It seems that anyone who's contributed a project to the bundle can view the bundle's analytics - and in particular we can see the email addresses of everyone who's purchased it, and how much they paid. Is this intended?
EDIT: looks like this has been fixed, nice