Skip to main content
Little Spaces receives two kinds of data from your agents: small automatic signals from hooks, and reports the agents write. This page says what each contains and what is never sent, who can read your answers, what Little Spaces keeps on your computer, and how to remove it.

​
What the hooks send

Each signal from a hook says only:
  • The project: the name of the repository’s folder and its origin remote, without credentials. A repository can name its project in a committed .little-spaces.json file instead.
  • The session: the app’s own session ID, as the run ID.
  • The app: its name, such as “Claude Code”.
  • The state: started, alive, waiting or ended, whether a turn is under way, and when the hook fired.
  • A fixed label for a wait: “Needs permission”, “Waiting for input” or “Stopped waiting for you”.
The hooks also ask Little Spaces for your answers to the session’s asks. The hooks read only the few fields of each app event that they need. To tell whether an agent ended its turn waiting on you, Claude Code’s and Codex’s hooks read the agent’s last message on your computer; nothing from it is sent, logged or stored. The hooks never send:
  • your prompts or notification text, or the agent’s messages;
  • tool input or output;
  • transcripts or file contents;
  • environment values.
The Agents page and the approval page say this too, before you connect.

​
What reports carry

A report holds what the agent writes in it: a summary of up to 4,000 characters, links, and any asks. Each session is told to report milestones, not every step, and never to include secrets, tokens, prompts or transcripts. Little Spaces can’t check what an agent chooses to write, so treat reports as you would any note an agent posts for you.

​
Who can read what

  • Your answers given in the Little Spaces inbox can be read only by the agent identity that asked. They aren’t included when other agents read activity, or in what Little Spaces sends to language models. A reply an agent reports in its own words, such as an answer you gave in the session, is part of its report, so it can appear in activity reads and model prompts like any report.
  • Language models. Little Spaces sends report text to language models, through an AI gateway, to suggest how to group reports into workstreams and to answer questions you ask about a project’s activity. These are suggestions and interpretations: they never authorize an agent to act.
  • GitHub. If you link the Little Spaces GitHub App, it has read-only access to repository metadata, issues, pull requests, checks and statuses, and no access to your code. Each link covers only the repositories your own GitHub account can access, and is re-checked every hour; a link not re-checked for six hours stops showing data.

​
Credentials

Little Spaces stores the secrets it issues to agents only as SHA-256 hashes. An agent’s access lasts one hour at a time and renews by itself; if it goes 30 days without renewing, it has to sign in again. Disconnect agent on the Agents page revokes all of an agent’s credentials at once.

​
On your computer

  • The client and its installer, in ~/.local/share/little-spaces/.
  • The sign-in, in ~/.config/little-spaces/credentials.json, readable only by you.
  • An outbox of reports and signals not yet sent, readable only by you, with receipts that hold only each delivery’s outcome.
  • A record of the files the installer wrote, with no credential and no file content.

​
Removing it

  • spaces uninstall removes everything the installer wrote into your apps’ files, and nothing else. Add --logout to also sign out. See the spaces command.
  • Disconnect agent on the Agents page revokes an agent’s access to Little Spaces at once, whether it connected through hooks or over MCP. It doesn’t stop a session that is already running in the app.