Privacy policy

Effective: 30 September 2026. Last updated: 2 October 2026.

This Privacy Policy explains how FABERA YAZILIM HİZMETLERİ ANONİM ŞİRKETİ ("Fabera", "we", "us", or "our") collects, uses, discloses, retains, and protects personal data when you use the Countr mobile application, its widgets, this website, subscriptions, and related services (together, the "Service").

Fabera is the data controller for the processing described in this Policy. Our registered address and contact details are in Section 14.

1. Scope and your choices

This Policy applies to information processed through the Service and through support communications. It does not control independent processing by Apple, Google or other third parties under their own policies. This Policy is a privacy notice, not a contract or a request for consent. Where consent is legally required, we request it separately, and refusing that consent does not amount to rejecting this notice.

Some processing is necessary to provide the Service, such as unlocking a subscription and restoring purchases. Other processing depends on your choices: access to your photos and videos, your location, notifications and the camera each require your permission through iOS or Android, and each can be changed at any time in your device settings. Section 5 explains your choices for the advertising identifier on each platform and, in the European Economic Area, the United Kingdom and Switzerland, the consent form and how to change or withdraw your answer.

2. Categories of data we process

2.1 Travel data processed only on your device

The core of Countr runs on your phone (iPhone or Android). The following data is created, processed and stored in the app's storage on your device. It is not transmitted to Fabera or to any of our service providers:

• Photo and video metadata. If you allow access to your photos and videos, Countr reads the capture date, the capture location and the file name of photos and videos. Countr does not copy, upload or analyse the content of the images.
• Location history. If you allow location access ("While Using" and, optionally, "Always"), Countr records the places your device reports. On iPhone it uses iOS significant-change and visit monitoring. On Android it asks for battery-saving location updates about every 15 minutes, first "only while using the app" and, optionally, "all the time". It does not use continuous GPS tracking on either platform.
• Your travel record. Trips, days, countries and regions, trips you add or edit by hand, notes, gap-filling choices, the trackers you choose, and all calculated day counts and limit dates.
• Travel proofs. Photos, camera captures or files you attach to a day. These are stored in a protected area of the app and unlocked with Face ID, Touch ID, your fingerprint or face on Android, or your device passcode or screen lock. Biometric data is handled by the operating system; Countr never receives it.
• Settings and setup answers, such as your home country, goals, language and appearance.
• Widget data. A summary of your trackers is shared with Countr's widgets through storage on your device, so it can appear on your home screen and, on iPhone, your Lock Screen.

Country and region boundaries are bundled inside the app, so matching a place to a country requires no network request and no third-party map or geocoding service. Limit reminders are scheduled locally on your device; Fabera does not collect a push-notification token.

Exports (PDF or CSV files) are generated on your device and leave it only through the system share sheet, to the destination you choose. Once shared, a file is governed by the recipient's practices.

Moving to a new phone. Because Fabera holds no copy of your travel record, it moves to a new device only through your own device backup and restore (for example iCloud Backup, a computer backup, or Android backup to your Google Account) or by re-scanning your photo library on the new device. Exported files can be kept as your own record.

Local data can be lost if the app or its data is deleted, the device fails, or storage is corrupted. Unless technically excluded, local app data may be included in device backups made by Apple or Google under their rules and your backup settings.

2.2 Pseudonymous service identifiers

Countr has no user account. RevenueCat, PostHog and AppsFlyer each generate and maintain their own pseudonymous identifiers for subscription access, product analytics and attribution. These identifiers do not directly contain your name or email address, but they distinguish an app installation or provider record and may be linked through limited secondary fields where needed to measure subscription outcomes. We therefore treat them as personal data.

2.3 Subscription and transaction information

When you view or purchase a subscription, we and our providers may process the product identifier, offering, price and currency, subscription status, trial or introductory-offer status, purchase and renewal dates, store, storefront country, transaction and receipt identifiers, cancellation, expiration, refund, tax, commission and related entitlement information. Apple (on iPhone) or Google Play (on Android) processes your payment. We do not receive or store your full payment-card number or the password of your Apple Account or Google Account.

2.4 Device, network and technical information

We and our providers may process IP address, device and operating-system type or version, app version, language, locale, country or approximate location inferred from IP, request timestamps, crash or diagnostic information, Apple's Identifier for Vendor (IDFV), on Android the Google Play install referrer and the advertising ID (unless you have deleted or switched it off), an attribution-provider identifier, and similar technical identifiers. The IP address is not stored by our product-analytics provider.

2.5 Usage and interaction data

The app sends PostHog pseudonymous product-usage events used to understand onboarding, feature use, permission choices, paywall interaction and app reliability, such as which screens are opened, which buttons are tapped and which setup options are chosen, together with crash and error reports. Before an event is sent, the app removes fields containing countries, dates, coordinates, time zones and prices. PostHog therefore does not learn where you were or when. Session recording is disabled. We do not provide PostHog with the IDFA, the Android advertising ID, email addresses or phone numbers. Product analytics are not advertising tracking and are therefore not governed by the tracking prompt or by the consent form described in Section 5.1. Where the consent form is shown, product analytics record only that it was shown, how long it was open, and the category of the answer (everything allowed, some purposes allowed, nothing allowed, or the form could not load), so that we can check that the form works. The detailed choices and the consent record itself are not sent to PostHog.

The app sends AppsFlyer limited attribution milestones, such as completion of onboarding, a paywall view and subscription acceptance, together with install, session, device and campaign information processed by its SDK. These milestones contain no travel data.

2.6 Support and communications

If you contact us, we process the information you provide, such as your email address, message, attachments, device or subscription details, and anything else you choose to include. Our email provider, currently Google Workspace, processes these communications. Please do not send passwords, payment-card numbers, passport scans or travel documents unless we specifically need them to help you.

2.7 Data we do not request

Countr does not require your legal name, email address, postal address, phone number, passport or visa details, government identifier, contacts, microphone or health information to provide its core Service. If a future feature changes this, we will update this Policy and ask for any required permission before collection. We do not intentionally request special-category or sensitive personal data.

3. Why we process data and our legal bases

Depending on applicable law, we process data for these purposes and on these legal bases:

• Provide the Service: unlock subscription features, restore purchases, and respond to support requests. Basis: performance of our contract with you or steps taken at your request (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Subscriptions and records: process entitlements, trials, renewals, refunds and transaction records. Basis: contract performance and compliance with legal, tax, accounting and consumer-protection obligations (KVKK Art. 5(2)(c) and 5(2)(ç)).
• Security, fraud prevention and enforcement: verify entitlement state, detect misuse, investigate incidents, enforce our Terms, and establish, exercise or defend legal claims. Basis: legal obligations and our legitimate interests where they do not override your rights (KVKK Art. 5(2)(ç), 5(2)(e) and 5(2)(f)).
• Operation and improvement: understand feature use, diagnose crashes, measure onboarding and paywall performance, and test improvements. Basis: our legitimate interest in operating and improving Countr (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Attribution and campaign measurement: understand which advertising campaign led to an install or subscription and prevent attribution fraud. For limited measurement without the IDFA, the basis is our legitimate interest. On iPhone, IDFA access occurs only with your permission through Apple's tracking prompt. On Android, the advertising ID is used unless you have deleted it or switched it off in Android settings (see Section 5). In the European Economic Area, the United Kingdom and Switzerland, the use of your data by advertising partners for advertising measurement and personalised advertising is based on the consent you give or refuse in the consent form (GDPR Art. 6(1)(a) and the applicable rules on storing or reading information on a device), as described in Section 5.1.
• Legal compliance and corporate transactions: respond to lawful requests, comply with regulation, and manage a merger, financing, restructuring or asset transfer. Basis: legal obligation, protection of legal rights, or legitimate interests.

Processing of your travel data on your device is performed by the app at your direction; Fabera does not have access to it. We do not treat this notice or a permission as blanket consent: consent for one purpose does not authorise an unrelated purpose.

4. When and with whom we share data

We do not sell personal data for money. We disclose only information reasonably necessary for the purposes above, subject to contracts and safeguards where required. None of the recipients below receives your photos, locations, trips, countries, dates or day counts.

4.1 Service providers and platforms

• Apple: App Store distribution, subscriptions and payments, receipts and entitlements, refunds, App Tracking Transparency, and operating-system features such as photo access, location services, Face ID, notifications, widgets and backups.
• Google: Google Play distribution, subscriptions and payments, purchase tokens and entitlements, refunds, the Play install referrer, the advertising ID and its controls, and Android features such as photo access, location services, screen lock, notifications, widgets and backups.
• Google (consent form): in the European Economic Area, the United Kingdom and Switzerland, the consent form is provided by Google's User Messaging Platform, a consent management platform certified under the IAB Europe Transparency and Consent Framework. To decide whether the form applies and to display it, the app contacts Google when it starts. Google may then process technical information such as your IP address (used to determine your region), device type, operating system, language, the app's identifier, an advertising identifier where the operating system makes one available, and your consent choices. Countr contains no Google advertising SDK and displays no ads.
• RevenueCat, Inc. (United States): subscription offerings, purchase processing support, entitlement status, trial and renewal lifecycle, and subscription analytics. RevenueCat generates its own pseudonymous App User ID and may receive device and attribution identifiers and campaign fields as permitted. Through the RevenueCat–AppsFlyer integration, RevenueCat may send subscription-lifecycle and revenue events to AppsFlyer for attribution.
• PostHog, Inc. (United States): pseudonymous product analytics, feature flags and crash diagnostics, as described in Section 2.5.
• AppsFlyer Ltd. (Israel): install attribution, limited conversion events, campaign measurement and fraud prevention. AppsFlyer may process its own identifier, device identifiers, IP address, approximate location inferred from IP, user agent, campaign information and permitted event data. The IDFA is included only if you allow tracking; the Android advertising ID is included unless you have deleted it or switched it off.
• Advertising partners (Google, Meta Platforms, Pangle, which is the advertising network of the TikTok group, and AppLovin; together with AppsFlyer, these are the partners named in the consent form): receive attribution and conversion measurement through Apple's SKAdNetwork framework, the Google Play install referrer and our AppsFlyer integration, covering installs, app opens and selected subscription events with their values. On iPhone, device-level identifiers are shared with them for attribution only if you allow tracking; otherwise they receive aggregated measurement only. On Android, the advertising ID may be shared for attribution unless you have deleted it or switched it off. We never provide email addresses or phone numbers for advertising matching, and we do not use advertising SDKs from these partners in the app. A partner being named in this Policy or in the consent form means that we may use it for advertising measurement; it does not mean that we advertise with it at a given time or that it has received data about you.
• Apple Ads: attribution of installs that follow an Apple Ads campaign, through Apple's AdServices framework and SKAdNetwork. Apple provides a privacy-preserving attribution token that does not identify you to us and does not require tracking permission.
• Cloudflare: hosting, security and delivery of this website.
• Google Workspace: support email and related metadata when you contact us.

Provider privacy notices: Apple, Google, RevenueCat, PostHog, AppsFlyer, Meta, Pangle, AppLovin, Cloudflare.

Contracted processors generally process personal data only for the services they provide to Fabera, under contracts and applicable law. Apple, Google and any provider that independently determines the purposes and means of a processing activity may act as a separate controller for that activity, governed by its own privacy notice.

4.2 Legal, safety and business transfers

We may disclose information where reasonably necessary to comply with law, court orders, lawful government requests or regulatory obligations; to protect rights, property, safety or security; to investigate fraud or misuse; to enforce agreements; or to establish, exercise or defend legal claims. Because your travel record is not in our possession, we cannot disclose it. If Fabera is involved in a merger, acquisition, financing, restructuring, insolvency or transfer of all or part of its business, information we hold may be disclosed to advisers and transaction parties and transferred as part of that transaction, subject to applicable law.

5. Tracking, attribution and your choices

Countr uses attribution technology to measure advertising effectiveness and subscription outcomes. Apple may classify some identifier use as "tracking" when data is linked across apps or websites owned by different companies for advertising measurement.

On iPhone, Countr presents Apple's App Tracking Transparency prompt before accessing the IDFA. You are free to deny permission, and you can change your choice at any time in iOS Settings under Privacy & Security → Tracking. Your choice never affects the features of Countr.

• If you allow tracking, we and our attribution provider may use the IDFA and related device identifiers to attribute your install and selected subscription events to the campaign that led you to Countr, and share that attribution with the advertising partner concerned.
• If you do not allow tracking, we do not access the IDFA, advertising partners do not receive device-level identifiers from us, and measurement relies on Apple's SKAdNetwork, which reports aggregated results. Our attribution provider still processes ordinary technical information, such as IDFV and IP address, to count installs, deduplicate subscription events and prevent fraud; this is not used to track you across other companies' apps or websites.

On Android, there is no tracking prompt. Attribution uses the Google Play install referrer, which tells us which campaign link led to the install, and the advertising ID that Android provides to apps. You control the advertising ID in Android Settings under Privacy → Ads (or Google → Ads): you can delete it or reset it at any time. When it is deleted, our attribution provider does not receive it, and measurement relies on the install referrer and ordinary technical information. Your choice never affects the features of Countr.

5.1 The consent form in the European Economic Area, the United Kingdom and Switzerland

If your device is in the European Economic Area, the United Kingdom or Switzerland, Countr shows a consent form the first time you open the app, on iPhone and on Android, before any advertising attribution starts and, on iPhone, before Apple's tracking prompt. Elsewhere the form is not shown and the rest of this Section applies. Your region is determined by Google from your IP address when the app starts; we do not use your travel data for this.

• What it asks. Whether the partners named in the form (Google, AppsFlyer, Meta, Pangle and AppLovin) may store or read information on your device and use data about your installation and subscription events for advertising purposes, such as measuring which campaign led to an install and, where a partner offers it, personalised advertising. Countr itself shows no ads.
• Your choices. "Consent" allows all purposes and partners listed. "Manage options" lets you allow or refuse each purpose and each partner separately; every option there is switched off until you switch it on, and confirming without switching anything on is a refusal.
• Refusing is free. Your answer never changes the features, the price or the quality of Countr.
• Changing or withdrawing your answer. At any time, open Settings → Privacy choices in Countr. The form opens again, and there you can consent, refuse everything with "Do not consent", or adjust single options. A withdrawal applies from then on and does not affect processing that was lawful before it.
• What happens with your answer. The form saves your choices on your device in the standard format of the IAB Europe Transparency and Consent Framework. Our attribution provider reads them and passes them on with every attribution message, so that Google and the other partners know whether you consented. Where you did not consent, they are instructed not to use your data for the purposes you refused. The partners named above are permitted to rely on your consent only; we have not allowed them to rely on "legitimate interest" for the purposes in the form.
• What does not depend on the form. Whatever you answer, our attribution provider processes the technical information described in Section 2.4 to count installs, to avoid counting a subscription twice and to prevent fraud, on the basis of our legitimate interest. On iPhone, the advertising identifier (IDFA) is in addition available only if you also allow tracking in Apple's prompt. Subscription processing and product analytics (Sections 2.3 and 2.5) are not governed by the form.
• The form's wording. The text of the form is the standard text supplied by Google under the framework and is the same for many apps. Where it mentions "precise geolocation data" or "legitimate interest", that describes what the framework allows partners to request in general. It does not change what Countr does: Countr does not send your location, your trips, your countries or your dates to any partner, and this Policy describes the processing that actually takes place.

On iPhone, Apple's tracking prompt remains a separate question, asked after the form. The IDFA is never accessed unless you allow tracking in that prompt, whatever you answered in the form; and your answer in the form is passed on to the partners whatever you answered in the prompt.

Although we do not sell data for money, certain advertising-attribution disclosures could be considered "sharing", "targeted advertising" or a "sale" under some US state privacy laws. Where such a law applies, you may request the legally available opt-out by contacting us. The app does not use browser-based Global Privacy Control signals.

Travel data is never part of tracking. No location, country, date or trip is shared with an attribution provider or advertising partner.

6. International data transfers

Fabera is established in Türkiye. Our providers may process information in Türkiye, the United States, Israel, the European Economic Area and other countries where they or their subprocessors operate. These countries may have privacy laws different from those where you live. Where required, we use a lawful transfer mechanism appropriate to the provider and jurisdiction, such as an adequacy decision, the EU Standard Contractual Clauses with supplementary measures, the UK Addendum or IDTA, or an appropriate safeguard under KVKK Article 9. We also rely on data minimisation, access controls and contractual restrictions. This notice is not consent to an international transfer.

7. Data retention and deletion

We retain personal data only as long as necessary for the stated purpose and any applicable legal, tax, accounting, security, dispute or record-keeping period.

• Travel data on your device remains until you delete it. In Countr, Settings → Delete all my data erases your travel record, proofs and settings; Erase location data erases only location history. Deleting the app removes its local data from the device, but not copies in your own device backups or files you exported. On Android, Clear storage on the app's page in Android settings does the same.
• Pseudonymous provider identifiers and related records are retained according to each provider's storage behaviour, our configuration, operational need and legal obligations. Deleting the app may reset some device-side identifiers but does not itself erase provider records.
• Subscription and transaction records may be retained for contractual, accounting, fraud-prevention, dispute and legal limitation purposes.
• Analytics, crash reports, attribution data and support correspondence are retained according to operational need, provider settings, legal obligations and limitation periods.

We may retain aggregated or irreversibly de-identified information that can no longer reasonably identify you. A deletion request may not require deletion of information we must retain by law or need to establish, exercise or defend legal claims.

8. Security

We use reasonable technical and organisational safeguards, including data minimisation by design (travel data never leaves your device), encrypted transport, access controls, restricted production access, provider controls, separation of secrets from the app, separation between subscription, analytics and attribution identifiers, and device-level protection for travel proofs. No method of transmission, storage, software or third-party system is completely secure, and we cannot guarantee absolute security. You are responsible for securing your device, device passcode, Apple Account, backups and network.

9. Your privacy rights

Your rights depend on where you live and may be subject to legal conditions and exceptions. We may need to verify a request before acting.

9.1 Türkiye and KVKK

Under Article 11 of Law No. 6698 on the Protection of Personal Data ("KVKK"), you may have the right to learn whether your personal data is processed, request information about processing, learn its purpose and whether data is used accordingly, learn the recipients in Türkiye or abroad, request correction, request deletion or destruction where conditions are met, request notice of correction or deletion to recipients, object to an adverse result arising solely from automated analysis, and claim compensation for damage caused by unlawful processing. Where processing is based on explicit consent, you may withdraw it at any time with effect for the future.

9.2 EEA, United Kingdom and Switzerland

Where the GDPR, UK GDPR or equivalent law applies, you may have rights of access, rectification, erasure, restriction, objection and data portability; the right to withdraw consent without affecting earlier lawful processing (for the consent form, in Settings → Privacy choices, see Section 5.1); and the right not to be subject to certain solely automated decisions with legal or similarly significant effects. You may complain to the data protection authority where you live, work or believe an infringement occurred. We generally respond within one month, extendable by up to two further months for complex or numerous requests, with an explanation within the first month.

9.3 United States and other jurisdictions

Depending on your state or country, you may have rights to know, access, correct, delete or obtain a portable copy of personal data; opt out of sale, sharing, targeted advertising or certain profiling; and appeal a denied request. We will not discriminate against you for exercising a privacy right.

9.4 How to exercise a right

Most of your data is on your device and under your direct control: you can view, correct, export and delete it in the app. For data held by us or our providers, email support@fabera.ai. A formal KVKK application may be submitted by signed written application to our registered address or by another method permitted under the Data Controller Application Procedures and Principles Communiqué. Describe the right and enough information to locate the record, without sending passwords or payment-card details. Because the app does not display its pseudonymous provider identifiers, we will work with you on proportionate verification but may be unable to link an email address to a pseudonymous record without additional evidence.

We respond to a valid KVKK application as soon as possible and no later than 30 days, generally free of charge, subject to any fee permitted by law. A remote request cannot erase data stored only on your device or cancel a subscription bought through Apple or Google Play.

10. Children

Countr is not intended for anyone under 16 years old, and we do not knowingly collect personal data from anyone under 16. Users aged 16 or 17 may use Countr only with the permission of a parent or legal guardian. If you believe a person under 16 has provided personal data, contact us so we can investigate and take appropriate action.

11. Credits and open data

Countr works out the country of a place on your device, using boundary data bundled inside the app. That data, the icons and some of the software come from other people's work, used under these licences:

• Country boundaries: geoBoundaries, licensed under CC BY 4.0. The data was simplified and compiled into the app's own map format; changes were made to the original. Disputed areas follow the US Department of State lines the dataset ships with.
• Time-zone boundaries: timezone-boundary-builder, © OpenStreetMap contributors, licensed under the Open Database License (ODbL) 1.0. The data was simplified and compiled into the app's own map format; changes were made to the original. The pipeline that produces the bundled map is reproducible and available on request at support@fabera.ai.
• US state and city boundaries: US Census Bureau TIGER/Line, a US government work in the public domain.
• UK country boundaries: Source: Office for National Statistics licensed under the Open Government Licence v3.0. Contains OS data © Crown copyright and database right 2025.
• Icons: Solar icon set by 480 Design, licensed under CC BY 4.0.
• Flags: circle-flags by HatScripts, MIT licence.
• Typeface: Nunito, SIL Open Font License 1.1.
• Software: Flutter and the Dart SDK (BSD 3-Clause); SQLite (public domain) through the sqlite3 package (MIT); RevenueCat Purchases (MIT); PostHog (MIT), with its bundled PLCrashReporter and libwebp; the AppsFlyer SDK (proprietary, under AppsFlyer's terms); and other open-source packages under BSD, MIT and Apache 2.0 licences. The full licence texts are available on request at support@fabera.ai.

These credits describe materials inside the app. None of these sources receives any data from you.

12. This website

This website sets no cookies and uses no analytics, advertising or tracking scripts. Cloudflare processes ordinary connection data (IP address, browser, pages requested, timestamps) to deliver and protect the site, and keeps these logs briefly. The Schengen calculator stores the trips you enter only in your browser's local storage on your device; they are never sent to us. Before this website adds non-essential cookies or analytics, this Policy and any required consent controls will be updated first.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, law or processing practices. The "Last updated" date identifies the current version. Where required, we will give notice of material changes through an in-app message, this website or another reasonable channel, and request new consent if the law requires it. This Policy is written in English. Where we provide a translation for convenience, the English version governs in case of conflict, to the extent permitted by applicable law. Third-party links are governed by the destination's own terms and privacy notice.

14. Contact

Questions, complaints and privacy requests may be sent to: