PRIVACY POLICY
2026-04-24

====================
WEBSITE (tabasa.app)
====================
tabasa.app is a public website for information about tabasa and for distributing platform downloads.

This website does not use third-party analytics trackers and does not use ad-network profiling.

The website may record page requests and download requests in self-hosted server logs for site operation, security, and operational reporting.

The website stores limited first-party browser state. The cookie and privacy notice uses browser storage for consent state. When the Android testing invitation feature is enabled, a first-party cookie may be set so the invitation does not reappear repeatedly.

The website has no user account system and no login.

If you contact the author by email, your email address and message are used to reply to you. If you request access to Android closed testing through the website, the Google account email address you send may be shared with Google so test access can be granted.

Privacy contact: wojciech.pietrzak@tabasa.app
Website: https://tabasa.app
Third-party license notices for Tabasa software distributions: https://tabasa.app/licenses.html

====================
ANDROID APPLICATION
====================
The Android application declares the INTERNET permission. No location, camera, microphone, contacts, or similar device-access permissions were identified in the application manifest.

The application stores its SQLite database and app state in Android app-private storage. Stored data includes the local puzzle library, attempt history, rating state, tutorial and legal acceptance state, and app settings needed for normal use.

The application connects to https://api.tabasa.app/v1/puzzles to download chess puzzles. Requests may include app version, platform or client identity, rating range, and already-attempted puzzle IDs so the service can return suitable puzzles and avoid duplicates. If the service is unavailable, the application can fall back to an embedded local puzzle set.

No account, login, cloud sync feature, third-party analytics SDK, advertising SDK, or third-party crash-reporting service was identified in the Android application code reviewed for this policy.

Android system backup behavior, if enabled on the device, is controlled by Android and the user's device settings.

====================
LINUX APPLICATION
====================
The Linux GUI application does not declare mobile-style platform permissions.

By default, local data is stored on the device in a SQLite database at ${XDG_DATA_HOME:-$HOME/.local/share}/tabasa/tabasa.db and GUI configuration at ${XDG_CONFIG_HOME:-$HOME/.config}/tabasa/gui_config.json. The application can also remember a user-selected database file path.

Network use is limited to chess puzzle retrieval through the engine. The engine fetches puzzles from https://api.tabasa.app/v1/puzzles. Requests may include app version, platform or client identity, rating range, and already-attempted puzzle IDs so the service can return suitable puzzles and avoid duplicates. If the service is unavailable, the application can fall back to an embedded local puzzle set.

No account, login, cloud sync feature, third-party analytics service, advertising SDK, or third-party crash-reporting service was identified in the Linux application code reviewed for this policy.

====================
WINDOWS APPLICATION
====================
The Windows GUI application does not declare mobile-style platform permissions.

By default, local data is stored on the device under %APPDATA%\tabasa\. This includes the SQLite database at %APPDATA%\tabasa\tabasa.db, the GUI configuration file at %APPDATA%\tabasa\gui_config.json, and a local runtime log at %APPDATA%\tabasa\runtime.log. The runtime log is local-only and is used for runtime diagnostics; it is not a remote telemetry service.

Network use is limited to chess puzzle retrieval through the engine. The engine fetches puzzles from https://api.tabasa.app/v1/puzzles. Requests may include app version, platform or client identity, rating range, and already-attempted puzzle IDs so the service can return suitable puzzles and avoid duplicates. If the service is unavailable, the application can fall back to an embedded local puzzle set.

No account, login, cloud sync feature, third-party analytics service, advertising SDK, or third-party crash-reporting service was identified in the Windows application code reviewed for this policy.