Privacy Policy

Privacy Policy

Effective October 19, 2026 · Applies to the Invictus RangeLog iOS app and the sync service at shooting-tracker-api.kinabrew.dev

Short version. Your shooting data lives on your phone. If you turn on sync, it is encrypted on your phone with a key we never receive, so the only things our server can see are that an account exists, when it syncs and how much encrypted data it holds. We do not sell data, run ads, or use analytics SDKs.

1. Who we are

Invictus RangeLog ("the app") is published by Invictus Armory ("we", "us"). Contact: support@invictusarmory.com.

2. Data stored on your device

The app keeps a database on your device containing what you enter: firearms, gear and their specifications, maintenance events and intervals, ammunition components and loads, range sessions (date, title, location text, weather conditions, notes), shot strings, chronograph velocities, target photos and the measurements you mark on them. This data stays on the device unless you enable sync. Deleting the app deletes it.

Target photos you take or choose are stored in the app's private container, not in your Photos library, unless you save them there yourself.

3. Permissions the app may ask for

  • Camera and Photos. Only when you add a target photo. Used to capture or select the image; nothing is uploaded unless sync is on, and then only encrypted.
  • Location (while using). Only when you tap "Fill from my location" in a range log. Your coordinates are sent once to Open-Meteo (open-meteo.com), a weather service, to retrieve current conditions, and to Apple's geocoder to get a place name. We do not receive or store your location. Open-Meteo's handling of requests is governed by its own privacy policy.
  • Files. When you import a chronograph CSV, export a report, or export or import your encryption key. Files go only where you choose.

4. The optional sync service

Sync is off by default. If you create an account and turn it on, the app encrypts every record and photo on your device with a 256-bit key generated on the device (AES-256-GCM). The key is stored in your device's Keychain and, if you choose, in iCloud Keychain, which Apple end-to-end encrypts. The key is never sent to us.

What our server stores for a synced account:

  • An account identifier we generate.
  • A keyed hash (HMAC-SHA256 under a server secret) of your email address, and, if you use Sign in with Apple, of the Apple user identifier. We do not store the email or Apple identifier themselves, nor your name.
  • For email accounts, a salted hash of a key the app derives from your password. Your password is never sent to us.
  • Hashed session tokens, with creation, last-use and expiry times.
  • Encrypted records: an identifier, two timestamps (modified, deleted), a key version number and ciphertext. We cannot determine what kind of record a blob is or read any of its fields.
  • Encrypted photos, under random identifiers, with no link to any record that we can see.
  • A per-account sequence counter used to order sync.

We cannot read, search, aggregate or recover your synced content. If you lose every device holding your key and your exported key file, the server copy is unrecoverable; the app lets you replace it from any device you still have.

5. Server logs

The sync service runs on Cloudflare Workers. Cloudflare's edge records request metadata (IP address, timestamp, request path, status code) for operation and abuse prevention, retained per Cloudflare's policies. Our own application logs record errors and request paths only; they never contain request bodies, tokens or key material.

6. What we do not do

  • No advertising, no ad identifiers, no tracking across apps or sites.
  • No third-party analytics or crash-reporting SDKs.
  • No sale, rental or sharing of personal data with third parties, except the processors named here (Apple, Cloudflare, Open-Meteo) as needed to provide the feature you invoked.

7. Your choices and rights

  • Use it without an account. Every feature works offline.
  • Delete server data. Settings → Sign Out & Delete Server Data removes all encrypted records and photos from the server while keeping your local copy.
  • Delete your account. Settings → Delete Account removes the account, its hashes, tokens and all encrypted data immediately. There is no retention period.
  • Export. Barrel reports export as PDF and JSON; your encryption key exports as a file.
  • If you are in a jurisdiction with data-subject rights (GDPR, UK GDPR, CCPA/CPRA and similar), you may exercise them by email. Because we hold only ciphertext and hashes, access and portability are fulfilled from your device; erasure is immediate via the controls above or on request.

8. Children

The app is intended for adults and is not directed at children under 13 (or the age of digital consent where you live). We do not knowingly collect data from children.

9. Security

Beyond the client-side encryption described above, the service uses HTTPS with HSTS, rate limiting, hashed credentials and tokens, and stores no plaintext identities. The design and threat model are documented and available on request. No system is perfectly secure; a compromised or jailbroken device, or a weak device passcode, can expose data that the app itself protects.

10. Changes

We will post any changes to this policy on this page and update the effective date. Material changes will be noted in the app's release notes.

11. Contact

support@invictusarmory.com