Privacy Policy

Last updated: October 8, 2026 · Version 2.5

Countrol is a tracker for alcohol, smoking and other substances. What you record in it is some of the most sensitive information about you there is, so the app is built so that we never receive it. This policy explains exactly what that means, what the few optional features do send somewhere, what the app reports about how it is used, and what the countrol.app website records when you visit. It is written to be read, not to be survived.

1.Who we are

Countrol (“we”, “us”, “our”) is an independent app developed and operated from Switzerland. For the limited processing described in this policy — the referral ledger, the website and email you send us — we are the data controller under the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP) and the UK GDPR. You can reach us at the address in section 29.

For everything you track in the app, there is no controller to name: the data never reaches us. It is held on your device, under your control, and we have no technical means of access.

2.What this policy covers

This policy covers the Countrol mobile app on iOS and Android, the optional Countrol+ subscription and referral programme, and the website at countrol.app including its blog and support pages.

It does not cover Apple, Google or any other company's own handling of your data, which is governed by their policies, or third-party websites we link to. Your use of the Service is also governed by our Terms of Use.

3.Where everything lives

The honest one-page answer, before the detail:

4.Data stored on your device

Countrol stores the following locally on your device:

• Consumption entries. Your tracking logs for alcohol, smoking and other substances, with their dates, quantities and any categories you create. On iOS, stored using SwiftData; on Android, in a local Room database.
• App preferences. Language, tracked substances, custom categories and colours, theme and app icon, notification settings, currency and pricing, CO₂ settings, and other choices.
• Onboarding choices and progress. Your initial setup, milestones, streaks and any tutorial state.
• Referral state, if you use it. Your own code and whether you have redeemed one (see section 9).

None of this is transmitted to us. We run no server that receives it, and there is no API for it to be sent to. It is written to the app's private storage area, which the operating system keeps separate from other apps.

5.What the app never collects

To be explicit, the Countrol app never collects any of the following:

The app contains no advertising SDK and nothing that records your screen. It contains two third-party SDKs, and nothing else:

• RevenueCat records the status of a Countrol+ subscription and nothing else. It cannot see a screen you opened, a button you pressed or anything you track, and it is not present at all for someone who never buys. What it receives is set out in section 10.
• PostHog iOS records a short, fixed list of usage events — that onboarding finished, that the Countrol+ screen was opened, that a reminder was switched on. The only things it records without being asked are that the app was installed, updated, opened or put in the background, and a crash when one happens; every other event is a line written by hand. It can be turned off in Settings, and that switch covers the crashes too. What it receives, and what it never receives, is set out in section 12.

Crash reporting is the one thing here that changed: earlier versions of Countrol reported nothing at all, and this one reports crashes and the errors it would otherwise have swallowed — described in section 12 and covered by the same switch. Neither SDK ever receives what you track. We do not sell, rent, trade or share personal data with anyone for their own purposes, and we have not done so at any time.

6.Health-related information

What you track — how much you drink, smoke or use — is health-related information, and under the GDPR it is a special category of personal data deserving extra protection. Our answer to that is structural rather than procedural: we designed the app so that this data never leaves your control, so there is no processing of it by us to safeguard, restrict or breach.

We never receive it, never store it, never analyse it, and never disclose it — not to advertisers, insurers, employers, data brokers, researchers or anyone else. No part of the referral programme, the subscription or the website is linked to what you track, and none of them could be: the two never touch.

7.iCloud sync iOS

If you switch on iCloud sync in Settings, your Countrol data is synchronised across your Apple devices through your own personal iCloud account, in a private database that only you can access. This is handled end-to-end by Apple and governed by Apple's Privacy Policy. We do not have access to it, cannot read it, and receive no copy or notification of it.

Sync is off unless you turn it on, and turning it off stops further syncing. Removing the data already in iCloud is done through your device's iCloud settings (see section 22).

8.Device backups

Your phone's own backup system may include Countrol's data, in the same way it includes other apps. This is worth knowing, because it is a case where your entries leave the device without us being involved.

• Android Android Auto Backup is enabled for the app. Where you have backup switched on for your device, your Countrol database and preferences are copied to your Google account's backup. Google's backups of app data are encrypted, and on current Android versions they are protected with a key derived from your device passcode. We have no access to them. The app lock setting is deliberately excluded from the backup, so that restoring onto a device without biometrics cannot lock you out of your own history.
• iOS If you back up your iPhone to iCloud or to a computer, that backup includes app data, per Apple's normal behaviour.

These backups belong to you and to the platform, not to us. They are governed by Apple's and Google's privacy policies, and you can disable them in your device settings.

9.The referral programme

This is the one part of the app where data about you reaches a service we operate. Taking part is entirely optional; if you never open the referral screen and never install through a friend's link, nothing in this section applies to you. Nothing you track is ever involved — the ledger holds codes and identifiers, and has no field that could hold a consumption entry.

iOS How it works on iPhone

Referrals use Apple CloudKit in a public database inside our iCloud container. Three kinds of record are written, each exactly once:

• your referral code and the identifier that owns it;
• a link from that identifier to the code, so it survives a reinstall;
• a redemption record, if you enter someone else's code: the code and the time.

The identifier is the opaque per-app user record ID that CloudKit issues. It is not your Apple ID, your name or your email address, and it cannot be used to identify you outside our container. Apple does not give us your Apple ID, and we never ask for it.

Android How it works on Android

Referrals use Google Firebase (Firebase Authentication and Cloud Firestore), operated by Google as our processor:

• The app signs in anonymously. Firebase issues a random account identifier that is not tied to you personally.
• Firestore stores your code with that identifier as its owner, and, if you redeem someone's code, a redemption document holding the code and a timestamp.
• Only when you claim a reward, you are asked to sign in with Google so the reward survives a reinstall. From that point, Firebase Authentication holds the email address and basic profile of the Google account you chose, linked to the same identifier. This is the only place the app ever handles an email address, it happens only if you choose to claim, and the email is never used to contact or market to you.
• Firebase App Check with Play Integrity is used to verify that requests come from a genuine, unmodified install of the app. This is an anti-abuse measure operated by Google.
• If you installed the app from a referral link, Google Play passes the app the referral code that was attached to that link, through the Play Install Referrer API. Only the code is read from it, and it stays on the device until you choose to use it.

Google's handling of this data is governed by the Firebase privacy documentation and Google's Privacy Policy.

What we can see, and what we do with it

We can see referral codes, the opaque identifiers that own or redeem them, and the times. We use them for one purpose only: to count referrals correctly, to grant the rewards that were earned, and to prevent fraud and abuse of the programme. We do not use them for advertising or profiling, and we do not share them with anyone outside the platform providers above. Deleting referral data is covered in section 22.

10.In-app purchases

Countrol offers an optional Countrol+ subscription. All payment processing happens on the store platform:

We never receive, see or store your name, card number, billing address or any other payment detail. Whether you have Countrol+ is decided on your device, by asking the store directly — that answer is what unlocks the app, and it works with no network of ours involved.

Subscription records — RevenueCat

Alongside that, the app reports completed purchases to RevenueCat, a subscription-management provider, so that we can see how many subscriptions are active, how many renew and how many are refunded. RevenueCat acts as our processor: it may not use anything it receives for its own purposes. It receives:

• An anonymous identifier the app generates on your device the first time it runs. It is not your Apple ID, your email or any account of yours; we never send a name, an email address or an identifier of our own, so the record cannot be traced back to you by us or by RevenueCat.
• The purchase itself — which product, when, the price and currency, the store country, and whether it is a trial, a renewal, an expiry or a refund. This comes from the store receipt; the payment stays with Apple or Google.
• Basic technical context — app version, operating system version, device model, and the IP address of the request, which is used to derive an approximate country.
• Where the subscription came from — which screen the Countrol+ page was opened from, which plan was selected on it, and the interface language. This is so that we can tell whether the offer shown during onboarding works better or worse than the one somebody goes looking for in Settings. It describes a screen, never a person.
• The analytics identifier — the anonymous identifier described in section 12, so that a subscription can be counted against the behaviour that led to it. Two anonymous values joined to each other; neither is joined to you.
• Apple Search Ads attribution iOS — if you installed Countrol after seeing an ad on the App Store, Apple's AdServices framework provides a campaign-level token telling us which campaign the install came from. This is Apple's standard, campaign-level data: it identifies an advertising campaign, not a person, requires no tracking permission and involves no advertising identifier. We use it for one thing — to know whether advertising pays for itself.

This is not tracking. Nothing here is used for advertising to you, nothing is shared for anyone else's purposes, and none of it is combined with anything you track — which we do not have. Apple and Google separately provide us with aggregate sales reporting, which does not identify individual buyers.

11.Notifications and app lock

If you enable reminders, notifications are scheduled and delivered entirely on your device by the platform's own system (iOS UNUserNotificationCenter, Android AlarmManager). There is no push server, no device token sent to us, and no notification content leaves your device. The same is true of home-screen widgets, which read the local database directly.

If you enable the app lock, authentication is performed by the operating system's biometric or passcode system. We never receive your biometric data — the app is only told whether the check succeeded.

12.Usage analytics

Two separate things are described here: what the app reports about how it is used, and what the website records. Both go to PostHog, which acts as our processor and may not use anything it receives for its own purposes, and both are handled on PostHog's European infrastructure. Neither of them can see what you track.

In the app iOS

This is a change worth stating plainly: earlier versions of Countrol sent nothing at all about how the app was used, and this one sends a little. The reason is narrow — we could not tell which parts of the app people actually reach, which meant guessing at what to fix and what to remove.

What is sent is a fixed, hand-written list of events — a little under sixty of them, written out in the source rather than gathered by an SDK deciding for itself. They are moments like onboarding reached step 7, the Countrol+ screen was opened from Settings, a purchase completed, an entry was logged, a reminder was switched on, the Insights period was changed to monthly. Which screen you are on is reported the same way, by name, from a fixed list of screens.

Two of them are measurements rather than moments: how many seconds a screen was on display before you left it, and how long the app took to become usable after you opened it. The second is there so that a version that got slower can be spotted; neither is connected to anything you track.

Alongside each event go the app version, the operating system and version, the device model, the interface language, an anonymous identifier the app generates on your device the first time it runs, and a small amount of context about how the app is set up: whether onboarding is finished, whether you are subscribed, which theme you chose, whether spending or CO₂ tracking is on, and how many categories you track — a number, never which ones.

What is never sent is everything you came here to keep: not a substance, not a quantity, not a price you paid for a drink, not a date on which you drank or smoked, not a note, not a trigger, not a streak length, not the name of a category you invented, and never which categories you track. The events say that a feature was used; they never say what was in it. Where the shape of an answer is genuinely useful it goes out as a yes-or-no or a count — this entry had a note, three categories are switched on — and never as the thing itself.

Almost nothing is captured automatically, and the exceptions are named here rather than left to the SDK to decide: that the app was installed, updated, opened or put in the background, and a crash when one happens, which is the next section. There is no session replay and no screen recording; the taps you make and the text you type are not captured; and no advertising identifier is involved, so there is no App Tracking Transparency prompt, because there is nothing to ask for.

Crashes and errors

When the app crashes, or fails at something it does quietly — a save that does not take, an iCloud export that never lands, a receipt that will not import — it reports that failure. What goes with it is the kind of error, the message the operating system gave for it, and the stack: the list of functions the app was inside when it went wrong. This is what a crash reporter has always been, and it exists because a crash nobody tells us about is a bug nobody fixes.

These reports carry no more than the events above. Everything you track is held in a database the crash reporter does not read, and nothing you have typed is put into an error message on purpose. If you switch usage data off, crash reporting goes with it — it is the same switch.

Questions we may ask in the app

The same service can show a short survey inside the app — for example, why you decided not to subscribe. Answering one is optional and always will be; the answer is stored against the same anonymous identifier as everything else, so it tells us what somebody thought and never who they are. Please do not put anything about your health or your consumption into a free-text answer: unlike the rest of the app, a survey answer is a message you are choosing to send us.

The service is also used to switch features on and off remotely and to compare two versions of a screen. That looks at the anonymous identifier to decide which version you get, and nothing else about you.

What never leaves

Your IP address is discarded before the event is stored, and the app tells the service explicitly not to look it up. That is deliberate and it costs us something: it means we cannot tell which country an event came from. It also means no location of any kind, however approximate, is derived from your use of the app.

One identifier is shared, and only one: the analytics identifier is given to our subscription provider (section 10) so that a subscription can be counted against the behaviour that led to it. Both are anonymous values generated on your device. Joining them to each other tells us that somebody who opened the paywall from the onboarding went on to subscribe; it cannot tell us, or anyone else, who that was.

You can switch it off. Settings → Privacy → Share Anonymous Usage Data. Turning it off stops any further event immediately and discards the anonymous identifier, so switching it back on later starts as a new, unconnected install. The app is fully functional either way, and nothing about it changes based on whether you leave it on.

On the website countrol.app

To understand how many people find countrol.app and which pages they read, the site uses the same provider in its cookieless mode. It records the page visited, the date and time, the referring website, and the browser and device type.

It records rather more about the page itself than it used to, and all of it is about the page rather than about you: which links and buttons get clicked, where on a page people click and how far they scroll, clicks on things that turn out not to be clickable, JavaScript errors together with the stack they came from, and how quickly the page loaded and became usable. This is the ordinary business of finding out whether a marketing page works. It is possible here, and deliberately not done inside the app, for one reason: these pages are public writing of ours, with nothing on them that you typed and nothing about what you track.

In this mode the analytics sets no cookies and writes nothing to your browser's storage, and no persistent identifier is assigned to you. Visits are grouped by a hash the server computes daily and cannot reverse, which is why the same visitor is counted again the next day and why no location is derived from your address. Because no personal data is stored on your device and none is retained that identifies you, this analytics needs no cookie consent banner.

This is aggregate traffic measurement. It tells us that a page was read; it can never tell us who read it, and it is not connected to anything you track in the app.

One thing about how it is wired deserves stating plainly rather than being discovered. Both the app and the website reach the analytics service through a proxy on our own domain (c1.countrol.app) rather than by calling it directly. The practical effect is that the ordinary blocklists content blockers use, which work by recognising a known analytics domain, will not recognise this one — so a blocker that used to stop this will no longer stop it. We use the proxy because it keeps every request the app and the site make on our own domain, but we are not going to pretend it does not also have that consequence. The Share Anonymous Usage Data switch in the app’s Settings is unaffected by any of it and remains the way to turn this off completely; on the website, blocking the domain c1.countrol.app does the same job, and the site works exactly as it does now without it.

One page also reports to TikTok. That is advertising measurement rather than analytics in the sense above, and it is described on its own in the next section.

13.Cookies, local storage and TikTok’s pixel countrol.app

Every page of the website but one sets no cookies — not for analytics, not for advertising, not for anything. The exception is countrol.app/tiktok, described below. The site stores at most two small values in your browser, purely so it behaves the way you left it:

• countrol-lang (local storage) — the language you picked from the language menu, so the site stops suggesting another one.
• countrol-lang-dismissed (session storage, gone when you close the tab) — that you dismissed the suggestion to read the site in another language.

Both are strictly necessary for a preference you expressed, never leave your browser, and are readable only by countrol.app. Clearing your browser storage removes them. The site never redirects you based on your IP address or your browser language.

The exception: countrol.app/tiktok

countrol.app/tiktok is the link in our TikTok profile and the page our TikTok ads lead to. Its only job is to get you to the App Store or Google Play. To find out whether an ad does that, the page loads TikTok’s pixel, a script supplied by TikTok, whenever it stays on screen — inside TikTok’s own browser, or on a computer. On a phone, in an ordinary browser, the page sends you on to the store before the pixel could load. No other page of the site loads it.

When it runs, the pixel sends TikTok the address of the page, including the click identifier TikTok adds to an ad link; the page you came from; your browser and device type; your IP address, which every request carries; that the page was viewed, how much it was clicked and scrolled, and which buttons were tapped and where they lead; and a Download event the first time you tap the App Store or Google Play button. It also sets four cookies on countrol.app: _ttp, a random identifier; ttcsid and ttcsid_ followed by our pixel’s ID, which group one visit’s events together; and _tt_enable_cookie, which records that cookies work. All four last 90 days unless you clear them, and no other page of the site reads them. The page has nothing from the app on it, so the pixel cannot see anything you track.

What we get back is TikTok’s ad reporting: how many people an ad brought to this page, and how many of them tapped a store button. TikTok is not our processor here. For collecting this data on our page and passing it on, TikTok and we are joint controllers; what TikTok does with it afterwards is TikTok’s alone. It can match a visit to a TikTok account and use the data for its own purposes, including measuring and improving advertising, as set out in TikTok’s privacy policy.

To keep it from running: a browser that sends a Global Privacy Control signal never loads the pixel, and blocking analytics.tiktok.com stops it too. The page works exactly the same without it.

14.Website hosting countrol.app

The website is a set of static files served by GitHub Pages (GitHub, Inc.). Like any web server, the hosting infrastructure processes the technical data needed to deliver a page — including your IP address, the requested URL, the time and your user agent — and may retain it briefly in security and abuse logs. We do not have access to those logs and do not use them. GitHub's handling of them is governed by its own privacy statement. The legal basis for this processing is our legitimate interest in serving and securing the website (GDPR Art. 6(1)(f)).

15.When you email us

If you write to us for support, to report a bug or to exercise a right, we receive your email address, whatever you put in the message and anything you attach. We use it only to answer you and to fix what you reported. We do not add you to a mailing list, and there is no mailing list to add you to.

Please do not send us details of your consumption or your health unless they are genuinely necessary for the question — the app is built so that we never see them, and an email is the one way around that. Correspondence is kept while it is useful for support and then deleted, generally within 24 months.

16.Legal bases

Where the GDPR, the UK GDPR or the Swiss FADP applies, we rely on the following legal bases for the limited processing we actually carry out:

Where we rely on legitimate interests, we have weighed them against your rights and concluded the processing is limited, expected and low-risk. You can object at any time (see section 20). None of the processing described here involves what you track, because it never reaches us.

17.Who else is involved

We are a very small operation and we use a small number of established providers. With one exception, named below, nobody receives your data to use for their own purposes:

• Apple — App Store distribution and billing, iCloud sync, and CloudKit for the iOS referral ledger.
• Google — Google Play distribution and billing, and Firebase Authentication, Cloud Firestore and App Check for the Android referral ledger.
• RevenueCat — subscription status and reporting, under an anonymous identifier. United States.
• PostHog — usage analytics for the app and the website, on its European infrastructure.
• GitHub — static hosting of the website.
• TikTok — the advertising pixel on countrol.app/tiktok, and nowhere else. This is the exception: TikTok can use what it receives for its own purposes (section 13).
• Our email provider — for correspondence you send us.

Beyond that, we disclose personal data only where we are legally compelled to — a binding order from a competent authority — or where it is necessary to establish, exercise or defend a legal claim. Given the design of the app, a request for what someone tracks is one we could not comply with even if we were ordered to: we do not hold it. If Countrol were ever transferred to a new owner, personal data could pass to them as part of that transfer, and you would be told before it took effect.

18.International transfers

We are based in Switzerland. The providers above operate globally, so the limited data described in this policy may be processed outside your country, including in the United States — and, for what TikTok’s pixel collects, wherever TikTok’s own privacy policy says it processes data. Where such a transfer involves personal data protected by the GDPR, the UK GDPR or the FADP, it takes place under a lawful transfer mechanism — typically the European Commission's Standard Contractual Clauses together with the providers' own data processing terms, an adequacy decision, or a certification scheme where one applies. You can ask us for more detail about a specific transfer.

19.How long things are kept

• What you track: for as long as you keep it. It is on your device, so you decide, and deleting the app deletes it.
• Referral records: for as long as the programme runs and a reward may need to be honoured, because a redemption is deliberately write-once — that is what makes “one per account, ever” enforceable. You can ask us to erase yours (see section 22).
• Subscription records: kept by RevenueCat for as long as we use the service, because a subscription can be refunded, restored or disputed long after it was bought. The record is attached to an anonymous identifier, so tell us that identifier and we can have it erased (see section 22).
• App usage events: kept by PostHog under our account for as long as they are useful for the question they answer, and attached to an anonymous identifier. Tell us that identifier — or simply switch the setting off, which discards it — and we can have the events erased (see section 22).
• Website analytics: retained as aggregate statistics; because the site runs in cookieless mode, there is no individual record to keep or delete.
• TikTok’s pixel: what it sends is kept by TikTok under its own policy. The four cookies it sets on countrol.app expire after 90 days, and clearing your browser’s cookies removes them sooner.
• Server and abuse logs: kept briefly by the hosting provider under its own policy.
• Email correspondence: generally up to 24 months, then deleted.
• Records we must keep by law (for example anything tax-related): for the period the law requires.

20.Your rights

Under the GDPR, the UK GDPR and the Swiss FADP you have the right to: access the personal data we hold about you; have it corrected; have it erased; restrict or object to processing based on legitimate interests; receive it in a portable format; and withdraw consent where we relied on it, without affecting what was done before.

You can exercise any of these by emailing us at the address in section 29. We answer within one month, and we do not charge for it. There is one honest limitation worth stating plainly: for what you track, there is nothing for us to give you, correct or delete — not because we refuse, but because we hold none of it. Exercising those rights over your entries means using the app's own export and delete functions, which give you complete control without going through us.

To act on a referral request, we generally need the referral code concerned, since the identifiers in the ledger are opaque to us and it is the only way to locate the right records without collecting more data about you.

21.US state privacy rights

If you live in California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, the following applies in addition:

• The app does not sell your personal information or share it for cross-context behavioural advertising, and has no mechanism through which it could. The one thing on any of our surfaces that these laws could treat as a sale or as such sharing is TikTok’s pixel on countrol.app/tiktok (section 13); no other page of the website has anything like it.
• We do not use or disclose sensitive personal information beyond the purposes permitted under the CPRA, and we do not collect the sensitive information the app keeps on your device at all.
• You have the right to know what we collect and why, to request deletion or correction, and not to be discriminated against for exercising any of these rights. We do not offer financial incentives in exchange for personal information.
• The categories that could be involved are limited to online identifiers and internet activity, as described in sections 9, 12, 13 and 14. We do not collect the other statutory categories.
• The website honours Global Privacy Control signals: a browser that sends one never loads TikTok’s pixel, and that is how to opt out of it. Every other page sets no cookies and shares nothing, so there is nothing else to opt out of.
• You may use an authorised agent, and we may need to verify the request. Submit any request to the address in section 29.

22.Deleting your data

You have full control, and most of it does not involve us at all:

• Delete individual entries from the History tab in the app.
• Reset all data from the Settings tab, which restarts the app from scratch.
• Uninstall the app, which removes everything it stored on your device.
• iOS If iCloud sync was on, also turn it off and remove the app's iCloud data from Settings › [Your name] › iCloud.
• Android If device backup is on, delete the app's backup from your Google account's backup settings.
• Referral data: email us with your referral code and ask us to erase it. We will delete the code and the associated records, which also ends any reward attached to them. On Android, you can additionally disconnect the Google account you linked.
• Subscription record: email us and ask us to erase it. The record carries no name or email address, so we need something to find it by: send us the receipt Apple or Google emailed you for the purchase, and we will locate the record from the transaction and delete it. Erasing it does not cancel or refund the subscription itself, which is managed by Apple or Google, and it does not affect Countrol+ on your device.

Deletion of local data is immediate and irreversible. We cannot restore it, because we never had it — export anything you want to keep first.

23.Security

The strongest security measure here is architectural: data that is never transmitted cannot be intercepted, and a database we do not have cannot be breached. On top of that:

• App data is written to the operating system's private, app-sandboxed storage, protected by the device's own encryption when a passcode is set.
• The optional app lock adds biometric or passcode protection to opening the app.
• All network traffic the app makes is encrypted in transit (TLS).
• The referral ledger is protected by server-side rules that make records write-once and scoped to their owner, with Play Integrity attestation on Android, so the database itself enforces the rules rather than trusting the app.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Your device is the important part of this: use a passcode, keep the operating system updated, and be careful about who has physical access to it. If we ever become aware of a personal data breach affecting you, we will notify you and the competent supervisory authority as the law requires.

24.Children

Countrol is intended for adults only and must not be used by anyone under 18 (see the Terms of Use). We do not knowingly collect personal data from children, and the app's design means we collect almost none from anyone. If you believe a child has provided us with personal data through the referral programme or by email, contact us and we will delete it.

25.No profiling or automated decisions

We do not profile you, score you, segment you or make any decision about you by automated means, and none of the processing described here produces legal or similarly significant effects. The usage events in section 12 are read as totals across everyone — how many people reached a screen, not who — and nothing you see in the app is chosen, priced or withheld on the strength of them. The charts and insights in the app are calculated on your device, from your own entries, for you alone to read. What TikTok does with its pixel’s data (section 13), including for its own advertising, is governed by TikTok’s policy rather than this one.

26.Store privacy declarations

Our App Store privacy label and Google Play Data Safety declaration describe the practices set out in this policy. On the App Store, four categories are declared, all four under Data Not Linked to You:

• Purchases — the subscription record described in section 10.
• Identifiers — the anonymous identifiers those records are attached to, and the code used by the optional referral programme.
• Usage Data → Product Interaction — the usage events described in section 12, for as long as you leave them on.
• Diagnostics → Crash Data — crashes, with the stack they happened in.
• Diagnostics → Performance Data — how long the app took to become usable after you opened it.
• Diagnostics → Other Diagnostic Data — the failures the app used to swallow in silence, such as a save that did not take.

These are all of them, and every one sits under not linked to you. The same list appears in the app’s privacy manifest, which is shipped inside the app itself and which Apple reads independently — the two are written to agree, and if they ever disagree it is a mistake we want reported. In particular there is no Location, coarse or otherwise, because the IP address is discarded before anything is stored and nothing else in the app knows where you are; no Health & Fitness, because what you track never leaves the device; and no Contact Info, because we have none. Data used to track you stays empty: there is no advertising identifier, nothing is shared with a data broker, and nothing is combined with data from anyone else’s app or website.

They sit under not linked to you for a concrete reason: every identifier involved is generated on your device and we never send a name, an email address or any account of ours with it, so there is nothing for it to be linked to. Everything you actually track stays on your device and is declared nowhere, because it never reaches us. Someone who never buys and never uses the referral programme generates neither of the first two categories, and switching off Share Anonymous Usage Data generates none of the third.

• Data used to track you: none.
• Data used for advertising: none.
• Data shared with third parties for their own purposes: none.

If you ever find a difference between a store label and this policy, this policy is the accurate description of what the app does, and we will correct the label.

27.Not medical advice

Countrol is a self-tracking tool, not a medical device, and nothing in it is medical advice. The full disclaimer — including why you should speak to a healthcare professional before changing what you consume — is in section 4 of the Terms of Use. If you are in crisis or in a medical emergency, call your local emergency number.

28.Changes to this policy

We may update this policy as the app changes or the law does. The current version is always at countrol.app/privacyPolicy with the date at the top. Where a change materially affects how your personal data is handled, we will give notice through the app or the website before it takes effect. Continuing to use the Service after that means you accept the updated policy.

29.Contact and complaints

Questions about this policy, or a request about your data, go to . We read everything, and we answer.

If you are unhappy with how we have handled it, you have the right to complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU or the UK, the data protection authority of the country where you live or work. We would appreciate the chance to put it right first.