Privacy policy · Country Card

Country Card is a mobile app that shows a reference card for each country. This policy explains what information the app handles, why, and who else is involved. It applies to the Country Card app for iOS and Android and to this website. Country Card is published by Craig Robertson (“we”, “us”), who is the controller responsible for the personal data described here; contact details are at the end of this page.

The short version: there are no accounts, the app never asks for your location, and the settings that describe you stay on your phone. The only third parties that receive anything are the advertising, subscription, crash-reporting, app-update, photo, map and hosting services described below.

What stays on your phone

The app asks you to choose a home country and a passport country, and lets you pick a home time zone, mark countries as favourites and change the temperature unit. It also keeps a short list of countries you recently viewed, and a copy of the country information it last downloaded so it can still show it when you are offline. All of this is stored only on your device. It is not uploaded to us, not backed up by us, and not linked to any identifier. Deleting the app deletes it.

What reaches our server

When you open a country, the app requests that country’s data from our server. Three of those requests include a preference you chose:

The embassy card requests your passport country’s embassy in the destination, so the request path contains both country codes. To answer it, our server may ask Google Places for that embassy by country name — the two country names, nothing about you or your device — and keeps the answer for up to 30 days so the next reader’s request needs no lookup.
The visa row on the Entry Requirements card requests the rule for your passport country at the destination, so that request path also contains both country codes.
The exchange rate is requested relative to your home currency.

These requests carry no account, device identifier or advertising identifier. Our server runs on Cloudflare, which briefly records standard request logs, including the IP address the request came from and the path requested, for operating and debugging the service. We keep these logs for no more than 7 days and never use them to identify or profile anyone.

Advertising

The free version of the app shows ads served by Google AdMob. No ad is requested until the steps below have run, and they only start once you have finished setting up the app:

Consent form. Where the law requires it, including the UK and the European Economic Area, Google’s consent form asks whether AdMob may use your data for personalised ads and measurement. Elsewhere no form appears.
Tracking permission (iPhone only). iOS then asks whether Country Card may track you across other apps and sites. Android has no equivalent prompt; there, the advertising identifier is governed by your phone’s own ad settings.

If you allow personalised ads (and, on iPhone, tracking), AdMob may use your device’s advertising identifier to show personalised ads and to measure them.
If you decline, AdMob still shows ads, but they are not tailored to you and the advertising identifier is not used.

Where Google requires it, you can reopen its consent form from Settings › About › Ad privacy choices in Country Card. This lets you review and change your advertising consent.

You can change the tracking choice at any time in your phone’s settings (iOS: Settings › Privacy & Security › Tracking; Android: Settings › Privacy › Ads, where you can delete the advertising identifier). Google’s own use of information from apps that use its services is described at policies.google.com/technologies/partner-sites, and its privacy policy is at policies.google.com/privacy. Country Card Premium removes ads.

Subscriptions

Country Card Premium is an auto-renewing subscription sold through the App Store or Google Play. Purchases are processed by Apple or Google under their own terms and privacy policies; we never see your payment details.

To know whether your subscription is active, the app uses RevenueCat. RevenueCat assigns your installation a random, anonymous app-user ID and receives your purchase history for this app from the store. That is used to unlock Premium, restore purchases on a reinstall, and show the subscription management screen. RevenueCat’s privacy policy is at revenuecat.com/privacy.

Crashes, updates and performance

If the app crashes or hits an error, a report goes to Sentry, hosted in the European Union. A report contains the error and where in the app’s code it happened, the screens opened and buttons tapped just before it, the device model, operating system version, app version, a random ID the app creates when it is installed (so repeated errors on one installation can be grouped) and a sample of how long screens took to open. Your IP address is not stored with the report, and neither are the countries you set or the countries you looked at: we have turned off the option that would add them, and the app removes country and currency codes from the web addresses of its own requests before a report is sent. Sentry’s privacy policy is at sentry.io/privacy.

The app is also built with Expo and uses two of its services:

EAS Update checks for a newer version of the app’s code when the app launches. That request includes the app version and platform so the right update can be served, and a random ID the app creates when it is installed.
EAS Observe sends performance measurements, such as how long the app took to start, and reports of errors that didn’t crash the app. They come with the device model, operating system version, app version, your phone’s language setting and the same random installation ID. It does not send anything you typed or chose.

These installation IDs, Sentry’s and Expo’s, are random. They are not taken from your device or linked to your name, account or advertising identifier, and reinstalling the app creates new ones.

Expo’s privacy policy is at expo.dev/privacy.

Photos, maps and links to other services

Embassy listings come from Google Places, fetched through our server, so your device never contacts Google for them. Country photos come from Unsplash: our server searches Unsplash for the destination, and your device then downloads the chosen photo directly from Unsplash’s image servers, as Unsplash requires. That download tells Unsplash your IP address and which photo was shown, as loading any web image does, but nothing else about you. The map on the Location card is drawn by Apple Maps on iPhone and Google Maps on Android, so your device fetches map tiles for the destination’s capital from Apple or Google directly, under their privacy policies; the map never uses your location. Cards link out to the official sources their facts come from. Once you follow a link you are on that site, under its own privacy policy. Nothing about you is sent when the link is created.

This website

This website is static, sets no cookies, and uses no analytics. It is served by Cloudflare, which records the same brief request logs described above.

If you contact us

If you email us, including through the Contact row in the app or a “something wrong?” report from a country page, we receive your email address and whatever you write. Messages sent from the app have the app version, platform and, for a report, the country code filled in so we can act on them. We use this only to reply and to fix the problem you raised.

Why we can use this information

Where UK or EU data protection law applies, we rely on:

Your consent for personalised advertising and ad measurement, and on iPhone for tracking. You can withdraw it at any time as described under Advertising.
Our legitimate interests in running and securing the service (server request logs), keeping the app working and finding out why it fails (crash reports, performance measurements and update checks), funding the free version with non-personalised ads, and answering your messages. These use as little information as possible, and none of it is used to profile you.
Performing our contract with you to provide Premium once you have subscribed.

How long information is kept

On your phone: until you change the setting or delete the app.
Server request logs: no more than 7 days.
Embassy answers cached on our server: up to 30 days. They contain nothing about the person who asked.
Crash reports in Sentry: no more than 90 days.
Update checks and performance measurements held by Expo, advertising data held by Google, and the purchase record held by RevenueCat are kept under each provider’s own retention policy, linked above. RevenueCat keeps the purchase record for as long as it is needed to keep your subscription working and to meet record-keeping duties.
Emails you send us: for as long as needed to deal with your message.

Where information is processed

Some of the services above, including Google, RevenueCat, Expo and Cloudflare, process data in the United States and other countries outside the UK and the European Economic Area. When they do, they rely on safeguards recognised under UK and EU law, such as the EU-US Data Privacy Framework and its UK extension or standard contractual clauses. Sentry stores crash reports in the European Union.

Children

Country Card is not directed at children under 13 and we do not knowingly collect personal information from them.

Your rights

If you are in the UK or the European Economic Area you have rights under data protection law, including the right to access, correct or erase personal data, to object to its processing, and to withdraw consent. We hold nothing linked to your name, email address or an account. Crash reports and performance measurements carry only a random installation ID, which we have no way to connect to you. Deleting the app removes everything stored on your phone, and reinstalling it starts with new IDs. For the advertising and subscription services, the controls are the ad privacy choices described above, the tracking setting on your phone and your App Store or Google Play account. To make a request, or if you have a question about your data, email us at the address below. If you believe we have not handled your data properly you can complain to your local supervisory authority; in the UK that is the Information Commissioner’s Office (ico.org.uk).

Changes

If this policy changes we will update the date at the top of this page and, for anything material, mention it in the app. Previous versions are available on request.

Contact

Questions about this document or about Country Card go to support@countrycard.app. Country Card is published by Craig Robertson.