Limner

Last updated 24 October 2026

Limner is a catalogue for a household's books, run as one service for many households by Surface Collective Co. ("we"). This policy covers the website at app.getlimner.com and the Limner app for iPhone and iPad.

The short version

We keep what you put into Limner on our servers, and use it to run Limner and to build and improve it, including features that work across libraries.
We don't sell your personal information, and we don't track you across other apps or websites. Limner has no ads today.
A child's reading stays inside your household. See Children, below.
A few outside services help us run Limner. Each one is listed below, with what it receives.

What we keep

Your account: your name, your email address, and your password, which is stored only in scrambled form that can't be turned back into the password.
Your library: books and copies, where they're shelved, collections, tags, notes, covers and files you upload, loans and the names of the people who borrowed, and reading activity: what you're reading, dates, ratings and goals. If your admins share the library by link, we also keep what visitors leave when they ask to borrow a book: a name, a way to reach them and a note.
Members of your library: the name and email address you enter when you add or invite someone. An admin can also add a member's birth date, which is used to decide which books suit a younger reader.
Things you import: photos of shelves, pasted lists, and spreadsheets or exports you send through Import. A photo you take to add one book is read and then thrown away; it isn't kept. A photo of a shelf is kept until you add its books or discard that import, and for 30 days at most, so the check screen can show each book's spine; it's never used as a cover.
Sign-in records: on the website, a cookie that keeps you signed in. In the app, a sign-in token for each device, with a name for the device and when it was last used, so you can see and sign out your devices.
How the app is used: simple daily counts for each library — how often each screen is opened, how many books were added and by which method (scan, search, photo, import), how many times the AI helped and with what kind of job, and how big the library is. The counts belong to the library as a whole. They don't say which person did something or which books were involved, and they're used only to see what is working and what isn't.
Technical records: your IP address, used to slow down repeated sign-in attempts, and ordinary server logs.

How we use it

To run Limner for you: showing your library to its members, tracking loans, sending the reminders you've turned on, suggesting what to read next.
To build and improve Limner: some features look at what many libraries own and read, for example to suggest books, to match the same book across libraries, or to let households that have joined a lending group see what each other can lend. Our team may look at library and reading records while building and checking these features, including the titles in them.
To keep it working: the usage counts and technical records described above tell us what is used and what breaks.

If you'd rather your library were left out of the features that look across libraries, a library admin can email us at the address below and we'll do that. When such a feature ships, we'll also put a switch for it in the library's settings.

Who can see your library

The members of your library can see its catalogue, and its admins manage it. Each library is kept in its own database, and nothing in it is shown to other households unless your library's admins choose to share it, for instance by joining a lending group. If you ask us for help, an owner can give us a support code, which lets us see the library — read-only, for up to an hour — and you can end that at any time.

Outside services

Supabase hosts our database, which holds accounts and library records.
Anthropic provides the AI that reads imports and photos. When you photograph a book to add it, or import a shelf photo, pasted text or an unfamiliar spreadsheet, the photo, the text or a sample of the spreadsheet's rows is sent to Anthropic's Claude model to pick out titles and authors. Under Anthropic's commercial terms, this data isn't used to train their models.
Our AI provider also helps with a few other jobs: tidying up a book's details, suggesting an age rating, filling in the books of a series, and suggesting an order for a shelf. These send book details — titles, authors, descriptions, series names and the list of books on a shelf. Arranging a shelf also sends any instructions you type for it, exactly as you typed them, so leave out anything you'd rather not share. We don't add anything else about the people in your library. The provider is Anthropic today; our software can also use OpenAI or Google (Gemini) instead, and if we switch, these details go to that provider.
Resend delivers our email: address verification, password resets, invitations and reading reminders. It receives the recipient's address and the message.
Sentry receives reports when something goes wrong on our server. We strip the contents of your catalogue out of these reports before they're sent.
Open Library and Google Books are where we look books up. They receive the ISBN or title being looked up and nothing about you. Many book covers are pictures they host, which your browser or the app loads straight from them whenever you view the book, so they see your IP address.
Other websites: if someone in your library sets a book's cover to a picture from another website, your browser or the app loads it from that website whenever you view the book, so that website sees your IP address too.
jsDelivr serves the barcode-scanning code used by the website's scan page. Like any website, it sees your IP address when your browser loads it.
Apple handles TestFlight crash reports and the feedback you send through TestFlight, under Apple's own privacy policy.

On your device

The app keeps your sign-in token in the iOS Keychain, and a few settings, such as your choice of light or dark mode, on the device. It contains no advertising or analytics code. The website stores your light or dark choice in your browser.

How long we keep it

For as long as your account and your library exist.
When an owner deletes a library, it goes offline straight away. Its records and files are kept for at least 14 days, in case it was deleted by mistake, and after that we erase them permanently by hand. If you want that done, or confirmed, by a particular date, email us.
Daily backups are kept for 30 days, so erased information is gone from them within about 30 days of being erased.

Your choices

You can see and change what you've entered at any time, in the app or on the website. A library admin can export the whole catalogue.
You can leave a library, and an owner can delete one.
You can delete your account yourself: in the app, under More, then “Delete Account”; or on the website, from your profile (under your name, then “Delete account”). It takes effect straight away and signs you out everywhere. Your sign-in address, your password and your reading history are deleted. In a library you shared with others, the books and loans stay and you appear as “Former member”, because the library still holds them. A library that only you belonged to is deleted with your account and erased permanently after the grace period described above. If you're the only owner of a library that other people use, you'll be asked to make one of them an owner first.
To get a copy of your information or correct it, email us at the address below. We'll answer within 30 days.

Children

Limner accounts are for adults and teenagers. We don't knowingly let children under 13 create accounts. A parent adds a child as a member of the household's library instead, with a name and, if they choose, a birth date, and the child never signs in.

What a child reads stays inside the household. A child's reading activity, ratings and notes are shown only to the members of your library. They're never shared with other households, never used in the features that look across libraries, and never included in any figures we put together from many libraries. The household's books themselves belong to the household, so they can still be lent out if an admin chooses. A parent or library admin can see, change and delete everything recorded about a child.

Changes

If this policy changes, we'll update this page and the date at the top. If the change matters, we'll also tell account holders by email.

Contact

Surface Collective Co. — ops@surface-collective.co

Help & support · Sign in