Privacy Policy
Who is responsible
Invictus Mind and Invictus Plus are provided by Piotr Mateusz Dros, trading as Invictus Studio / Invictus PDM, United Kingdom. For privacy enquiries, access requests or account deletion, email contact@invictuspdm.uk. This notice covers the Android app com.invictusmind.app and its Plus account and subscription services.
Free app and optional Plus account
The free modules work without a Plus account. If you choose Plus sign-in, Firebase Authentication processes your email, account identifier, password authentication and email-verification status. Passwords are handled by Firebase Authentication; the billing API does not receive them. Signing in does not upload your existing Journal or activity records.
Advertising in the Basic version
The Basic version is supported by Google AdMob full-screen interstitial advertisements shown at natural breaks between free content. The app does not display these advertisements while a verified Plus entitlement is active or a previous eligible lifetime purchase has been confirmed. If the app cannot establish whether the installation is eligible for advertising, advertisements are withheld. Advertising needs an internet connection; lack of an available advertisement does not block access to the free modules.
Advertising privacy and your choices
Google User Messaging Platform (UMP) is used to obtain and apply advertising privacy choices where required before the app requests advertisements. This version requests non-personalised advertisements. Non-personalised advertisements can still involve technical data processing for delivery, measurement and fraud prevention. Open Info > Advertising privacy > Manage advertising privacy to review the privacy options form when it is available or required for your region. You can reset or delete the Android advertising identifier in your Android settings.
Data used by advertising services
When advertising is enabled, the Google Mobile Ads SDK collects and shares technical information with Google and its advertising services, including the IP address (which can indicate an approximate location), device or account-related identifiers such as the Android advertising ID and app set ID, app and advertisement interactions, and diagnostic or performance information. These data are used for advertisement delivery, measurement and analytics, security and fraud prevention, subject to applicable privacy choices. Google states that SDK data are encrypted in transit using TLS. The app does not request precise device location for advertising.
Health and personal records are not advertising inputs
The app does not send Journal text, photos or voice recordings, planner content, weight or avatar profile entries, stress ratings, exercise logs, focus records, step counts, or Health Connect data to AdMob, and does not use them to target advertisements. No such values are added to advertisement keywords or custom targeting. Advertising privacy choices do not grant access to these records. Google processes advertising data under its own applicable privacy and retention terms; see https://policies.google.com/privacy and https://policies.google.com/technologies/ads. For questions about information held by Invictus, contact contact@invictuspdm.uk.
What stays on your device
Journal text, selected photos and voice recordings, planner items, progress, profile and avatar settings, weight entries, self-reported stress, training logs, focus sessions and recorded steps are saved locally by the app. The Plus billing service does not receive these records. Local data is shared by people using the same app installation; changing a Plus account does not create a separate local Journal. Device backup or transfer features may copy app data according to your Android settings. Exports and sharing you initiate leave the app under your control.
Language settings and Plus reminders
Your interface language choice (English, Polish or Spanish) and the time of the last Plus reminder are stored on your device. Interface translations are bundled with the app; selecting a language does not send your entries to an external translation service. Basic may show a dismissible Plus reminder, no more than once every three days and once per app session. A reminder does not start a purchase or subscription.
Optional notifications
Daily reminders are scheduled locally on your device. Where the remote notification service is configured, optional remote notifications use Expo Push Service and Firebase Cloud Messaging. After you opt in with a verified Invictus account, we register a push token, a random installation identifier, your selected notification categories and app language with our notification backend. Notifications do not include your health, Journal or planner contents. Remote notifications are optional and do not require a Plus subscription. You can change categories or turn them off in Reminders; if you are offline, server removal is retried when the app reconnects. Registrations expire after 30 days and are renewed during active use only while you remain opted in. When the service is not configured, the app identifies it as unavailable and does not claim that delivery is active.
Optional Health Connect connection
If you choose Connect in Phone Health, Invictus Mind requests read-only access to the categories you select: steps, exercise sessions, sleep sessions and weight. You choose which categories to allow in the Android Health Connect permission screen. Data shared by compatible apps, including Samsung Health, can then be displayed while Invictus Mind is in the foreground. Steps and exercise show the current local day, sleep covers the previous 24 hours, and weight shows the latest shared record from the previous 30 days. These values stay temporarily in app memory for display; this integration does not save them in your Journal or Plus workspace, send them to our servers, use them for advertising or write changes to Health Connect. It does not add imported totals to the separate foreground step counter or replace your self-reported weight. You can refresh, manage access in Health Connect or disconnect to revoke all Invictus health permissions. Shared data availability and timing depend on your source apps and your permissions. This feature does not diagnose or treat medical conditions.
Subscription and security data
To verify Plus, the app sends a Google Play purchase token, a Firebase sign-in token and an App Check token to our service. Google Play supplies subscription status, product, plan, expiry and purchase-account binding. We store hashed purchase identifiers, hashed account references, ownership links, subscription status and expiry, plus rate-limit and temporary verification records. Hashes are pseudonymous, not anonymous. Raw purchase tokens are processed for verification and are not deliberately persisted by this version of the billing service.
Service providers and technical data
Google provides Firebase Authentication, App Check / Play Integrity, Firestore, Cloud Run and Google Play Billing. These services process technical information needed for authentication, integrity checks, security and operation, including network and device/app signals. Infrastructure may keep request metadata and operational logs; we do not intentionally log passwords, authentication tokens, purchase tokens or Journal contents. Google processes payment details; we do not receive your full card details.
Why we process data
Account and entitlement data are used to provide the Plus service you request and perform our contract with you. Integrity checks, ownership protections and request limits support our legitimate interest in preventing fraud and protecting accounts. Where required, records are retained to meet legal obligations. Optional local wellbeing entries are for your own use and are not sent to our billing server.
Permissions and choices
Microphone, selected media, activity recognition, notifications and device authentication are used only for the relevant features. You can manage permissions in Android settings. Step counting records foreground walking sessions; it is not a continuous location tracker. Biometric checking uses the device authentication interface; the app does not receive your biometric template. The Journal lock is an access control, not a promise of end-to-end encryption.
Retention and deletion
Local records remain until you delete them or clear the app's storage, subject to any copies in device backups or exports. Account records are kept while the account is in use. Billing ownership records are kept while needed to provide access, resolve purchases and prevent reuse of a purchase by another account. Security and legal records may need longer retention; we will explain any necessary exception when handling a deletion request. This version does not automatically erase billing records merely because a subscription expires.
Your rights and account deletion
You can request access, correction or deletion, and where applicable restriction, objection or portability, by emailing contact@invictuspdm.uk. We may verify that the account belongs to you. You can start an account-deletion request from Plus account in the app. Deleting an account is separate from cancelling Google Play billing and does not erase local files on your device. You may complain to the UK Information Commissioner's Office at ico.org.uk or your relevant local authority.
Hosting and transfers
The configured billing service and Firestore database are in London. This does not mean every Google authentication, support or integrity operation stays in the UK. Google services may process data internationally under their applicable data-processing terms and transfer safeguards. Contact us for information about the arrangements relevant to your data.
Updates
We will update this notice when data handling changes. Significant changes will be presented in the app as appropriate. Any future cloud backup, external AI processing or additional health integration needs a corresponding explanation before it is introduced.