Privacy

Last updated 18 October 2026

Bittern is a code review tool run by Jamal Mulla, an individual in the United Kingdom, who is the controller of the personal data described here. This page says plainly what Bittern collects, why, and who else sees it.

What we store

  • Your GitHub account: its id, username, name and avatar, from signing in with GitHub.
  • GitHub sign-in tokens, encrypted, so Bittern can act on GitHub as you. It only ever does what you can already do there.
  • Your review work: files you mark reviewed, which changed lines you have had on screen (you can turn this off in the account menu, which deletes it), and your AI guide chats, drafts and notes.
  • AI usage: the cost of each AI request, to show you your spend and apply daily limits.
  • A session cookie that keeps you signed in. It is the only cookie Bittern sets; there are no tracking cookies.

Your code

Bittern reads pull requests through GitHub as you. To answer questions about a pull request, the AI guide keeps a copy of the repository at that pull request's commits on our server; copies not used for 7 days are deleted. When you ask the guide something, your question and the code it needs are sent to the AI provider (below). Code is never sent anywhere else, and we never post anything to GitHub that you did not choose to post.

Who else sees data

  • GitHub, which Bittern reads from and posts to on your behalf.
  • DigitalOcean (London), which hosts Bittern and its database.
  • OpenRouter, which passes AI guide requests to the model you chose (for example from OpenAI or Anthropic). It only receives what you ask the guide and the code needed to answer.
  • PostHog (EU), for product analytics: which features are used, such as opening a pull request or asking the guide. It runs without cookies or storage in your browser. Signed-in users are identified by GitHub username; event addresses have repository names and file paths removed, and events never contain code or text you write.

Why (legal basis)

We use your data to provide the service you signed up for, and product analytics under our legitimate interest in understanding and improving Bittern. We do not sell data or use it for advertising.

How long

Account data, review work and chats are kept while you use Bittern. Sign-in sessions last 14 days. Clearing a chat deletes it. To have everything deleted, email us and we will do it within 30 days.

Your rights

Under UK data protection law you can ask for a copy of your data, have it corrected or deleted, object to its use or ask us to stop using it. Email us; if you are unhappy with the answer you can complain to the Information Commissioner's Office (ico.org.uk).

Questions: contact@jamalmulla.dev