Privacy Policy

We collect only what helps the app work for you:

• Account info — name, email, and password (if you create an account).
• Things you share — tasks, notes, requests for support, optional reflections or journaling (these remain private unless you choose to share them).
• App activity & device data — usage, basic analytics, app version, and crash reports to keep things running smoothly.
• Device tokens — push notification tokens to deliver alerts you've requested.

Under GDPR, we need a legal reason to process your personal data. Here's ours:

• Contract performance — we process your account info and content to provide the service you signed up for.
• Legitimate interest — we use analytics and crash reports to improve the app and keep it stable. We've assessed that this interest is proportionate and does not override your privacy rights.
• Consent — we send push notifications only when you've opted in. You can withdraw consent at any time in your device settings without affecting anything that happened before.

Your data helps us provide and improve the service — nothing more:

• Operate the app and help you manage tasks and community connections.
• Send gentle reminders or notifications when you allow them.
• Improve features and respond to support requests.

We do not sell your information. Ever.

We share data only with the trusted services below that help us run the app. When you share a task or request, it's visible only to the people you select.

• Heroku (Salesforce) — app hosting and infrastructure. Privacy policy
• Google Analytics & Firebase — app analytics, crash reporting, and push notifications. Privacy policy
• Amazon Web Services (SNS) — push notification delivery. Privacy policy
• SendGrid (Twilio) — transactional email delivery. Privacy policy

Vicus is operated from the United States. If you're located in the EU or EEA, your personal data will be transferred to and processed in the US.

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal safeguard for these transfers. Our processors — Heroku, Google, AWS, and SendGrid — each maintain SCCs or equivalent protections.

A note on Firebase: Google Firebase transfers analytics and crash data to Google's US infrastructure. Some EU data protection authorities have scrutinized similar setups. If you'd prefer to opt out of Firebase analytics data collection, contact us and we'll honor that request.

You have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Restriction — ask us to pause processing while a concern is resolved.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — for consent-based processing (e.g. push notifications), withdraw at any time without affecting prior processing.

To exercise any of these rights, email us at support@vicus-app.com. We'll respond within 30 days.

EU/EEA residents: You also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

California residents (CCPA): You have the right to know what personal data we collect, request its deletion, and opt out of sale (we don't sell data).

Texas residents (TDPSA): You have the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising or sale of personal data (we do neither).