Privacy
Bito 1.3.0 · Reviewed 8 October 2026
In short
Bito doesn't declare the INTERNET permission. Without it, the app can't connect anywhere: what you log stays on your phone. No accounts, no Bito servers, nothing to sync.
What it stores
Your habits and their entries, your tasks, your breathing sessions, points, badges, whatever Habi is wearing, your settings and the name you type. It all lives in the app's private storage, which other apps can't reach.
Bito has Android's cloud backup turned off (allowBackup="false"): your data stays out of the system backup. Uninstall the app and it goes with it. To keep it, use Bito's own backups, below.
What it avoids
No accounts, no analytics, no ads, no automatic crash reports. It uses no Google service: zero Google Play Services dependencies.
Each permission
The 1.3.0 APK declares eight permissions. Four are Bito's own; the other four come from Android libraries Bito uses and land in the APK at build time.
Its own
| Permission | Bito uses it for |
|---|---|
android.permission.POST_NOTIFICATIONS | Showing your habit reminders, task alerts, the breathing reminder and the timer countdown. |
android.permission.SCHEDULE_EXACT_ALARM | Getting each reminder and the end of the timer there on time. |
android.permission.RECEIVE_BOOT_COMPLETED | Scheduling the alerts again after the phone restarts. |
android.permission.VIBRATE | Vibrating when you log and at each breathing phase, if it's on in Settings. |
Added by libraries
| Permission | Comes from |
|---|---|
android.permission.WAKE_LOCK | WorkManager (androidx.work), Android's library for background work; in Bito, automatic backups. It lets the processor stay awake until a job finishes. |
android.permission.ACCESS_NETWORK_STATE | WorkManager. It checks for a network but can't connect: without INTERNET, nothing can. |
android.permission.FOREGROUND_SERVICE | WorkManager. It lets a long job keep running with a visible notification. |
com.alvarotc.bito.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION | AndroidX Core (androidx.core). An internal permission only the app itself can hold: it stops other apps from sending Bito the signals Bito sends itself. |
Check it yourself: download the APK and run aapt2 dump permissions app-release.apk (aapt2 ships with Android's build tools). For 1.3.0 it prints:
package: com.alvarotc.bito
uses-permission: name='android.permission.POST_NOTIFICATIONS'
uses-permission: name='android.permission.SCHEDULE_EXACT_ALARM'
uses-permission: name='android.permission.RECEIVE_BOOT_COMPLETED'
uses-permission: name='android.permission.VIBRATE'
uses-permission: name='android.permission.WAKE_LOCK'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='android.permission.FOREGROUND_SERVICE'
permission: com.alvarotc.bito.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
uses-permission: name='com.alvarotc.bito.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION'Backups
Backups go to the folder you pick in Android's file picker. That gives Bito access to that folder and nothing else: it isn't a system permission. Make them by hand or let them run on their own.
A plain backup is JSON any text editor can read. Add a password and it's encrypted with Argon2id and AES-256-GCM, and Bito doesn't store that password anywhere: without it, the backup won't open.
If another app or a cloud service syncs that folder, what happens to the file from there is up to that service, not Bito.
Only if you tap it
“Something not right?”, in Settings › About, opens a Tally form in your browser, no account needed. The other About links, like the source code and the license, open their page in the browser. Either way, you open the page and that site serves it, not Bito. The app sends nothing on its own.
Website
bito.alvarotc.com is served by Vercel and loads its typeface from Google Fonts. It sets no cookies and runs no analytics. Like any server, Vercel and Google Fonts see the IP address that asks for the page.
Contact, changes
Bito is developed and maintained by Álvaro Torres, an independent developer.
Any questions about this page, same form: Report a bug. If the page changes, so does the date at the top.