Example Firebase Realtime Database Structure - Scoped User Info (world/public/friends-only/private) [CC0 License]

userinfo-database-data.js

// Database data
// https://console.firebase.google.com/u/0/project/PROJECT-ID/database/data
{
  "userInfo": {
    "userId01": {
      "public": {
        "username": "someuser1",
        "profilePic": "https://www.gravatar.com/avatar/23463b99b62a72f26ed677cc556c44e8", // see http://gravatar.com/site/implement/images/
        ...
      },
      "friend": {
        "onlineStatus": "true", // user is online?
        "lastOnline": "1510049876520", // user was last online at T
        "friends": {
          // you can use `true` to signify close friends/friends you follow and false for other friends
          // alternatively, this could be an object {"notify": "true", "follow": "true", "from": "1510049876520"}
          "userId02": true,
          "userId04": true,
        }
        ...
      },
      "private": {
        "primaryEmail": "example@example.com",
        "emails": {
          // you can use `true` to signify the primary email and false for others instead of "primaryEmail" above
          // alternatively, this could be an object {"primary": true, "allowFindByEmail": "true", "sendNotifications": "true", "added": "1510049876520", "providers": {"facebook":"true"}}
          "example%40example%2Ecom": {...},
          "example%40outlook%2Ecom": {...},
        },
        "blocked": {
          "userId03": true,
        }
        ...
      }
    },
    "userId02": {...},
    "userId03": {...},
    "userId04": {...},
    ...
  },
  ... // other trees
}

userinfo-database-security-rules.js

// Database Rules
// https://console.firebase.google.com/u/0/project/PROJECT-ID/database/rules
{
  "rules": {
    "userInfo": {
      "$uid": {
        "world": { // readable to world, writable by this user
          ".read": "true",
          ".write": "auth != null && auth.uid === $uid"
        },
        "public": { // readable accessing user is not blocked or is an admin
          ".read": "auth != null && (data.parent.child('private/blocked').child(auth.uid).exists() === false || admin.token.admin === true)",
          "username": {
            ".write": "auth != null && auth.uid === 'admin-worker'" // managed by server
          },
          "$other": {
            ".write": "auth != null && auth.uid === $uid" // anything else, writable by this user
          }
        },
        "friend": { // readable if accessing user is a friend of this user or is an admin
          ".read": "auth != null && (auth.uid === $uid || data.child('friends').child(auth.uid).exists() === true || auth.token.admin === true)",
          "friends": {
            ".write": "auth != null && auth.uid === 'admin-worker'" // managed by server
          },
          "$other": {
            ".write": "auth != null && auth.uid === $uid" // anything else, writable by this user
          }
        },
        "private": { // readable if accessing user is this user or an admin
          ".read": "auth != null && (auth.uid === $uid || auth.token.admin === true)",
          "emails": {
            ".write": "auth != null && auth.uid === 'admin-worker'" // managed by server
          },
          "blocked": {
            "$blockedID": {
              ".write": "auth != null && auth.uid === $uid" // writable by this user
              ".validate": "newData.isBoolean()" // data must be a boolean
            }
          },
          "$other": {
            ".write": "auth != null && auth.uid === $uid" // anything else, writable by this user
          }
        }
      }
    },
    ... // other trees
  }
}