Privacy Policy

Effective date: July 2, 2026

This Privacy Policy explains how Victus Inc. ("Victus," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use the Victus mobile app and our website at https://victus-us.com (together, the "Service"). Victus is a meal subscription and delivery service that lets you plan meals from partner kitchens and have them delivered.

By using the Service, you agree to the practices described in this policy. Please also read our Terms of Service. If you have questions, contact us at info@victus-us.com.

A Quick Summary

Here is the short version. The rest of this page has the details.

• We collect the information we need to create your account, verify your phone, plan your meals, take payment, and deliver your orders.
• We never store your full card number. Card details go directly to our payment processor, Stripe.
• We share limited information with the specific companies that help us run the Service (for example, the delivery provider and the partner kitchen preparing your food).
• We do not sell your personal information, and we do not use advertising or cross-app tracking tools in the app.
• You can delete your account and your data directly in the app, or by emailing us.

Information We Collect

We collect the following categories of information, mostly directly from you when you sign up and use the Service.

Account information

• Name and email address, which you provide when you create an account (by email and password, or by signing in with Google or Apple).
• Your password if you sign up with email. Passwords are handled through our authentication provider and are stored in hashed form, not in plain text.
• An optional profile photo, if you choose to add one.

Phone number

We collect and verify your mobile phone number using a one-time code sent by text message. A verified phone number is required before your first payment so that we (and the delivery courier) can reach you about your delivery. We store your phone number and whether it has been verified.

Delivery addresses

When you add a delivery address, we collect the street address, apartment or unit, city, state, ZIP code, and the approximate map coordinates (latitude and longitude) of that address so we can determine coverage and route your delivery.

Health and fitness details you choose to provide

During onboarding you may enter your height, weight, and resulting body mass index (BMI), and select an activity level. We use these only to estimate a calorie target and suggest meal plans. Your activity-level selection is used to make an on-device estimate and is not stored on our servers. You are not required to share these details to browse the app, though some personalized recommendations rely on them.

Meal plans, orders, and meal customizations

We store your weekly meal plans, the meals you select, any customizations you make, and your order history, so we can prepare, bill, and deliver your orders and show you your history.

About allergens and dietary preferences: Victus does not maintain a separate profile of your food allergies or dietary preferences. Allergen and ingredient labels shown in the app describe the meals themselves (menu data provided by partner kitchens), not you. When you customize a meal — for example, by adding or removing an ingredient — those choices are saved as part of that order so it can be prepared correctly.

Payment information

Payments are processed by Stripe. When you add a payment method, your card details are sent directly to Stripe and are used to create a secure payment token. Your full card number never touches Victus servers and is never stored by us. What we keep is a Stripe customer identifier and records of your charges and invoices (for example, the amount, date, and a receipt link). Apple Pay and Google Pay are also supported through Stripe's payment sheet.

Device and push-notification data

To send you order updates, we collect a push-notification token and your device platform (iOS or Android) when you sign in. Push notifications contain order-status information such as the title and body of the update; we do not use them to collect additional information about you.

Location information

With your permission, we access your device's precise location to show your position on the map and to find nearby partner kitchens. This is described in detail in the Location Information section below.

Technical information

Our servers briefly process your IP address to protect the Service from abuse (for example, rate-limiting requests). These records are keyed to the request, not attached to your profile, and are used only for security and reliability.

Information from sign-in providers

If you sign in with Google or Apple, we receive basic identity information from that provider, such as your email address and (from Apple, only the first time you authorize) your name.

What we do not collect

• We do not collect your date of birth or age.
• We do not use third-party analytics, advertising, attribution, or crash-reporting SDKs in the app, and we do not track you across other apps or websites.

How We Use Your Information

We use the information above to:

• Create and secure your account and verify your identity and phone number.
• Build and manage your meal plans and provide personalized meal and calorie suggestions.
• Process payments and apply any credits or meal-token balances to your orders.
• Prepare, dispatch, and deliver your orders through our partner kitchens and delivery provider.
• Send you transactional messages, including order-status push notifications and phone verification texts.
• Respond to your support requests.
• Protect the Service, prevent fraud and abuse, and maintain reliability.
• Comply with our legal obligations and enforce our Terms of Service.

How We Share Your Information

We share personal information only with the service providers that help us operate the Service, and only the information each one needs. We do not sell your information and we do not share it for advertising. The providers we use are listed below, along with what each one receives.

Supabase (hosting, database, authentication, storage)

Supabase provides the cloud infrastructure that runs the Service, including our database, account authentication, file storage, and server functions. Most of the personal information described in this policy is stored on Supabase infrastructure on our behalf.

Stripe (payments)

Stripe processes your payments. Stripe receives your card details directly (never through us), along with your name, email address, the payment method you provide, and an internal account identifier. Stripe maintains its own records of your customer profile and charge and invoice history in accordance with its retention practices and its own privacy policy.

Firebase Cloud Messaging and Apple Push Notification service (push delivery)

We use Google's Firebase Cloud Messaging and Apple's Push Notification service to deliver push notifications. These services receive your device push token, platform, and the notification content (order-status title and body). We do not use Firebase Analytics or Crashlytics.

Uber Direct (delivery)

To deliver your order, we share with Uber Direct your first and last name, phone number, drop-off address (street, apartment, city, state, ZIP, country), any delivery notes, and an order manifest (meal names, prices, quantities, and order total), together with the partner kitchen's pickup details. In return, Uber provides us the assigned courier's name and phone number and a hosted tracking link.

Square (partner-kitchen order forwarding)

We forward your order to the partner kitchen through Square. Square receives the meal name, ingredient customizations, and — inside the order note — your delivery street address, the target delivery time, and any meal notes, so the kitchen can prepare and label your order for the courier. Payment is recorded to the kitchen as an external payment collected by Victus through Stripe.

Google Places and Google Maps (address lookup and maps)

When you type an address, we use Google's Places service through our server to offer address suggestions. Google receives the address text you type, a place identifier, and a session token. We also use the Google Maps SDK to display maps in the app.

Google and Apple (sign-in)

If you choose to sign in with Google or Apple, those companies act as identity providers and process your sign-in in accordance with their own privacy policies.

Twilio (verification text messages)

Phone verification codes are delivered by SMS through our authentication provider using Twilio. Twilio receives your phone number in order to send the message.

Legal and safety disclosures

We may disclose information if required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request. If Victus is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

Location Information

We want to be precise about how location works in Victus:

• When you allow it, we access your device's precise location to show your position on the map and to find nearby partner kitchens (including before you have created an account).
• We access location only in the foreground, on demand. Victus does not track your location continuously and does not collect location in the background. Your on-device position is used during your session and is not stored to your profile.
• Your delivery address (including its map coordinates) is stored and shared with the delivery provider so your order can be routed and dropped off.
• During delivery, live courier tracking is provided through Uber's hosted tracking page, which you open from the app. We do not track your device's location during delivery.

You can change or revoke location permission at any time in your device settings. Some map and nearby-kitchen features may not work without it.

We Do Not Sell Your Personal Information

We do not sell your personal information, and we do not share it with third parties for their own advertising or cross-context behavioral advertising. We use no data brokers and no advertising SDKs. The only sharing we do is with the service providers described above, so we can operate the Service for you.

Data Retention

We keep your personal information for as long as your account is active and as needed to provide the Service, and afterward only as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we remove your data from our systems as described below.

Please note that some records are held by our service providers under their own retention rules and are not automatically removed when you delete your Victus account:

• Stripe retains your customer record and charge and invoice history for its own financial and legal recordkeeping.
• Orders and deliveries that have already been transmitted to Square (partner kitchens) or Uber Direct are not recalled from those providers.
• Any remaining meal-token balance is forfeited on deletion and is not refunded or transferable.

Deleting Your Account and Your Data

You can delete your account at any time. In the app, go to your profile settings and choose to delete your account, or visit Delete your account for step-by-step instructions. If you cannot access the app, email us at info@victus-us.com from the address on your account and we will process the deletion for you.

When you delete your account, we:

• Cancel any active subscription first. If we cannot successfully cancel your billing, we stop and do not delete the account, so you are never left being billed on a deleted account.
• Cancel your pending and in-progress orders.
• Delete your account and the data associated with it — including your profile, addresses, subscription record, orders and meal plans, invoices, notifications, saved meal customizations, token balance, and push-notification tokens.

As noted in the Data Retention section, certain records held by Stripe, Square, and Uber Direct are retained by those providers under their own policies.

Your Privacy Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date (you can update most of your details directly in the app).
• Delete your account and personal information.
• Portability — receive a copy of certain information you provided in a usable format.
• Opt out of any sale or sharing of personal information (note: we do not sell or share your information for advertising).

To exercise these rights, use the tools in the app or email us at info@victus-us.com. We will verify your request using the information associated with your account and will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it; to request deletion or correction of your personal information; and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law.

The categories of personal information we collect are: identifiers (such as name and email); customer records (such as phone number, delivery address, and payment information); protected classification and health-related characteristics you voluntarily provide (such as height, weight, and BMI); commercial information (such as orders and meal plans); geolocation data; internet or network activity (such as IP address for security); and inferences we draw to suggest meals. We collect these from you and from your sign-in provider, and we disclose them to the service providers listed above for the business purposes described in this policy. You may designate an authorized agent to make a request on your behalf. You have the right not to receive discriminatory treatment for exercising your rights.

European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in these regions, you have the rights to access, rectify, erase, restrict, and object to the processing of your personal information, and to data portability, and you may withdraw consent at any time where processing is based on consent (such as location access and push notifications).

We rely on the following legal bases: performance of a contract (to provide the Service you request, including planning, billing, and delivery); legitimate interests (to secure the Service and prevent abuse); consent (for precise location and push notifications); and legal obligation (for financial and compliance recordkeeping). You also have the right to lodge a complaint with your local data protection authority.

International Users and Data Location

The Service is offered in the United States, and your information is stored and processed in the United States by us and our service providers. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location.

Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies under local law). If you believe a child has provided us personal information, please contact us at info@victus-us.com and we will delete it.

Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including encryption of data in transit and reliance on Stripe's PCI-compliant systems for card handling. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your account credentials confidential.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy. The current version is always available at https://victus-us.com/privacy.

Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at info@victus-us.com. This is the best way to reach us, and you can also find help through our Support page.

Victus Inc. · https://victus-us.com