Privacy Policy

Last updated: August 2026. Publisher: Small Tiger Group (libo@smalltigergroup.com).

This policy covers bim-cli (the command-line tool) and bimcli.com (the website). The six sections below correspond to the Claude Code plugin directory's privacy-standard checklist; a reviewer can verify each point independently.

bim-cli sends anonymous usage telemetry on by default in production builds (see Section 1). No conversation data, document content, file paths, or argument values are ever sent. When you explicitly ask a driver to call an external service -- a flood zone lookup calls a FEMA API, a Google Sheets push calls Google with your OAuth token -- those calls go directly from your machine to the service; nothing passes through Small Tiger Group infrastructure.

1. Collection

Usage telemetry (on by default): One ping per top-level command, sent to t.bimcli.com. Opt out with bim telemetry off, DO_NOT_TRACK=1, or BIM_TELEMETRY=0.

The complete set of fields stored per event is listed below. All fields are shape-only; no argument values or file paths are ever included.

Field Example Notes
date 2026-08-17 Calendar date (UTC), assigned server-side
ts 2026-08-17T14:32:01.123Z ISO-8601 timestamp, assigned server-side
version 0.4.7 bim-cli version string
os windows OS family only (windows / macos / linux)
verb site.flood.lookup Command shape only -- never argument values
ok 1 Whether the command succeeded (0 or 1)
err not-covered Error kind only if the command failed, never hint text or user data
ms_bucket fast Latency bucket: fast / medium / slow
src agent Caller type inferred from environment (agent / claude / cursor / human / ci / unknown)
distinct_id a3f8... Random, resettable per-install UUID -- see note below
driver site Name of the driver that handled the command
driver_version 0.2.1 Driver version string
exit_stage run Where the command exited (flag-parse / pre-flight / run)
flags --out,--strict Flag NAMES used; values are stripped client-side before the ping is sent
arg_count 2 Count of positional arguments; no values
has_stdin 0 Whether stdin was piped (0 or 1)
out_format json Output format requested (json / text / etc.)
country US 2-letter country code derived by the worker from the Cloudflare geo-IP header -- never client-supplied
client_ts 1755445921000 Unix timestamp (ms) from the client clock
result_count 3 Count of items in the output

distinct_id (CLI install ID): Each enabled installation generates a random UUID on first use and stores it at %APPDATA%\bim-cli\did (Windows) or ~/.config/bim-cli/did. It is not derived from any hardware characteristic, username, or personal identity. Its purpose is to correlate events from the same install for usage-pattern analysis and to enable self-service deletion via bim telemetry forget. You can rotate it at any time with bim telemetry reset-id; rotation unlinks future pings from past history. When telemetry is disabled, no ID is generated or sent.

What is never sent: IP addresses, file paths, argument values, document content, conversation data, or any content you pass to a command.

Install ping (unconditional): One ping per install, fired by install.ps1 regardless of BIM_TELEMETRY setting. Sends only the installed version tag. The server records the date and a 2-letter country code from Cloudflare geo-IP (e.g., US). No IP address is stored.

Website install-intent beacon: When you click an install or download link on bimcli.com, or use a page's "copy" button for the install prompt, the page sends a copy_install event to t.bimcli.com/event. The payload fields are: event ("copy_install"), page (the path), distinct_id (the bim_did UUID described below), and ref (the referrer hostname if present, for example news.ycombinator.com -- never the full URL or query string). No cookie or IP address is stored.

bim_did (website funnel ID, stored in localStorage): The page stores a random UUID under the key bim_did in your browser's localStorage. It is generated by crypto.randomUUID() and is not derived from any user identity or machine characteristic. Its purpose is to link a copy_install event to the subsequent install and first CLI run in the operational funnel. It is not used for cross-session profiling. To clear it, clear your browser's site data for bimcli.com (in Chrome/Edge: Settings > Privacy and security > Clear browsing data > Cookies and other site data; in Firefox: about:preferences#privacy > Clear Data).

Desire-paths log (local only): When bim-cli encounters a verb or flag it does not recognize, it writes a record to %LOCALAPPDATA%\bim-cli\logs\unknowns.jsonl on your machine. This contains only the unrecognized command shape -- no argument values, no file paths, no personal data. This file is local and never uploaded automatically.

Desire-paths upload (bim feedback, opt-in): When you run bim feedback, the local unknowns log is uploaded to t.bimcli.com. Uploaded fields: bim version, OS family, caller type, and command entries (format, verb, flags only -- no argument values). A short optional freeform note may be included. The server records a 2-letter country code from Cloudflare geo-IP. No IP address is stored.

Website (bimcli.com / mcp.bimcli.com): The website runs two services that collect data. Google Analytics 4 (measurement ID G-1BGKZ53S2S) collects pageview and session data; it sets a first-party _ga cookie and sends data to Google. The first-party install-intent beacon (described above) also runs on every page and sends a copy_install event when you interact with an install link or copy button; it stores bim_did in localStorage and sends it as distinct_id, as described above. If you prefer not to have GA4 track your visit, you can use a browser extension such as uBlock Origin to block googletagmanager.com.

2. Usage

Telemetry data is used solely to understand which bim-cli verbs are used, at what frequency, and with what error patterns -- to guide feature development and bug prioritization. Install ping data counts installation volume and geographic distribution. The website install-intent beacon is used only to understand which pages and referrer hosts lead to install attempts. No data is used for advertising, targeting, user profiling, or resale.

3. Storage

CLI telemetry, install, feedback, and website install-intent data is stored in two places, both operated by Cloudflare in the US region and processed by the t.bimcli.com Cloudflare Worker:

Cloudflare acts as a data processor under its Data Processing Addendum and privacy policy. The Worker does not log or store IP addresses for any endpoint. Website analytics are stored in Cloudflare's analytics infrastructure.

4. Third-party sharing

Data collected by bim-cli (telemetry, install, feedback) is not shared with any third party. Cloudflare processes it as a sub-processor under their DPA. No advertising partners, analytics vendors, or data brokers receive any bim-cli CLI usage data. Website analytics only: pageview and session data from bimcli.com is processed by Google via Google Analytics 4 (see Section 1, Website). This sharing is limited to website traffic data and does not include CLI usage, file contents, or argument values.

Third-party calls made on user request: bim-cli is a local, offline tool. When you explicitly invoke a verb that calls an external service, that call goes directly from your machine to the provider:

5. Retention

D1 (live query layer): raw event records are retained for a rolling ~90-day window; records older than that are purged by a daily Cloudflare Cron Trigger.

R2 (durable archive): a daily snapshot is exported from D1 to R2 before the purge runs. No deletion schedule is applied to R2.

Self-service deletion: Run bim telemetry forget to request server-side erasure of all records associated with your distinct_id from both D1 and R2, followed by automatic rotation of your local install ID so future pings are unlinked. This is a best-effort deletion; aggregate statistics derived before the deletion are not individually traceable.

Uninstalling bim-cli does not erase telemetry data already sent. To erase it, run bim telemetry forget before uninstalling.

distinct_id (CLI install ID): this is a random, resettable UUID described in Section 1. It is not linked to a person and is not tied to any hardware identifier. Rotate it at any time with bim telemetry reset-id.

The desire-paths log (%LOCALAPPDATA%\bim-cli\logs\unknowns.jsonl) is a local file; you can delete it at any time.

bim-cli does not collect personal data as defined by GDPR. bimcli.com receives standard CDN-level request data through Cloudflare. If you are a California resident: Small Tiger Group does not sell personal information. The categories of information received via Cloudflare's CDN are: internet or other electronic network activity information (IP address, browser type, pages visited). No other CCPA data categories apply.

6. Contact

Privacy questions and deletion requests: libo@smalltigergroup.com

Cloudflare's DPA and Standard Contractual Clauses are available at cloudflare.com/gdpr.

Opt-out

To disable usage telemetry, use any of the following:

Any of these is checked before each command. The install ping (version + country) is unconditional -- it fires once during install.ps1 and is not gated by these settings.

To erase data already sent: bim telemetry forget -- deletes all records for your install ID from both D1 and R2, then rotates the local ID.