← Abella Web

Privacy Notice

Last updated: 23 October 2026

Abella Web is the browser-based interface for the Abella proof assistant at https://abella-prover.org/web/. It is operated by the Abella project maintainers ("we", "us", or "our"). We keep data collection to a minimum. The prover and editor run in your browser, and we do not keep a database of your files, accounts, or GitHub tokens. This notice explains the limited data involved when you use the site or connect GitHub.

1. Data controller

Controller: The Abella project maintainers
Contact: [email protected]
Website: https://abella-prover.org/web/

2. What data we process and why

A. Your work

Your project files, edits, imported sources, and archive contents are processed in your browser and stay on your device. They are not uploaded to or stored on our servers. The app may save the current project and a few small preferences in your browser so that a reload restores your work. If you open a local folder, those files also stay on your device. Zip import and export are local operations.

B. Connecting to GitHub

Connecting to GitHub is optional. You can paste a personal access token or choose Sign in with GitHub. We do not create accounts for Abella Web and never see your GitHub password. GitHub handles your sign-in on its own site.

• When you sign in, GitHub asks you to approve access. If you approve, a temporary sign-in code is passed to a small sign-in service operated for Abella Web, which exchanges it with GitHub for a GitHub access token (the credential your browser uses to talk to GitHub). The service does not keep the code or the token.
• The access token is kept only in the open browser tab. It is removed when you close the tab or choose Disconnect. It is not saved permanently, placed in the page address, written to logs, or included in error messages.
• Your browser uses the token to communicate directly with GitHub when you load or commit a repository. We do not proxy or store repository contents on our servers.
• By default, Abella Web asks GitHub for access to public repositories only. If you explicitly allow private repositories, GitHub grants access to all repositories you can access. A fine-grained personal access token remains the narrower option if you need per-repository access.
• GitHub processes your account and repository data under its own privacy statement. You can revoke access with Disconnect or in GitHub Settings → Applications → Authorized OAuth Apps.

C. Technical and security data

When you visit the site, our hosting and security providers process standard request information such as your IP address, browser type, requested page, and the time of the request. This is used to deliver the site, protect it from abuse, and diagnose technical problems. Access logs are rotated and are not kept longer than 30 days. We do not use analytics, advertising, or behavioural tracking.

3. Legal bases

• We process the data needed to provide Abella Web and the optional GitHub connection you request.
• We rely on our legitimate interest in keeping the service secure and available, including short-term abuse protection and access logs.
• Where consent is required, we rely on your consent. You can withdraw it by disconnecting from GitHub or by not using the optional feature.
• We do not intentionally collect special-category data, make automated decisions about you, or sell personal data.

4. Cookies and browser storage

Abella Web does not set cookies for advertising, analytics, or tracking. Cloudflare may set a strictly necessary security cookie at the edge; it is not used to track you.

Your browser stores some data on your device so that the app works:

• the current project and small preferences, kept on your device until you clear the site's data;
• your GitHub access token, kept only for the open tab and removed when the tab closes or you disconnect;
• the last GitHub repository address, if you connected GitHub, kept on your device until you clear site data.

This storage is needed for the app you requested, so no cookie-consent banner is used. You can remove it at any time by clearing this site's data in your browser or by using Disconnect for the GitHub session.

5. Who receives data

We use a small number of service providers:

• Cloudflare provides the edge network and security, including the small GitHub sign-in service. It processes request data on our behalf. See the Cloudflare Privacy Policy.
• DreamHost hosts the static site and its access logs. See the DreamHost Privacy Policy.
• GitHub processes your GitHub account, authorization, and repository data when you choose to connect. GitHub handles that data under the GitHub Privacy Statement.

These providers may process data outside your country. Their privacy policies describe the safeguards they use. We do not sell personal data or share it for advertising.

6. How long we keep data

• Project data and preferences stay on your device until you clear the site's data.
• The GitHub token stays only for the open tab; it disappears when the tab closes or you disconnect.
• The GitHub sign-in service does not keep codes or tokens. Temporary abuse-protection records expire quickly.
• Network access logs are kept for no longer than 30 days, except where a longer period is needed to investigate a security incident.
• GitHub keeps data according to its own policies.

7. Your rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the applicable data protection law, including:

• access to your personal data;
• rectification of inaccurate data;
• erasure of your personal data;
• restriction of or objection to processing;
• data portability;
• withdrawal of consent, where processing is based on consent;
• lodging a complaint with your local supervisory authority.

Because most data is stored only on your device, you can exercise access and erasure directly by viewing or clearing your browser's site data and by using Disconnect. For requests about network logs, contact us at [email protected]. We will respond within one month and may ask for information needed to locate the relevant records. We do not charge for ordinary requests.

8. Security

We use HTTPS, restrict access to the sign-in service, and do not log sign-in codes or access tokens. No method is completely secure; please report a suspected vulnerability to the contact address above.

9. Children

Abella Web is an educational tool that is not directed at children. We do not create accounts or knowingly collect personal data from children. If you believe a child's data has been processed, contact us.

10. Changes to this notice

We may update this notice if the service or legal requirements change. The revision date at the top will be updated, and material changes will be described on this page.

11. Contact

Privacy questions and data protection requests: [email protected]. Non-sensitive project questions can also use the Abella issue tracker.

← Back to Abella Web