Privacy Policy | Little Bear Apps

About Us

Little Bear Apps is an Australian-based software company operating globally online. We build privacy-focused developer tools, MCP servers, and browser extensions. You can reach us at hello@littlebearapps.com.

Our Philosophy

We believe your data is yours. Our tools are designed to run locally where possible. On this website we use Google Analytics, but it only sets cookies with your permission, and we're transparent about everything we collect. Most of our work is open source so you can verify our claims.

Your Choices

The first time you visit, a banner asks whether you're happy for us to use analytics cookies:

Accept: Google Analytics sets two cookies so it can tell repeat visits apart and keep a session together
Decline: no analytics cookies are set. Google Analytics may still receive a basic, cookieless signal that a page was viewed (Google calls these "cookieless pings"), with no identifier that links one visit to another

Nothing is set until you choose. Your choice is saved in your browser for 6 months, and you can change it any time with (also at the bottom of every page).

Privacy Signals (GPC/DNT)

We automatically honour your browser's privacy signals:

Global Privacy Control (GPC): if enabled, Google Analytics isn't loaded at all
Do Not Track (DNT): same as GPC, we respect this legacy signal

When we detect these signals, you'll see a short notice and no banner, because we've already honoured your preference. If you want to opt in anyway, use Cookie settings at the bottom of any page.

What We Collect

Website Analytics

We use Google Analytics 4, loaded through Google Tag Manager, to understand which pages are useful and where visitors come from. It records:

Pages viewed and the site that sent you here
Device type, browser and screen size (general categories)
Approximate location (country, region and city), worked out from your IP address
A handful of site actions: copying an install command, searching the help centre (the number of results, not what you typed), sending the contact form, signing up to the newsletter, and clicking through to GitHub or a package registry

It doesn't record what you type into forms or search, your name, or your email address. We've turned off Google Signals and ads personalisation, we don't run Google Ads, and event data is kept for 14 months.

Google uses your IP address to estimate location. For visitors in the EU, Switzerland and the UK, Google says it discards the IP address immediately after that. Our reports never show IP addresses. See Google's Privacy Policy and how Google uses information from sites that use its services.

Contact Form

If you use our contact form, you provide your name, email, and message. This is used solely to respond to your enquiry. Your message is sent via Resend (our email delivery provider) to our inbox, and a copy (your name, email, message, and the IP address and browser it was sent from) is kept in our database on Cloudflare so enquiries don't get lost. Ask us at any time and we'll delete it.

The form uses Cloudflare Turnstile to verify you're a real person (no CAPTCHAs, no tracking cookies). You'll also receive a confirmation email acknowledging your message. We won't add you to marketing lists without explicit consent.

Sending the form is recorded in Google Analytics as an event: not what you wrote, and not your name or email.

Newsletter and Tool Updates

If you sign up for the newsletter, tick the newsletter box on the contact form, or register interest in a tool, we store:

Your email address and first name (if you give it)
Which tool you're interested in, and where you signed up
When you confirmed, plus the IP address, browser and approximate country recorded at that moment, as proof of consent
Whether our emails to you were delivered or bounced, so we stop sending to addresses that don't work

You confirm by clicking a link we email you (double opt-in). Until you do, your sign-up stays unconfirmed and you won't get updates. We don't record whether you open our emails or which links you click.

These details are stored in our database on Cloudflare. Your email address and name are also held by Resend, which sends the emails from mail.littlebearapps.com. Every email has a link to change your preferences or unsubscribe. To have your details deleted completely, email privacy@littlebearapps.com.

Theme Preference

We store your light/dark mode preference in your browser's localStorage. This never leaves your device and is not sent to any server.

Third-Party Services

We use the following services to operate this website:

Service	Purpose	Privacy Policy
Cloudflare Pages	Website hosting, CDN, security, bot verification (Turnstile)	Link
Resend	Email delivery (contact form, newsletter) and the newsletter subscriber list	Link
Google Analytics (Google LLC)	Website usage statistics; cookies only after you accept	Link
Google Tag Manager (Google LLC)	Loads Google Analytics on this website	Link
GitHub	Open source hosting, discussions	Link
Gravatar	Author profile images on blog	Link
YouTube Data API	Content analysis via internal developer tools	Link
PyPI	Python package distribution	Link
npm (GitHub, Inc.)	JavaScript package distribution (for example Outlook Assistant)	Link

Third-Party API Data

Our tools fall into two categories when dealing with third-party APIs:

Tools that run on your machine (Outlook Assistant, etc.)

These tools authenticate against a third-party API (for example, Microsoft Graph) using OAuth, directly from your machine. When you use them:

You grant consent explicitly through the provider's own consent flow — we cannot request permissions you haven't approved
OAuth tokens are stored locally on your machine (for example, Outlook Assistant stores them at ~/.outlook-assistant-tokens.json)
Your mail, calendar, contacts, and other API responses are returned directly to your machine and never pass through Little Bear Apps infrastructure
Whatever a tool returns goes to the AI assistant you use it with, and from there to that assistant's AI model provider, under their privacy terms, not ours
You can revoke access at any time via the provider's account permissions page (for Microsoft, visit myapps.microsoft.com → the app → Remove; or for personal Microsoft accounts, account.live.com/consent/Manage)
Our use of Microsoft Graph data complies with the Microsoft APIs Terms of Use and is limited to the scopes you consent to

Internal developer tools that access Google APIs

Some of our own internal tools access Google APIs (including the YouTube Data API) for analysis and development purposes. These are not distributed to end users. When authenticated via OAuth:

We access only the data explicitly authorised during the consent flow
Data is stored securely on Cloudflare infrastructure (encrypted at rest)
Data is used solely for internal analysis and is not shared with third parties
YouTube API data is retained in accordance with YouTube's Terms of Service
Users can revoke access at any time via Google Account Permissions
To request data deletion, contact privacy@littlebearapps.com

Our use of Google API data adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Our Developer Tools

Our developer tools (Outlook Assistant, PitchDocs, etc.) are designed to run locally on your machine. Across the whole suite, we commit to the following:

No telemetry or usage data sent to Little Bear Apps servers
No accounts or registration with Little Bear Apps required
No phoning home for updates unless you explicitly enable it. Installing or launching a tool with npx or uvx downloads it from the public package registry (npm or PyPI), not from us, and our plugins pin an exact version
No access to the internet unless the tool's primary function requires it (for example, an email or calendar assistant necessarily talks to the email or calendar provider's API)
When a tool does call an external API on your behalf, it does so directly from your machine — your data, credentials, and OAuth tokens never transit Little Bear Apps infrastructure

Many of our tools are open source — you can review the code on GitHub to verify these claims.

Outlook Assistant specifics

Outlook Assistant is an open-source MCP (Model Context Protocol) server that connects your AI assistant to your Microsoft Outlook account via the Microsoft Graph API. It runs on your machine. This section describes the current release (v3.14.1).

Your own Azure app — Little Bear Apps doesn't provide a shared Azure app. You register your own free Azure app and give Outlook Assistant its Application (client) ID. Sign-in uses Microsoft's device-code flow by default, which needs no client secret. An optional browser sign-in uses a local server on localhost:3333 and your own client secret.
What it can access — At sign-in it requests these delegated permissions, which act only as you: offline_access, User.Read, Mail.Read, Mail.ReadWrite, Mail.Send, Calendars.Read, Calendars.ReadWrite, Contacts.Read, Contacts.ReadWrite, People.Read and MailboxSettings.ReadWrite. The write permissions are there so it can draft, send and organise your email, calendar and contacts, and change mailbox settings such as automatic replies. You can't pick individual permissions: Microsoft's consent screen lists them all, and work or school accounts may need an administrator to approve them.
Shared mailboxes (opt-in) — Only if you set OUTLOOK_SHARED_MAILBOX (work or school accounts only), it also requests Mail.Read.Shared, plus Mail.ReadWrite.Shared if you set it to true or readwrite, for mailboxes delegated to you. It never requests Mail.Send.Shared and can't send from a shared mailbox.
Where your data goes — Outlook Assistant talks only to Microsoft: login.microsoftonline.com to sign in and graph.microsoft.com for mail, calendar, contacts and settings. The results of each request go to the AI client you use it with (for example Claude Code, GitHub Copilot or Cursor), and from there to that client's AI model provider (for example Anthropic, OpenAI, GitHub or Cursor), under that provider's terms and privacy policy, not ours. Emails, invitations and replies go to the recipients you choose, and only when you ask. Nothing goes to Little Bear Apps: there's no Little Bear Apps backend, no analytics and no telemetry. Data Microsoft holds is covered by the Microsoft Privacy Statement.
What's stored on your machine — ~/.outlook-assistant-tokens.json holds your OAuth access and refresh tokens (refresh tokens last about 90 days). ~/.outlook-assistant-config.json holds your Azure client ID if you enter it at sign-in (it isn't a secret). ~/.outlook-assistant-pending-auth.json holds temporary sign-in state and is removed when sign-in completes. All three are readable only by your user account. Exports and attachment downloads are written only when you ask, and only to your system's temp folder, ~/Downloads, ~/Documents or a folder you set with OUTLOOK_EXPORT_DIR, with the same owner-only permissions.
Logs — Logs go only to standard error, which your MCP client may keep in its own logs. By default that's one line per tool call (the tool, action, outcome and duration), never the arguments. Optional debug logging (OUTLOOK_DEBUG) adds detail, with email addresses, IDs and credentials redacted.
Safety controls — You can turn on read-only mode (OUTLOOK_READ_ONLY), limit who it can email (OUTLOOK_ALLOWED_RECIPIENTS), cap sends per session (0 blocks sending) and preview actions with dry runs. The Claude Code, Copilot and Cursor plugins add a safety hook that asks before anything that emails people, deletes data or keeps acting (rules, forwarding, automatic replies), and a skill telling the AI to treat email content as data, not instructions; both run locally and make no network calls. Details are in the README's safety section.
Revoking access and deleting data — For personal Microsoft accounts, visit account.live.com/consent/Manage. For work or school accounts, visit myapps.microsoft.com, choose the app and select Remove. It appears under whatever name you gave your own Azure app registration, which may not be "Outlook Assistant". To remove everything from your machine, delete the three files above.
Source code — Fully open source on GitHub. You can verify every API call.
Children's use — Outlook Assistant is not intended for users under 13.

Cookies & Local Storage

Name	Type	Set by	Purpose	Lasts
`_ga`	Cookie	Google Analytics, only if you accept	Tells repeat visits apart	2 years
`_ga_<ID>`	Cookie	Google Analytics, only if you accept	Keeps a session together	2 years
`lba_consent_state`	localStorage	This site	Remembers your cookie choice	6 months
`theme`	localStorage	This site	Light or dark mode	Until cleared
`help-feedback-<page>`	localStorage	This site	Remembers that you rated a help article	Until cleared
`lba_gpc_notice_shown`	sessionStorage	This site	Shows the privacy-signal notice once per visit	This visit
Cloudflare security cookies	Cookie	Cloudflare	Bot and abuse protection (Turnstile)	Short-lived

We don't use advertising cookies. Theme and help-feedback values never leave your device. Change your analytics choice any time with ; declining also deletes the Google Analytics cookies.

Your Rights

Under the Australian Privacy Act and GDPR (if you're in the EU), you have rights including:

Access — Request a copy of data we hold about you
Correction — Request correction of inaccurate data
Deletion — Request deletion of your data
Objection — Object to processing (covered by our consent system)

Our analytics reports don't identify you. Google Analytics uses a random ID stored in the _ga cookie, which we can't link to your name or email. You can withdraw consent at any time through Cookie settings, which also deletes those cookies. For any other requests, email privacy@littlebearapps.com.

Australian residents can also lodge complaints with the Office of the Australian Information Commissioner (OAIC).

International Data Transfers

Our services use infrastructure in multiple countries:

Cloudflare — Global CDN, data processed in nearest edge location; our database (contact form copies, newsletter subscribers) is hosted in the Oceania region
Google — United States and other countries where Google operates (website analytics, only with consent)
Resend — United States (contact form emails, newsletter subscribers and sending)
GitHub — United States
Gravatar — United States

All services have appropriate data protection measures. Google Analytics data is handled under Google's data processing terms.

Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this policy as our practices evolve. Significant changes will be noted with an updated date at the top. For material changes, we may provide additional notice.

Contact

Questions about this policy? Email us at privacy@littlebearapps.com.

This policy is written in plain language because legal jargon doesn't help anyone. If anything is unclear, please ask.