Privacy Policy.

Who and what

BITS & SETS is a notebook and setlist app for stand-up comedians, for iPhone (bundle be.grunt.bitsandsets), published by Grunt SRL, Rue du Couvent 20, 1332 Rixensart, Belgium, VAT BE 0738.575.618. You write bits — a premise and its beats — build setlists from them, read them on stage, and log how each show went.

Contact: bits@grunt.be

The core statement

BITS & SETS collects no personal data. There are no accounts, no sign-up and no login. Your bits, beats, setlists, shows and settings stay on your iPhone, encrypted. The app contains no code that can reach the network, so nothing is ever transmitted to the developer or to anyone else. The one thing that can leave the phone is a backup file you create yourself, and it is encrypted before it is written with a passphrase only you know.

How this is enforced

Everything below this section is the precise version. This one is the plain one: not what the app promises, but what actually stops it. A promise is a sentence someone wrote. Each of these is a mechanism that has to be deliberately removed before the promise can break.

There is no network code, and the build fails if any appears

The app never opens a connection because there is nothing in it that could. A check runs every time the app is built and fails outright if any network call — fetch, sockets, beacons, a remote URL — or any analytics or advertising kit appears anywhere in the code. The check first proves it can see such things, by planting each of them in scratch files and confirming it catches every one, before it is trusted to report that there are none.

Your material is encrypted on your phone

The database holding your bits, beats, setlists and shows is encrypted at rest (SQLCipher, AES-256), and the key lives in the iPhone's Keychain, generated on first launch and bound to that device. Copied off the phone, the file reads as noise. This has been true on every install from the first version; it is not a setting and not a paid feature.

Your material is kept out of device backups

Photos and messages ride your iCloud or computer backup. Your material deliberately does not: the database folder is flagged so that iOS excludes it from every backup channel. A copy in a device backup would be unreadable anyway — the key never leaves the phone it was made on — so excluding it costs nothing and keeps ciphertext out of places it cannot be used. It also means a new phone starts empty unless you restore your own backup file, which is the next section.

The backup file

Backup is off until you set a passphrase. Once you do, the app writes one file, bits-backup.enc, and everything about it is designed so that nobody but you can open it:

• Encrypted before it is written. The file is your whole notebook — bits, beats, setlists, shows, settings — encrypted on the phone with AES-256-GCM. The key is derived from your passphrase (PBKDF2-SHA256, 600,000 rounds, a fresh random salt every time), and the passphrase itself is never stored anywhere but your phone's Keychain, where it is bound to that device and excluded from device backups.
• Where it goes. Into your own iCloud Drive, in a folder named BITS & SETS — so it survives losing the phone and you can find it in the Files app. That is Apple's service, under your Apple account, governed by Apple's terms; what it holds is ciphertext that Apple, Grunt and anyone else can see exists but cannot read. If iCloud Drive is off for the app, the file is written to the app's own folder on the phone instead, and the Backup screen says so.
• When. Once when you set the passphrase, whenever you tap Back up now, and automatically when you leave the app — only if something changed since the last backup, and at most once every ten minutes. There is no schedule running in the background; the app writes the file as you put the phone down.
• Export. You can also hand the encrypted file to anything on the phone through the iOS share sheet — AirDrop, a message, another app. Where you send it is your decision; it is the same file, no less encrypted.
• There is no recovery. If you lose the passphrase, the file cannot be opened — not by you, not by Grunt, not by Apple. The app says this before it lets you set one and asks you to confirm you have written it down. It is a real limitation and we would rather state it than soften it.

Restoring reads a backup file, asks for its passphrase, shows you what the file holds against what the phone holds, and replaces everything on the phone only after you type REPLACE. Nothing about the restore is transmitted anywhere.

A setlist as plain text

A setlist can also be shared as plain text — the running order with each bit's chosen beats — through the same share sheet, for sending to a producer or a booker. That one is not encrypted, because you are choosing to send it to someone; it contains only the material you picked for that set, and nothing about your device.

What is stored, and where

Stored on the phone, in the encrypted database:

• Bits: the premise, each beat's text and type, status, language, tags, and when it was last edited or archived
• Setlists: name, venue, date, target length, which bits and which of their beats, per-bit notes
• Shows: when a set was performed, how each bit did (killed, OK, died) and any note you added
• Settings: your speaking pace, pause lengths, default language, appearance, and when the last backup was written

Stored in the iPhone's Keychain, bound to this device and excluded from backups:

• The database key, generated on first launch
• The backup passphrase, once you set one

The search index is derived from your bits and lives in the same encrypted database. Nothing is stored anywhere else — no plain preferences file holds anything that names a bit, a beat or a set.

What the platform can see

"Nothing leaves the phone" and "nothing leaves the app" are different claims, and only the first is true — so here is the second, precisely. In performance mode the app asks iOS to keep the screen awake; that is a request, not data. If you use backup, iOS and iCloud Drive see that a file of a certain size exists, and nothing about its contents. The app hands nothing to the lock screen, to Siri, to Spotlight or to any widget, because it has none of those.

Permissions, and why there are none

The app asks for no permission at all: no location, no camera, no microphone, no contacts, no photos, no notifications, no tracking. Its only capability is the iCloud Drive container for the backup file, which is a grant to write a file into your own iCloud Drive, not a permission to read anything.

The App Store privacy label reads Data Not Collected, which is the whole of it.

Retention and deletion

Data is kept until you delete it. A bit is archived first, and deleted for good from the archive in the app; a setlist is deleted from its list; uninstalling the app removes the database and its key with it. A backup file in your iCloud Drive is yours to delete in the Files app. Since nothing is transmitted, there is nothing for the developer to delete on request.

Third parties, ads, children

No advertising, no third-party analytics kits, no data brokers, no sale or sharing of personal information. BITS & SETS is not directed at children under 13.

This website

The same standard applies to grunt.be itself, including this page and the BITS & SETS pages. They are plain static files.

• No cookies. Nothing is written to your browser's storage, so there is no consent banner — there is nothing to consent to.
• No analytics and no advertising. No Google Analytics, no Google Ads, no Meta pixel, no tracking pixels of any kind, and no third-party tags.
• No third-party requests at all. Fonts are self-hosted rather than loaded from Google Fonts, and every image, stylesheet and script is served from grunt.be. The pages carry a content security policy that forbids the browser from connecting anywhere else. Loading them sends your browser to no other company's server.
• Nothing to submit. There are no forms, no newsletter, no sign-up, and no account.

One honest caveat: the site is hosted by Netlify, and like any web host it necessarily receives the IP address of each request in order to send the page back. That is ordinary server operation, not analytics — it is not used to profile visitors, and it is not combined with any app data, because the app sends none.

GDPR

Grunt SRL is established in Belgium, and the General Data Protection Regulation (EU) 2016/679 applies.

Because all processing happens locally on your own device and no personal data is transmitted to or held by the publisher, the publisher holds no user data to access, rectify, port, or erase. You retain full control through the app itself: your material is yours to view, export, back up or delete at any time.

Questions can go to bits@grunt.be. You also have the right to lodge a complaint with the Belgian supervisory authority, the Autorité de protection des données (autoriteprotectiondonnees.be).

Changes

Material changes will be reflected on this page, with an updated date at the top.