Your choices
LittleDraft’s website uses two optional analytics services: its own visitor analytics and Google Analytics. Both are off until you allow them. You can choose each separately, reject both, or change your choices at any time with Cookie Settings. Rejecting analytics does not prevent normal use of the site. Do Not Track and Global Privacy Control signals are respected.
Necessary and requested storage
Consent choice cookie: ld_analytics_consent. Provider: LittleDraft. Purpose: remember your choices and the time and version of your decision. Duration: 180 days, unless cleared earlier. Consent: not required to remember your choice. An older Google Analytics preference stored as littledraft-google-analytics-consent in localStorage is ignored and removed when you save a new choice.
Appearance preference: littledraft-theme in localStorage. Provider: LittleDraft. Purpose: remember your selected light or dark appearance. Duration: until you clear it or change it. It is used for the appearance you request and does not require analytics consent.
Owner password session: __Host-ld_admin. Provider: LittleDraft. Purpose: authenticate the private owner dashboard when password sign-in is enabled. Duration: 12 hours, or until sign-out or earlier expiry. The cookie is Secure, HttpOnly and SameSite=Strict; optional analytics permission is separate.
Cloudflare bot protection: __cf_bm. This security cookie was observed in the website’s response headers. Cloudflare documents expiry after 30 minutes of inactivity; see Cloudflare’s cookie documentation. Edge security processing is separate from optional analytics.
Owner platform sign-in. The private website administration can also use ChatGPT sign-in supplied by the Sites hosting platform. Authentication may use browser cookies or similar session storage managed by that service. Their names and expiry are controlled by the provider and have not been verified here; the sign-in is only used when accessing the private admin area.
Optional website analytics
LittleDraft analytics. Provider: LittleDraft, hosted on Cloudflare. With your permission, the website records page views, selected clicks and download activity, along with the referring domain, approximate country, device category and a daily pseudonymous identifier derived from IP address and browser information. This identifier changes daily. No analytics cookie is set for this service. The implementation does not currently specify automatic deletion of its server-side event records; a retention period still needs to be established. Consent is required and can be withdrawn using Cookie Settings.
Google Analytics 4. Provider: Google. With your permission, Google’s analytics tag measures website visits and usage and may set _ga and _ga_* cookies. Google documents a default expiry of two years, although browser limits and configuration can shorten or change this. The Google Analytics property’s server-side retention settings have not been verified. Consent is required; withdrawing it disables the tag and attempts to remove its cookies.
Google’s tag is loaded only after you allow Google Analytics. LittleDraft’s own event and download measurement runs only when you allow LittleDraft analytics. Changing your selection stops future collection; it does not automatically erase earlier server-side records.
LittleDraft for macOS
The app stores settings and preferences in macOS UserDefaults until changed or removed. Its sign-in credentials and local encryption keys are stored in macOS Keychain; the saved session is removed on sign-out. Encrypted writing profiles and reference text are kept locally according to your choices: reference retention can be seven days, 30 days, 90 days or until removed, while learned styles remain until removed. These support features you choose; they are not advertising trackers.
The app’s service transport uses an ephemeral session with cookies and disk caching disabled. Sign-in opens the macOS authentication browser using Auth0; the browser or Auth0 may use their own authentication cookies, whose names and durations are not determined by the app code. Sparkle checks the LittleDraft update feed, and the app does not request Sparkle system profile fields. Update and authentication services may receive ordinary connection information.
The service keeps account-related usage, credit and diagnostic records for operation. The code removes reply-engine diagnostic records older than 93 days during cleanup; other records have different or unconfirmed retention periods. We did not find an advertising identifier or a third-party advertising, analytics or crash-reporting SDK in the inspected app source. This does not rule out processing by the operating system or external service providers.
More information
See our Privacy Policy and Subprocessor List. For questions or a request about your information, email hello@littledraft.com.