The complete inventory — every feature, card by card. The front page tells the story; this page is the full record of what's actually built.
Cards marked "on the way" are designed and coming; everything else is live in BITS today. This page isn't linked from the front page or indexed by search engines.
Security & privacy
Not a policy — an architecture. Everything below is how the thing is actually built.
Your vault is sealed with a random master key (AES-256-GCM) that never changes. Your password locks that key — so changing your password never means re-encrypting your life.
The unlock key is derived on your device (PBKDF2, 600,000 rounds — the current industry floor). The password itself is never sent anywhere, ever.
A one-time code (about 99 bits of entropy, no confusable characters) is your second way in. We hold no key and can reset nothing — that's the honest cost of a vault only you can open.
The server stores only ciphertext, addressed by a random vault ID. No name, no email attached to your data. We couldn't read your bits if we wanted to.
Attachments, images and covers are encrypted on your device before upload (up to 30 MB each). The file store holds unreadable blobs under random names — and one vault can never touch another's files.
Every single Executive Intelligence request is logged on your device: what was sent, what came back, what changed. You can read the log in Settings and clear it anytime.
When the intelligence helps, it sees only the slice needed for that one job — today's list, one page, one email. It never gets your whole vault.
One tap locks BITS. The key is flushed from memory; nothing on the device is readable until you unlock again.
Search runs entirely on your device over your unlocked vault. There is no server-side search, because the server can't read anything to search it.
No analytics on your data, no advertising, nothing sold on. The only counters kept server-side are anonymous rate-limit tallies.
Your bits are yours. One tap exports the whole vault to a file you keep — no lock-in, no export tax, no "contact support".
Anything that requires data to leave the device — asking the intelligence, fetching email, reading your calendar — is explicit, minimised, logged and reversible. Sealed is the default; every relaxation is your call.
Sync & devices
Sign in on a new device with your email and password and your sealed vault arrives; the same password derives the same key everywhere.
Each bit syncs as its own sealed record, not one giant file — changes move in seconds, paged and byte-limited so big vaults stay fast.
Devices hold a quiet line open to the server; when one saves, the others pull within moments. The nudge itself carries no content.
If two devices edit the same bit apart, the newer wins and the other is kept as a visible conflict copy. Nothing is ever silently thrown away.
Writes carry monotonic timestamps and a device stamp, so a phone with a wrong clock can't overwrite newer work — and a device never mistakes its own echo for a conflict.
Shared lists (read flags, devices, share keys, the intelligence log) merge item by item across devices — never last-writer-wins-clobbers-all.
Settings lists every device that holds your vault, with a name you choose and when it was last seen.
Large records are compressed before encryption, so long pages sync quickly without weakening the seal.
Turn sync off and BITS is a purely local, sealed app. Turn it on when you want your other devices in.
Backups & recovery
Every save keeps the previous version. Snapshots thin out sensibly with age — everything from the last week, then weekly, monthly, yearly — and you can restore any of them.
A snapshot isn't trusted until it has been read back and verified. Risky operations — like imports — refuse to run at all if their safety snapshot fails.
Point BITS at a folder on your own disk and it quietly writes a dated, sealed backup there every week — including your files — keeping the most recent eight. Independent of us entirely.
Export the whole vault to a single file; import it anywhere. Importing snapshots your current vault first, so even a bad import is recoverable.
Deleting a bit archives it. It sits in Deleted for 90 days — files included — before anything is permanently removed, and you can restore it any time in between.
Up to 100 steps of undo, journalled and sealed on disk, so it still works after a reload. A batch of intelligence changes undoes as one step.
The bit model
Every object in BITS — task, event, goal, habit, note, even a message — is the same flexible item with optional attributes. New ideas become values, not rebuilds.
Every bit knows what it is: a task to do, an event that happens and passes, a goal to work towards, a habit to keep gently, a note to hold. The nature travels with the bit and you can change it on the bit's page.
A missed event just passed — no red badge. Only tasks can be "still to do", and even then the language stays calm.
Give bits a parent and the goal's progress computes itself from what's done underneath. Structure is optional, emergent and reversible.
Bits belong to areas you define — with sub-areas — and each area has its own workspace: goals, active work, backlog, pages and habits in one place.
A bit can live at any horizon — day, week, month, quarter, year, five years. Five-year goals roll forward so the vision always looks five years out.
Scope controls what's in the foreground. Today shows the live handful; the backlog and someday pools hold the rest without shouting.
A bit with a fixed time is pinned — nothing reshuffles it. Everything else is flexible, and the day gets built around the anchors.
Daily, weekly (with chosen days), monthly or yearly. Recurring bits are hidden templates; habits log when you do them, reminders project onto the calendar, and single occurrences can be skipped.
Park a bit with a revisit date and it disappears until then — no nagging — and simply returns to view on the day.
Bits can carry an estimate, actual time spent, a priority and an energy level (high/medium/low) — all optional, all learnable.
Calm flags ("Do first", "Deadline", "Quick win") plus free-form tags for any dimension you care about. No imposed taxonomy.
When a quarter or month ends, unfinished goals offer to carry into the new period — your choice, never automatic.
Capture & search
One box for add, ask and update. Write in plain words — "push the survey to Friday and log 3 hours across Parts" — and the intelligence proposes the exact changes. You apply them in a tap, or undo the lot.
Jot a thought and it lands as the right kind of bit, in the right area, with a sensible title — you don't do the sorting.
Cmd-K anywhere: create, jump to an area, start a review, sync now, lock the vault — keyboard-first with fuzzy matching.
Search titles, notes and page content across the whole vault, filtered by area, status, horizon or tag — all on-device.
Start a timer on any bit; when you stop, the minutes log themselves onto it. Time capture without a timesheet.
Closing a bit captures a short "where this leaves off" note. Come back weeks later — or hit the next occurrence of something recurring — and it's waiting for you.
Pages & knowledge
Notes and documents are just another nature of bit — same sealing, same sync, same areas — so knowledge sits beside the work it serves, not in a separate silo.
Text, headings, images, files, links, checkboxes and collapsible toggle sections — nestable, and reorderable by drag with a clear insert line.
Link pages with [[double brackets]]; links resolve by title and missing ones show quietly grey. Your own connected knowledge base.
Nest as deep as you need. The page library and each area's shelf keep it browsable.
Give a page a sealed cover image (with adjustable focal point) and an emoji icon. Every version is kept — restore any earlier one.
Drop files onto bits and pages; they're encrypted on-device and stored under random names, downloadable only by you.
Clip a page from the web — text and images — and file it into an existing page or a new one, via a bookmarklet and the /clip route.
A page shows the bits connected to it, so reference and action stay in sight of each other.
Calendar
A full calendar workspace: timed bits in order, an all-day band, multi-day spans shown as bands across days.
Connect Google and your events appear live. Choose a writable calendar and it works both ways: create, edit or archive in BITS and Google follows.
Secondary calendars show as quiet background information unless you promote them. Imported events never count as things to do.
A time entered in another timezone keeps its label rather than being silently converted — "14:00 WET" stays what you meant.
Birthdays, renewals and repeating events project onto their days without creating clutter — one template, shown wherever it applies, with skippable occurrences.
BITS knows the day's busy intervals and can find the first real gap that fits a bit's estimate — snapped to sensible times, inside waking hours.
A quiet banner when something timed is starting soon — while you're in the app, dismissable, never a guilt mechanism.
Habits, reviews & patterns
A habit is a practice you log when you do it — nothing pre-spawns, nothing goes red. Do it twice in a day and both count.
Streaks compute from what you actually logged, with a two-week grid per habit so you can see the shape of it at a glance.
Weekly, monthly, quarterly and yearly reviews run as a chaired meeting: look back, clear the decks, check alignment, plan ahead, close with minutes. The intelligence chairs; you decide.
Each review saves its minutes — focus, shape of the period, anything deliberately dropped — building an honest record over time.
What you've actually been doing: weekly throughput, habit streaks, and how your estimates compare with real time spent.
A goal only reads as behind when work meaningfully trails the period — with a buffer, and never in the first stretch. No panic thresholds.
Gmail and your own domain mailboxes together in one unified inbox, each message tagged by the address it arrived at.
Your device pulls the mail and encrypts each message to your key before anything is stored. Message bodies live as sealed blobs.
Browse any folder — Sent, Drafts, custom — mark read or unread, move messages, delete to Deleted, create folders, and search whole folders on the server.
Replies default to sending from whichever address the message arrived at, with a picker to override — brands never cross wires.
Compose and reply in BITS — plain and rich text, attachments included — via Gmail directly or your own mail server, with sent copies saved to Sent.
One tap turns a message into a task that keeps its link back to the thread. Triage can spot urgency, extract actions and deadlines, notice invitations and draft the reply.
Flip the inbox to group by sender — see everything from one person in a single stack.
Mute senders you're done with; mark low-signal senders so they never read as urgent. Snooze anything to when you'll actually deal with it.
Read, archived and snoozed flags merge across your devices per-message — sealed like everything else, never clobbered.
Executive Intelligence
Helpful when asked, silent otherwise — and every request logged where you can read it.
Your own key: your browser talks to the model directly, we're not involved at all. Managed: BITS provides the model and meters by request count — never by reading content.
Light jobs (filing, classifying, habit tips) run on the fastest model; the heavier thinking (planning, drafting, reviews) runs on stronger ones. Nothing is wasted.
The intelligence runs only when something invokes it — opening the day, closing a bit, or you asking. No background processes reading your life.
A profile of how you like to work rides along with every request — and the intelligence can refresh that profile from your actual activity, with your say-so.
The intelligence proposes concrete changes; you apply them in a tap. A whole batch undoes as one step.
Stable context is cached for an hour (about a tenth of the cost on re-use), and the relay rate-limits per hour so no one can run the meter hot.
Home, display & offline
The front door is a real page — day brief, focus, today and capture as first-class blocks — and you can pin any page you like as home instead.
Drag-arranged widgets: today, priorities, week ahead, time logged, done today, habit grid, momentum, insights, email, calendar, metrics. Hide what you don't use.
Navy, linen, midnight and glass — all built on semantic colour tokens, so every surface stays legible in every skin.
Large type with a hard floor, high contrast, big tap targets, and never colour as the only signal. Readable at arm's length, not a setting to find.
An installable app whose shell is cached on-device: unlock, read and edit with no connection at all; changes sync when you're back.
BITS notices a new version and offers one tap to update — no app store, no interruption mid-thought.
A new account contains nothing at all. Guided setup covers the vault, recovery code, life areas and connections — everything beyond the vault is optional.
Moving in
Point BITS at an Anytype export and it rebuilds your pages — structure, images and files included, attachments sealed on the way in.
A hundred objects of the same type become one tidy table page, not a hundred stray pages. Properties become columns.
The importer takes and verifies a snapshot before touching anything — and refuses to run if that net isn't in place. Afterwards, likely duplicates are flagged for a tidy pass.
The import pipeline is built to grow: Notion (markdown, like Anytype) and Tana (JSON) are the natural next readers on the same safe machinery.
On the way
The direction of travel — specced and sequenced, arriving as each piece earns its place.
Proper notifications for timed bits and calendar events — per-type switches, all off by default, quiet hours respected. The server holds only a time, never the content.
Message another BITS user and it's end-to-end encrypted automatically — the keypairs and directory already exist. Falls back to normal email for everyone else, honestly labelled.
Shared vaults with their own keys, member roles, and recovery options for teams — zero-knowledge for the group, built on the sharing machinery that already works.
Free with your own key, forever. Paid tiers add managed intelligence with a fair allowance — sign-in is for billing only and never touches decryption.
The longer arc: end-to-end encrypted calls and screen-sharing between BITS users, with in-call notes landing as bits.
Light jobs — tagging, habit-spotting — running entirely on your device, so for those, nothing leaves it at all.
