Privacy Policy

Effective date: October 9, 2026

Bit & Grain Technologies LLC ("we," "us," or "our") operates the Bit & Grain platform: the website at bitandgrain.app, the web application, the Bit & Grain iPhone app and its Apple Watch app, and the Bit & Grain Android app (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have, including how we handle phone numbers and text messages.

1. Our role for your clients' information

Contractors use the Service to run their businesses. When a contractor, or a contractor's client, puts information about that client into the Service (for example a name, phone number, address, messages, or photos of the job), the contractor is the business responsible for that information. The contractor decides what to collect and why. Bit & Grain processes it on the contractor's behalf and following the contractor's instructions, to provide the Service. We do not use it for our own purposes.

There are two exceptions, where we decide how the information is used:

• Text message opt-in records, which we keep so we can prove consent and honor STOP requests for the text messaging service we run.
• Abuse prevention data, such as IP addresses and browser details on request forms, which we use to prevent spam, fraud, and abuse of the Service.

If you are a contractor's client and want to see, correct, or delete what a contractor holds about you, please ask the contractor. If you contact us instead, we will forward your request to the contractor and help them respond.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and sign-in details. You can sign in with an email and password or a one-time email link. You can also sign in with Google (on the web, iPhone, and Android) or with Apple (on the web and iPhone); if you do, we receive your name, email address, and an account identifier from that provider. When you sign up, sign in, or reset your password with email, we use Cloudflare Turnstile to check that the request comes from a person and not a bot; Turnstile receives technical information about your browser or device to do this. We also check signup email addresses against lists of throwaway email domains to prevent fraud.

Business Data

Data you enter into the Service is stored to provide it to you. This includes equipment, jobs, job notes, clients and their contact details, estimates, change orders, invoices, payments you record, expenses, receipts, purchase orders, appointments, time and clock records, mileage trips, messages with your clients, photos, documents, and other business records. Members of your business team can see business data according to the role the business gives them.

Photos, Files, and the Camera

If you allow camera access, the apps use the camera only when you choose to take a photo or scan something, for example a receipt, a job site, equipment, a barcode, or a document. You can also choose photos and files from your device. Only the photos and files you pick are uploaded.

Photos can carry information your camera saves inside the file, which can include where and when the photo was taken. Receipt photos are saved again without that location information. Other photos and files keep whatever location information your camera saved. If you do not want a photo's location stored, turn off location tagging in your camera settings before you take it.

Microphone and Voice Input

Grain AI can take your request by voice. The apps use the microphone only while you are holding or tapping the voice control.

• iPhone and Android:your phone's own speech recognition turns your voice into text. It runs on your phone when your phone supports that for your language; otherwise your phone's speech service (Apple's on iPhone, or your phone's default service, normally Google's, on Android) processes the audio under that company's terms. Bit & Grain receives only the text, as the message you send to Grain AI. The apps do not record, store, or upload the audio to us.
• Web:on Pro plans and during the free trial, voice input in the browser streams your audio directly from your browser to Deepgram, our speech-to-text provider, which returns the text. We tell Deepgram not to use the audio to improve its models. When Deepgram is not available, your browser's built-in speech recognition is used, which may send audio to your browser maker (for example Google in Chrome). We do not store the audio.

Location Data

The apps ask for your location only for two features, and only after you allow it:

• Clock in and clock out: when you clock in or out from the app screen on the iPhone, Apple Watch, or Android, the app takes a single location reading and stores it with that clock event, so your business has a record of where the shift started and ended. No location is taken when you clock in or out from a widget, a quick settings tile, Siri, or a notification.
• Mileage trips you start: when you start a trip, the app records your route until you end the trip and stores it with your mileage records. While a trip is recording it keeps recording if you lock the screen or switch apps; on iPhone and Apple Watch the system shows a location indicator, and on Android the app shows an ongoing notification for the whole trip.

Owners and managers of your business can see the locations stored with clock events and trips. The apps do not track your location at any other time, and the Android app does not request background location permission. Maps in the Service show addresses you have entered (job sites, clients, routes); turning those addresses into map positions and driving distances uses the map services listed in section 4.

Push Notifications

If you allow notifications, the iPhone and Android apps register with Apple Push Notification service and Google Firebase Cloud Messaging, which give us a device token. We store that token with your account and the platform (iPhone or Android) so we can send you notifications such as new client messages and appointment reminders. To deliver notifications, Firebase in the apps collects limited technical data, such as an installation ID and counts of notifications delivered. If you use Live Activities on iPhone, we also store the short-lived token for each running activity. Signing out of the iPhone or Android app removes that device's token. Tokens are deleted when your account is deleted, and you can turn notifications off at any time in your phone's settings.

Phone Numbers

Contractors enter their clients' phone numbers, and clients can enter their own on a contractor's job-request form or booking page. When a client agrees to get text messages, we record the opt-in with the date, time, where it came from (for example the job-request form, or a contractor confirming they have the client's permission), and the wording that was shown, so we can prove consent.

Information From Your Clients and Website Visitors

When someone submits a job request through a contractor's request form, we store what they enter and, to help prevent abuse, their IP address and browser information. When a client approves or signs an estimate or change order through the client portal, we store the signature, the time, and the signer's IP address and browser information as a record of the approval.

Usage Data and Analytics

• Our own analytics record pages visited and features used on the website and web application, with a random session identifier kept in your browser tab and the type of device, browser, and operating system. They use no cookies, and we do not store your IP address with these events. Some milestone events (for example sending a first invoice) are tied to your business while the business exists. These analytics turn off when your browser sends a Global Privacy Control or Do Not Track signal.
• Google Analytics and the Meta Pixelrun only on our public marketing pages. They never run in the web application, client portals, contractor websites, or embedded forms, and pages the iPhone and Android apps open are kept free of them from the apps' next update. They measure visits and how well our advertising works, set cookies, and receive information such as your IP address, browser and device details, the pages you visit, and how far you scroll. They do not run on the signup and sign-in pages. We turn off Google Analytics advertising features and turn on Meta's Limited Data Use setting. These tools do not load when your browser sends a Global Privacy Control signal or when you opt out on our Your Privacy Choices page (see section 8).

The iPhone, Apple Watch, and Android apps do not include advertising or tracking tools and do not use your device's advertising identifier.

Error Reports

Our web application sends error reports to Sentry so we can find and fix problems. Reports include technical details about the error and your browser. We set Sentry not to collect personal information by default and do not use session recording.

Connected Services

Some features work only if you connect another service. We receive and store only what that feature needs:

• Bank accounts (Plaid): if you connect a bank account, Plaid provides your account details and transactions so you can review and record business expenses.
• Social media (Zernio): if you connect social accounts, our social media provider, Zernio, posts what you write, with its images, to those accounts. Zernio also brings the direct messages, comments, and reviews from those accounts into your social inbox so you can read and answer them. If you use lead search, Zernio searches public Reddit posts for people asking for work like yours, and we store the matching public posts and the usernames of the people who wrote them.
• Payment accounts: if you connect Stripe or PayPal to get paid, those companies collect the business and identity details they require. We store the account identifiers and payment status we need to show your payments.
• Receipt email:receipts you forward to your Bit & Grain receipt address are received through Amazon Web Services and read into your expenses.

Google Calendar and Microsoft Outlook Calendar

If you connect your Google Calendar, we read your calendar list and busy times so the app can show your real availability and keep you from being double-booked. When you book or reschedule an appointment in Bit & Grain, we put that event on your calendar and keep it current; if you cancel, we remove it. Those events include the appointment details and the client details you entered (name, phone, email, and address). We only change events Bit & Grain created. We do not keep copies of your other calendar events, only the encrypted connection tokens and your calendar's name. We never use calendar data for advertising, never sell it, and never share it except to run the calendar feature. You can disconnect your calendar in Settings at any time, and we delete the stored tokens when you do. When your account is deleted, we also cancel our access with Google. Microsoft does not let one app's access be canceled on its own, so for a Microsoft calendar we delete our copy of the connection tokens, and you can remove Bit & Grain from your Microsoft account settings (for a personal account, at account.live.com/consent/Manage; for a work or school account, at myapps.microsoft.comor through your administrator). Bit & Grain's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. A Microsoft Outlook calendar connection works the same way.

Contact Forms, Newsletter, and Lead Forms

If you use our contact form, we collect what you write and your contact details, and we use Google reCAPTCHA to block spam, which sends information about your browser and activity to Google. If you subscribe to our newsletter, we store your email address and, if you give it, your first name, along with the page or campaign you subscribed from. If you fill out one of our lead forms on Facebook, Instagram, or LinkedIn, Meta or LinkedIn sends us what you entered. Either way, we send a confirmation email first and add you to our list only after you confirm.

Feedback

If you send us feedback from inside the Service, we receive what you write, your name, email address, and business name, and post it to our team's Slack so we can act on it.

3. How We Use Your Information

• To provide, maintain, secure, and support the Service
• To process payments (through Stripe and PayPal)
• To send transactional emails (invoices, payment receipts, sign-in links, password resets, account notices)
• To send text messages for contractors who use our text messaging service, only to people who have opted in. We do not send marketing or promotional text messages.
• To send push notifications you have allowed
• To power AI features you choose to use, as described in section 4
• To prevent fraud, spam, and abuse of the Service
• To measure and improve the Service and our advertising
• To send our newsletter and product emails, which you can unsubscribe from at any time

Support access

If you ask for help, a member of our team can sign in to your account as you to troubleshoot, but only after you agree each time. That access ends after 30 minutes, or sooner if you end it. Without that permission, our team can see basic account and billing information (such as your name, email address, business name, plan, and billing status) and the feedback you send us, but not the records inside your business.

4. Who We Share Information With

We do not sell your information for money. We share information with the service providers below, who process it for us to run the Service, and with the third parties described in section 2 when you choose to use them. Google and Meta on our marketing pages are explained in section 8.

• Hosting and storage: Vercel (web hosting) and Supabase (database, sign-in, and file storage). Amazon Web Services stores our backups and receives forwarded receipt emails.
• Payment processors (Stripe, PayPal), to process subscriptions and the payments your clients make to you
• Email delivery (Resend), to send account, transactional, and newsletter emails, and the emails contractors send to their clients through the Service
• Text messages (Twilio), to deliver text messages for contractors who use our text messaging service. See section 5.
• AI providers: on the web, before you first use Grain AI, scan a receipt, or identify equipment or materials from a photo, the Service asks your permission once and names Anthropic as the company that processes what you send; the iPhone and Android apps ask the same way from their next update. On the web, the same notice also comes before importing invoice PDFs or spreadsheets. Anthropic processes:
  • Grain AI chats, including the business and client details Grain AI looks up to answer you
  • Receipts, invoices, photos, and documents you scan, forward, or import
  • Text you ask the AI writing tools to draft or improve, such as messages, descriptions, and social posts
  Google (Gemini) creates logo designs from your business name, trade, and the description you give. Deepgram converts voice to text on the web, as described in section 2. The business terms of Anthropic, Google, and Deepgram do not let them use this information to train their AI models, and we do not use it to train models of our own.
• Maps and addresses:Google Maps and Google Places (address suggestions on the web and Android, maps on Android), Apple Maps (iPhone), Mapbox (maps, routes, and driving distances), OpenStreetMap's Nominatim service (turning addresses into map positions), and OpenStreetMap map tiles (map images on the web). These services receive the addresses, search text, or map area needed to answer each request.
• Barcode lookup: UPCitemdb receives only the barcode number when you scan a product, to look up its name.
• Push notifications: Google Firebase Cloud Messaging and Apple Push Notification service, to deliver notifications to your devices
• Social media: Zernio, for the social features described in section 2
• Security and spam prevention: Cloudflare Turnstile and Google reCAPTCHA
• Error monitoring: Sentry
• Team messaging: Slack, where our team receives feedback you send and alerts about billing problems
• Lead forms: Meta and LinkedIn, when you fill out one of our lead forms on their sites
• Scheduling a call with us: Cal.com, if you book a call from our website
• Your business team and your clients: information you choose to share, for example invoices, estimates, and portal pages you send to a client, or records your team members can see
• Law enforcement and legal requests, only when the law requires it
• A buyer or successor, if our business is sold or merged, subject to this policy

5. Text Messages (SMS)

Each business that texts through Bit & Grain has its own phone number. Texts are sent on behalf of the contractor you're working with, using Bit & Grain's registered text messaging service. Bit & Grain Technologies LLC is the brand registered with the mobile carriers, and each text names the contractor's business.

What we collect for texts

Your mobile phone number, the opt-in record described in section 2, and the texts you and the contractor send each other, which are kept as part of the contractor's business records.

How phone numbers are used

Phone numbers are used only for texts about your dealings with the contractor: appointment reminders, replies, and follow-ups about estimates and invoices. We do not send marketing or promotional texts. Agreeing to get texts is not a condition of any purchase.

Who sees text message data

• Twilio, which delivers the texts to your mobile carrier
• Our hosting and backup providers, which store them
• The contractor's team, who can see the conversation and may get a preview of a new text in a push notification or email
• Anthropic, if the contractor asks Grain AI about the conversation

We never sell, rent, or share phone numbers or opt-in records with anyone for their own marketing.

Stopping texts

Reply STOP to any text to stop texts from that business. Standard opt-out words (STOP, END, CANCEL, UNSUBSCRIBE, QUIT) work too, and there is no fee for replying STOP. Reply HELP for help. Message and data rates from your mobile carrier may apply. For message types, frequency, and more, see our SMS Terms.

6. Security

We protect your information with encryption while it travels over the internet and while it is stored. Each business can only reach its own records, and connection tokens for calendars are stored encrypted. Only a small number of people at Bit & Grain can reach our systems, and support access to an account needs your permission each time. No system is perfectly secure, and we cannot promise that information will never be accessed without permission. If a breach affects your information, we will tell you as the law requires. Read more on our Security page.

7. How Long We Keep Information

We keep your information while your account is active. If a free trial or subscription ends, your account is locked, but your data is kept and stays available for export until the account is deleted.

When you delete your account, it is deleted 30 days after your request, or 30 days after the end of a paid period you have already paid for. On the web, and in the iPhone and Android apps from their next update, you can instead choose Delete now: your subscription is canceled that day with no refund for the unused time, and the account is deleted 30 days from that day. A daily job then permanently deletes your login, every business you own and its records, and the files you uploaded; cancels our access to those businesses' connected Google calendars, Plaid bank connections, and Zernio social accounts; and deletes our copy of their Microsoft calendar tokens. If you belong to a business you do not own, that business keeps its records, and bank feeds and social accounts you connected for it stay with the business, and so do calendars you connected for it. See How to delete your account for the steps and the full list of what is deleted and kept.

Backups: we keep nightly backups so we can recover from mistakes and outages. Backups of each business expire after 90 days, and replaced versions of a backup are removed 30 days after that, so deleted data is gone from these backups no later than 120 days after it is deleted from the Service. Full database copies expire after 30 days. Our database host, Supabase, may also keep its own short-term backups. We do not restore deleted data from backups except to recover from an error or outage.

Each "until deleted" period above is followed by the backup period. We may also keep information when the law requires it, or to resolve disputes and enforce our agreements.

8. Cookies, Advertising Measurement, and Your Privacy Choices

We use essential cookies for sign-in and session management, and browser storage for preferences such as your theme. On our public marketing pages only, Google Analytics and the Meta Pixel set their own cookies, as described in section 2.

Under some state privacy laws, letting Google and Meta collect information on our marketing pages to measure our advertising can count as "sharing" personal information or as "targeted advertising," even though no money changes hands. You can opt out in either of these ways:

• Turn on the opt-out on our Your Privacy Choices page, also linked at the bottom of our website. Google Analytics and the Meta Pixel then stop loading in that browser.
• Turn on Global Privacy Control in your browser or with a browser extension. We treat it as an opt-out, and these tools do not load while it is on.

An opt-out applies to the browser you use. You can also block or delete cookies in your browser settings, and use Google's and Meta's own ad settings to limit how they use your information.

9. Your Privacy Rights

Depending on the state you live in (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with privacy laws), you have the right to:

• Know what personal information we have about you and how we use and share it
• Get a copy of your personal information
• Correct information that is wrong
• Delete your personal information
• Opt out of the "sharing" or targeted advertising described in section 8
• Not be treated differently, charged more, or given worse service for using these rights

You can do much of this yourself: see and correct your records in the Service, delete individual records from their own screens, download your data (business owners and admins can use Export my dataunder Settings, Account & Privacy on the web, which downloads every record of the business as CSV files, and the Delete my account screen in the iPhone and Android apps offers the same CSV files), and delete your account as described on our account deletion page. You can also stop texts by replying STOP, unsubscribe from our emails with the link in each email, and turn off camera, microphone, location, and notification access in your device settings.

Making a request

Email privacy@bitandgrain.app. To protect your account, we confirm a request by writing to the email address on the account and acting once you reply from it. Someone you authorize (an authorized agent) can make a request for you if they send us your signed permission; we may still ask you to confirm the request directly. If you are a contractor's client, see section 1: we will forward your request to the contractor.

We aim to reply within two business days, and we complete requests within 30 days, or within 45 days where the law allows. If we need more time, we will tell you why.

Appeals

If we turn down your request, you can appeal by replying to our answer or emailing privacy@bitandgrain.appwith the subject "Appeal." We will answer your appeal within 45 days and explain our decision. If you disagree with the result, you can contact your state attorney general.

10. Where Information Is Stored

The Service is offered in the United States, and we store your information in the United States. Sentry, our error monitoring provider, processes error reports in the European Union.

11. Children

You must be at least 18 to use Bit & Grain. The Service is not meant for children, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you think a child has given us information, email privacy@bitandgrain.app.

12. Changes to This Policy

When we change this policy, we post the new version here with a new effective date. For material changes, we email account owners and show a notice in the app at least 14 days before the change takes effect. Where the law requires it, we will ask for your consent before using information we already have in a materially different way.

13. Contact

Privacy questions, including questions about text messages: email privacy@bitandgrain.app. For help with the Service, email support@bitandgrain.app. You can also use the contact formand select "Legal / Privacy" as the category. We aim to reply within two business days.

By mail:
Bit & Grain Technologies LLC
10906 168th Ave E.
Bonney Lake, WA 98391