Privacy Policy

1. Core Privacy Commitment: 0 Bytes Leave Your Device

BIT is engineered from the ground up as a sovereign, offline-first personal AI assistant for Android. We believe that your thoughts, documents, audio recordings, and agent execution plans belong exclusively to you.

2. On-Device AI Processing

When you run BIT in local inference mode, all computations are executed entirely on your Android hardware silicon (CPU, GPU via Vulkan/OpenCL, and NPU):

• Language Models (GGUF): Model weights run natively through compiled C++ llama.cpp kernels. Prompts, context trees, and reasoning traces remain strictly inside local RAM.
• Speech & Voice (STT & TTS): Speech recognition (Whisper via sherpa-onnx) and voice synthesis (Piper neural engine) operate 100% offline. Microphone audio is never transmitted across a network.
• Document Retrieval (RAG & Memory Vault): Embeddings are generated locally using quantized BGE models. Semantic search vectors and full text are stored in a local, encrypted SQLite database.
• Vision Processing: Visual question answering and image inspection run on-device through multimodal projector tensors without cloud relays.

3. Hardware-Backed Encryption (Memory Vault)

All persistent state—including chat transcripts, long-term memory facts, and ingested document vectors—is secured using our Memory Vault system:

• Hardware-Backed Keys: Storage encryption uses AES-256-GCM. Cryptographic keys are generated inside the Android KeyStore System (Hardware TEE / StrongBox Keymaster), guaranteeing that keys cannot be extracted even from rooted devices.
• User-Controlled Data: You have absolute authority to delete specific conversation threads, wipe vector collections, purge indexed documents, or export an encrypted backup archive directly from the app settings.

4. Optional Cloud API Providers (BYOK)

BIT optionally allows you to connect external OpenAI-compatible or Anthropic API endpoints for larger cloud models. If and only if you choose to use this feature:

• Bring Your Own Key (BYOK): BIT never provides cloud API keys or routes requests through any developer intermediary. You provide your own API credentials.
• Direct Point-to-Point TLS: Network calls are transmitted directly between your phone and your chosen provider's official endpoint over encrypted HTTPS.
• Encrypted Key Storage: Your API keys are encrypted locally using the Android KeyStore and are never transmitted anywhere except the intended provider.
• Third-Party Policies: The privacy practices and data retention policies of your selected API provider govern all requests sent to that external service.

5. Network Connections & Permissions

BIT requests Android network permissions solely for transparent, user-initiated features:

• Model Sideloading: Downloading verified quantized model weights and voice assets directly from Hugging Face or user-specified URLs over HTTPS.
• Web Search Plugin (Agent Mode): When explicitly enabled for a query, web search terms are sent directly to DuckDuckGo to retrieve real-time facts. This can be toggled off at any time.
• Developer Linux Workspaces (PRoot): When initializing a Linux container, root filesystem archives (Ubuntu, Alpine) are pulled directly from official distribution mirrors with SHA-256 integrity verification.
• Version Check: Periodic update checks query the public GitHub Releases API. No device identifiers or user telemetry are sent.

6. Device Permissions

Every requested Android permission is mapped strictly to a local capability:

• Microphone (RECORD_AUDIO): Used exclusively to stream real-time acoustic frames into the on-device Whisper model during Live Voice mode. Audio is discarded immediately after inference.
• Storage (Storage Access Framework): Used solely to import GGUF model files, index PDF/text documents into the RAG vault, or save exported backups upon your explicit selection.
• Foreground Service: Used to maintain continuous execution for long background model downloads or extended agent reasoning without being killed by the Android OS.

7. Children's Privacy

BIT does not collect, store, or transmit personal information from anyone, including children under the age of 13.

8. Open Source Verification & Contact

BIT is free, open-source software licensed under the Apache License 2.0. The complete source code is publicly accessible on GitHub, allowing security researchers and users to independently audit and verify our zero-telemetry architecture.

If you have questions, feedback, or security inquiries regarding this Privacy Policy:

• GitHub Repository: github.com/jaswanthsanjay88/Bit
• Discord Community: discord.gg/v75PxaJDy
• Email: [email protected]