Privacy Policy

This privacy policy explains how Tabiatsari collects, uses, and protects your personal data when you use our mobile app and website.

Last updated: May 7, 2026

Overview

Tabiatsari ("we", "us", or "our") operates the Tabiatsari mobile application and the tabiatsari.uz website. This Privacy Policy describes what personal data we collect, why we collect it, and how we handle it. By using our services, you agree to the collection and use of information as described in this policy.

Information we collect

We collect the following data from users: Email address (for account creation, sign-in, and password reset). Full name (for account creation and your profile). Password (stored securely using bcrypt hashing; we never store or transmit your password in plaintext). Precise and coarse location (only while you are actively recording a hike or viewing the explore map; location access can be denied; background location is used only during active recording with a foreground service notification). Photos (only when you explicitly pick or capture an image via the in-app camera or photo library to attach to a hike or place). Crash diagnostics (via Firebase Crashlytics — stack traces, device model, and OS version; this data is not linked to your user identity for tracking purposes).

How we use your information

We use the data we collect to: Provide and maintain your account and profile. Enable GPS-based hike recording and display your position on the explore map. Allow you to attach photos to hikes and user-tagged places. Send transactional emails such as account verification and password reset messages. Diagnose and fix crashes and technical issues in the app. We do not use your data for advertising. We do not use advertising trackers, analytics SDKs, or third-party ad networks.

Third-party services

We share limited data with the following third-party services to operate Tabiatsari: Firebase (Google) — Crashlytics for crash reporting and Firebase Installations for device identification; crash data is not linked to your user identity. Google Sign-In — optional authentication method; only basic profile info (name, email) is received if you choose to sign in with Google. Meteoblue — weather forecast provider; only latitude and longitude are sent, with no user identity attached. Cloudflare R2 — hosts images and map tiles; no personally identifiable information is stored. AWS SES — sends transactional emails (account verification, password reset). AWS RDS — PostgreSQL database hosting where account and hike data is stored.

Data retention

Account data (email, name, profile) is retained until you delete your account. After you tap Delete Account, your account is marked deleted immediately and purged from our production systems within 30 days. Recorded hike data is retained on-device and synced to our servers; it is deleted when you delete the hike or your account. Crash logs collected by Firebase Crashlytics are retained per Firebase defaults (90 days).

Your rights

You can delete your account and all associated data directly from the mobile app at any time by going to Profile and tapping Delete Account. The action is permanent and cannot be undone. Your account is marked deleted immediately and is purged from our production systems within 30 days. If you can no longer sign in (e.g., lost password and email access), you may also request deletion by contacting [email protected]. You may also deny location and camera permissions at any time through your device settings, which will limit certain app features but will not affect your account.

Children's privacy

Tabiatsari is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at [email protected] and we will take steps to delete that information.

Contact us