Built by a shooter who got tired of the spreadsheet.
Invictus RangeLog is a local-first iOS app for precision rifle shooters. It keeps the round counts honest, the maintenance on schedule and the load data in one place, and it does all of that without ever being able to look at your data.
What's in it
Firearm builds
A profile per rifle: action, barrel, trigger, muzzle device, optic, magazine, stock and extras. Swap any slot for a single outing or save the new configuration back to the rifle.
Derived round counts
Rounds are never stored on a part. They are the sum of every shot string fired while that part was mounted, so editing or deleting a session fixes the count everywhere automatically.
Maintenance intervals
Any number of intervals per item, each by kind: Cleaning every 600, Borescope every 1,200. Each one tracks rounds since the last event of its kind and flags due and overdue on its own.
Barrel life
Set an expected life and get a ring, an estimate of rounds left, and a "past life" warning. The group-size trend chart shows the barrel opening up against its round count.
Range logs
Date, location, conditions and a snapshot of the gear on the gun. Conditions can be filled from your location: temperature, humidity, station pressure, density altitude and wind.
Shot strings & chrono
Each string records a load and a round count. Import the CSV that Garmin ShotView shares from a Xero C1, or type velocities by hand, and see average, ES and SD per string and per load.
Targets & groups
Photograph a target, mark two reference points a known distance apart, tap the holes. Extreme spread, mean radius and MOA are computed and stamped with the barrel's round count.
Loads & components
Projectiles, powder, primers and brass with lots and specs. Loads carry charge, COAL, CBTO, jump and neck tension, can be assigned to rifles, and show every session they were fired in.
Export
A branded PDF history report for selling a barrel, and the same data as JSON. Generated on the phone; nothing is sent anywhere to make it.
Works offline
Everything lives in a database on your phone. Sync is opt-in, and the app is complete without it.
Secure from the ground up
Most apps encrypt your data "in transit and at rest", which means the company can still read it whenever it wants. RangeLog is different: the key never leaves your devices, so the server only ever sees ciphertext. If our servers were seized, leaked or subpoenaed tomorrow, the attacker would get a pile of random bytes with timestamps on them.
Key is born on your phone
On first sync the app generates a random 256-bit root key on your phone and optionally stores it in the iOS Keychain. It is never sent to us.
Every record is sealed
Each gear item, load, session, string, target and maintenance entry is serialised and encrypted with AES-256-GCM before upload. So is every target photo.
The server stores blobs
One opaque table: id, two timestamps, a key version and ciphertext. No table names, no fields, no photo-to-record links.
Your devices decrypt
Another device reads the data only if it has your key: via iCloud Keychain, an exported key file, or a device you approve.
- Cipher. AES-256-GCM via Apple CryptoKit, fresh 96-bit nonce per write. Sub-keys for records and photos are derived from the root key with HKDF-SHA256.
- Tamper binding. The record's id and sync timestamps are authenticated data, so the server cannot swap a blob onto another id or rewind a last-writer-wins stamp without decryption failing.
- Size hiding. Plaintext is padded to 256-byte boundaries so blob sizes don't reveal record types.
- Login without a password. The app runs PBKDF2-SHA256 (600,000 rounds) over your password on the phone and sends only the derived key. The server hashes that again with its own salt. Your actual password never crosses the wire.
- Identity hashing. Email and Apple subject are stored as HMAC-SHA256 under a server secret, enough to find your account, useless on their own.
- Transport hardening. HSTS, no CORS, no caching, rate limits per IP on login and per account on sync, opaque 30-day session tokens stored hashed.
The full design, threat model and what it does not defend against are in the security whitepaper.
Invictus Armory
RangeLog is made by Invictus Armory, a small shop run by a PRS competitor and reloader. It started as a spreadsheet, became a web app, and then was redesigned from the ground up to be secure. The tagline is a training philosophy, not a marketing line.
