your audience with the delivery estimator.
Monitoring practice
- Crashlytics
- Crash reporting with grouped, deduplicated issues and stack traces. The default first stop when a release goes wrong.
- Crash-free users
- The share of daily users who saw no crash. The single most useful release health number, and more honest than a raw crash count.
- ANR (application not responding)
- Android blocking the main thread long enough for the system to offer to kill the app. Counted separately from crashes and penalised separately in Play Console.
- Trace
- A named, timed span in Performance Monitoring, either automatic (app start, network calls) or custom. Percentiles matter here; the median hides the problem.
- Alert threshold
- The value that turns a metric into a page. Set too tight it trains the team to ignore alerts, set too loose it arrives after the users do.
- Release health
- The combined view of crash-free rate, ANRs and adoption for a version, watched over the hours after a staged rollout. Broader patterns in mobile backend trends.
Where to go next
Definitions follow the Firebase and Google Cloud documentation for Firestore pricing, security rules, Cloud Messaging and Crashlytics, plus the Play Console vitals definitions for ANR and crash rate. Last verified .
All apps on Google Play
