TabForge — Privacy Policy

Effective date: October 20, 2026

TabForge ("the app") is a guitar tablature editor for Android published by Hollow Pick Studio, the trade name of independent developer José María Cerro Barrado (Madrid, Spain), who acts as the data controller under the EU General Data Protection Regulation (GDPR). Postal address: Calle Longares 48, Escalera 1, 3A, 28022 Madrid, Spain. Contact: hollowpickstudio@gmail.com. Seller details: Seller information.

The short version

Your musical projects and settings stay on your device. We have no server and no user accounts, and we never see your compositions.
The app collects nothing unless you explicitly consent to crash reporting on first launch. You can withdraw consent at any time in Settings, and collection stops immediately.
Purchases are processed entirely by Google Play. We never see your payment details.

1. Data stored only on your device

Tablature projects (.tfx files), editor state, preferences, and recovery autosaves are stored exclusively in the app's private storage on your device. They are never transmitted to us or to third parties by the app. Deleting the app deletes this data. Files you explicitly export or share leave the app only through the Android share/export flows you initiate.

2. Data processed only with your consent

On first launch the app asks for your consent before enabling any data collection. If — and only if — you consent, the following Google service is enabled:

Service	Data	Purpose	Legal basis
Firebase Crashlytics (Google LLC)	Crash stack traces; device model, OS version and app version; a random app-installation identifier (the Crashlytics installation UUID and Firebase installation ID); recent warning-level app log lines; app session start events (time and a running count), used to compute crash-free statistics. Reports are built to leave out project content, song titles and file paths.	Fixing crashes	Consent (Art. 6(1)(a) GDPR)

You are under no legal obligation to provide this data; it is sent only if you consent. Reports travel over HTTPS and can only be opened by the developer through his Google account.

You can withdraw consent at any time in Settings → Privacy; collection stops immediately. Withholding consent does not limit any app functionality.

3. Purchases

The optional Pro upgrade can be bought in two ways, both processed by Google Play Billing: as an auto-renewing subscription billed monthly or annually, or, during a limited launch period, as a one-time lifetime purchase. A subscription renews automatically at the end of each period until you cancel it, and you can cancel at any time from your Google Play account — in the app, Settings → About → Manage subscription opens the same place. The lifetime purchase is a single payment and never renews. Google LLC processes the payment; the app only receives a confirmation token proving the purchase (legal basis: performance of a contract, Art. 6(1)(b) GDPR). We never receive your name, address, or payment details. Google's processing is described in the Google Privacy Policy.

4. Advertising

The current version of TabForge shows no ads. If a future version introduces ads in the free tier, this policy will be updated first, and EU users will be asked for consent through Google's certified consent flow (UMP) before any advertising identifier is used.

5. International transfers

If you consent to crash reporting, the data listed in section 2 is sent to Google LLC (Firebase Crashlytics, contact: firebase.google.com/support/privacy) and stored on its servers in the United States.

When and how: over an encrypted connection (HTTPS), and only while your consent is on: a crash report the next time the app starts after a crash, an error report when the app records an error it recovered from, and a session-start event each time you open the app (or return to it after about 30 minutes away).
Purpose: fixing crashes. Retention: at most 90 days (section 6).
Safeguards: the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Reports are built to leave out project content, song titles and file paths.
For users in Japan: the United States has no adequacy recognition from Japan's Personal Information Protection Commission; this transfer is based on your consent, and US federal law offers no general data-protection statute equivalent to Japan's.
How to refuse: choose "Don't share" on first launch, or turn crash reporting off at any time in Settings → Privacy. Nothing is sent from then on, and the app works exactly the same.

6. Retention

Crash data is retained by Firebase for at most 90 days, after which it is deleted automatically. Data on your device is retained until you delete it or uninstall the app.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent at any time without affecting prior processing. Write to hollowpickstudio@gmail.com. We acknowledge requests within 2 working days and answer within one month, or sooner where your local law sets a shorter deadline (for example, within 10 days for users in Korea). You also have the right to lodge a complaint with the Spanish supervisory authority (AEPD) or your local data protection authority.

Privacy officer (for users in Korea: 개인정보 보호책임자): José María Cerro Barrado, hollowpickstudio@gmail.com. Users in any country, including Japan, Korea and Israel, can use this address to ask for access, correction, deletion or suspension of processing of their data.

8. Children

TabForge is not directed at children under 14 and we do not knowingly collect data from them. The app collects no data at all without explicit consent in any case.

9. Changes

Material changes to this policy will be announced in the app before they take effect, and the effective date above will be updated.