Skip to main content

Behind the Scenes

How Little Bear Apps handles privacy, security, and data. No legalese, just plain explanations.

The Quick Version

TL;DR for people who won't read the whole page:

  • ✓ Google Analytics on this website, and only with cookies if you say yes. The tools themselves don't track you.
  • ✓ All tools run locally — data stays on your machine
  • ✓ Every public repo has security scanning, test coverage, CI checks
  • ✓ Open source under MIT licence
  • ✓ Cookie consent gives real choices — reject is just as visible as accept

Why Bother?

After 14 years working in tech companies, I've watched privacy and security treated as afterthoughts more times than I can count. Legal checkboxes. Marketing spin. "We take your privacy seriously" followed by 47 trackers.

Little Bear Apps is a one-person operation. There's no legal team forcing compliance. No investors demanding growth metrics. No pressure to extract data for monetisation.

"I do it because it's the right way to build software, and because I use these tools myself."

This page isn't checkbox compliance. It's values — written down so you can hold me to them.

Security & Code Quality

Every public repository has automated security tooling. Production deploys require manual confirmation, and all GitHub Actions in Python repos are pinned to full SHA hashes to prevent supply chain attacks. You can verify each one yourself.

Tool Purpose Verify
GitHub Actions CI Automated tests, linting, and builds on every push View .github/workflows/
CodeQL Static analysis for security vulnerabilities GitHub Security tab
Dependency scanning npm audit, pip-audit, and bandit SAST across repos View CI workflows
Codecov Test coverage tracking with thresholds codecov.io
Socket.dev Supply chain and dependency security socket.dev
Dependabot Automated dependency updates with auto-merge for patches Org-level config
View on GitHub

Cookies & Consent

Until October 2026 this site used Plausible, which sets no cookies. It now uses Google Analytics, which does if you let it. So the banner is a real question now, and nothing is set until you answer it:

"Decline"

No analytics cookies. Google still gets an anonymous "a page was viewed" ping with no ID attached. That's how Google's consent mode works, and I'd rather tell you than pretend it's zero.

"Accept"

Google Analytics sets two cookies so it can tell a return visit from a new one. That's it: no ads, no Google Signals.

No dark patterns. The decline button is just as visible as accept. No pre-checked boxes. No "legitimate interest" loopholes. No guilt-tripping copy. If your browser sends a Global Privacy Control signal, Google Analytics doesn't load at all and the banner doesn't appear. Changed your mind? is at the bottom of every page.

"If you say no, it means no."

Analytics

This site used Plausible until October 2026. It now uses Google Analytics 4, loaded through Google Tag Manager. Plausible is good, especially on privacy, but it doesn't go as deep: proper event data, funnels, and Tag Manager to wire it all up. I'm also building a tool that works with exactly this kind of analytics data, so I wanted the real thing running on my own site.

The tools haven't changed. Untether, Outlook Assistant and the rest still don't track you or how you use them. The privacy angle hasn't gone; it's just changed shape: the tools stay private, and this site tells you exactly what it measures.

What it records

  • •Pages viewed and where you came from
  • •Approximate location (city level, from your IP)
  • •Device and browser
  • •A few actions: install commands copied, help searches (result counts only), sign-ups, clicks out to GitHub or npm/PyPI

Switched off or never sent

  • ✗Google Signals (no linking to your Google account)
  • ✗Ads personalisation and Google Ads
  • ✗Anything you type into a form or search box
  • ✗Your name or email

The trade-offs: the Google tag is much heavier than Plausible's ~1 KB script, and the data goes to Google in the US. If that's a dealbreaker, decline, or turn on Global Privacy Control and it won't load at all.

"I can see which pages are useful and where people come from. I can't see who you are, and I don't want to."

Google privacy policy · How Google uses data from sites like this · GA4 cookie usage

The Badge System

Every tool on this site has badges indicating its maturity and privacy status. These aren't marketing claims — they're commitments.

Maturity Badges

QA Tested

Tested before release. Works for intended purpose. May have bugs or rough edges.

How it's earned: Baseline for any public release.

Personal Use Proven

Running in my own workflows for 6-12+ months. Core functionality is stable.

How it's earned: Time-based, demonstrated stability.

Community Validated

Real users beyond me. Bugs surfaced and addressed. Features added from community feedback.

How it's earned: Earned through actual community use.

Privacy Badges

Fully Local

No data leaves your machine. LBA sees nothing.

What it implies: Third parties (registries, GitHub) see only download stats and repo activity.

Anonymous Analytics

Some anonymised data collected (specified what). No PII.

What it implies: Purpose disclosed, collection minimised.

Account Required

Requires account or cloud features.

What it implies: What's stored, why, and where is fully disclosed.

Per-Tool Breakdown

Specific, concrete details of what each tool accesses, stores, and sends.

Outlook Assistant
Reads

Your Outlook mailbox via Microsoft Graph API (delegated permissions):

  • Email, calendar, contacts, and settings you explicitly grant access to
Stores
  • OAuth tokens: ~/.outlook-assistant-tokens.json
  • Azure client ID (not a secret): ~/.outlook-assistant-config.json
Sends

Sign-in to Microsoft (login.microsoftonline.com) and queries to Microsoft Graph API (graph.microsoft.com). No Little Bear Apps servers involved.

Verify on GitHub →
PitchDocs
Reads

Your local codebase and existing documentation files.

Stores

Generated files written to your repo directory.

Sends

Nothing. Pure markdown plugin with no external requests.

Verify on GitHub →
ContextDocs
Reads

Your local codebase files and existing AI context files (CLAUDE.md, .cursorrules, etc.).

Stores

Generated context files written to your repo directory.

Sends

Nothing. Pure markdown plugin with no external requests.

Verify on GitHub →
Untether
Reads

Your Telegram messages sent to the bot, and AI agent stdout/stderr for progress streaming.

Stores
  • Config: ~/.untether/untether.toml
  • Session state: in-memory only (no database)
Sends

Messages to the Telegram Bot API (api.telegram.org). No Little Bear Apps servers involved.

Verify on GitHub →

Third-Party Services

Every external service the site or tools interact with. No hidden third parties.

Service Purpose What they see Privacy policy
Cloudflare Pages Site hosting Standard server logs View
Google Analytics Website analytics (with consent) Pages viewed, referrer, approximate location, device, and a random visitor ID if you accept cookies View
GitHub Code hosting, repos Repo activity, issues, PRs View
npm Package hosting (Outlook Assistant) Download counts View
PyPI Package hosting (Untether) Download counts View

What I Can't Control

Being transparent means admitting limits. Here's what's outside my control:

  • • If you install from npm or PyPI, those registries log download statistics.
  • • If you open a GitHub issue, GitHub has that data.
  • • If you email, that goes through standard email infrastructure.
  • • If you visit this site, Cloudflare sees standard server logs, and Google Analytics sees the page views described above.

"I can't change how third parties work. But I can be upfront about it."

What I Won't Do

Explicit commitments. Things Little Bear Apps will never do:

  • ❌ Sell data
  • ❌ Add ad networks or advertising pixels
  • ❌ Gate basic functionality behind accounts
  • ❌ Use dark patterns in consent flows
  • ❌ Pretend "privacy-first" while doing shady stuff in the background
  • ❌ Share data with third parties for marketing
  • ❌ Use your email for anything other than what you signed up for

Open Source

The developer tools are released under the MIT License. What that means:

  • ✓ Use it for anything, including commercial projects
  • ✓ Fork it and modify it however you want
  • ✓ No attribution required (though appreciated)
  • ✓ Everything on this page can be verified in the source code
View all repos

Security Issues

Found a security vulnerability? Please report it responsibly:

Explore more

Now that you know how I work, see what I've built.

Browse builds Privacy policy Get in touch
Last updated: 3 October 2026

This page will be updated when anything changes.