Privacy Policy

Information We Collect

We collect account information such as name, email address, authentication provider identity, account status, plan state, app or portfolio membership, and operational preferences.

When you use hosted work, we may process repository metadata, terminal session metadata, command receipts, deployment receipts, logs, errors, and app operational evidence needed to provide the service and help you review what happened.

OAuth Login

If you sign in with Google or another identity provider, we use that provider only to verify your identity and email address. Login OAuth does not grant Bitter access to Google Analytics, Search Console, Drive, Gmail, GitHub repositories, or other external services unless you separately authorize those integrations.

Credentials And Secrets

Credentials, provider tokens, deploy keys, and integration secrets are handled as protected material. BitterPass is the intended credential custody system for Bitter services. Product surfaces should expose status, handles, and receipts rather than raw secret values.

How We Use Information

We use information to create and secure accounts, provide local and hosted agent workflows, run deployments, record durable evidence, diagnose failures, enforce access boundaries, improve product reliability, and communicate service updates.

Retention

We retain account, app, billing, credential-status, deployment, and evidence records for as long as needed to provide the service, satisfy operational or legal obligations, debug failures, and preserve reviewability. Local caches and terminal tails should be bounded and may be deleted after durable evidence is recorded.

Sharing

We do not sell personal information. We may share information with infrastructure, payment, identity, analytics, and support providers only as needed to operate Bitter. We may disclose information if required by law or to protect Bitter, users, or the public.

Contact

Questions or requests can be sent to hello@bitter.sh.