Privacy policy

Information we collect

When you create an account with email and password, we store your email address and a password hash, rather than your readable password. We also store authentication records, sessions, and security information needed to manage access to your account.

When you choose Google sign-in, Google provides an account identifier, your email address and its verification status, your name, and your profile picture URL. We store this information with your account to authenticate you and associate future sign-ins with the same liimb account. We do not receive your Google password. We request only basic identity scopes (openid, profile, and email), with no access to Gmail messages, Google Drive files, contacts, or calendars.

We store the content you add: your handle, display name, bio, links, uploaded or imported images, appearance settings, and publication settings. If you contact support, we receive the information you include in your message. Hosting and infrastructure providers may process technical information such as IP addresses, request details, device/browser information, and error logs to deliver and protect the service.

Visits to published pages

When someone visits a published liimb page or clicks one of its links, we count it so the page’s owner can see how their page is doing. Each count records the page, the link that was clicked, the day, the website the visitor came from (its domain only, such as instagram.com, never the full address), and the visitor’s country when our hosting provider supplies it.

We do not store visitors’ IP addresses, full browser user-agent strings, or the full address of the page they came from, and we do not use cookies or build profiles of visitors. We check the browser’s user agent when a visit arrives to leave out search engines and other automated traffic, then discard it. To avoid counting a reload as a new visit, the visitor’s browser keeps a note in session storage for 30 minutes. Owners viewing their own page while signed in are not counted.

Individual visits are kept for a few minutes, then combined into daily totals for each page and deleted. Daily totals contain no information about individual visitors. A page’s totals are visible only to its owner and are deleted along with the page.

How we use information

We use information to create and secure accounts, sign you in, save and display your content, deliver requested account-recovery messages when email delivery is available, respond to support requests, troubleshoot problems, and prevent abuse.

Google account information is used for sign-in, account identification, and account linking. Your Google email address is not automatically published on your liimb page. Your public page uses the profile and content you choose in the editor. We do not use Google account data for advertising, sell it, or use it to train AI models.

Public pages and images

When you publish a page, its visible profile, links, and selected images become publicly accessible. Visitors, search engines, and other services may copy or cache them. Unpublishing hides the page from liimb’s public page route, but does not remove copies held elsewhere.

Uploaded and imported image URLs can be opened by anyone who knows the URL, including while your page is unpublished. Treat image uploads as publicly accessible and do not upload confidential or sensitive files. Deleting an unused image is available in the image library; cached copies may remain temporarily.

Service providers and other websites

liimb uses Convex for its database and authentication, Vercel for web hosting, Cloudflare R2 and its CDN for hosted images, and Google when you choose Google sign-in. Resend is the configured email-delivery integration when recovery email is enabled. These providers process the information needed to supply their services. Their processing may take place outside your country.

When you request a link preview, liimb fetches the destination website and may copy its title, description, and image into your account. Visiting an external link takes you to another service with its own privacy practices. We may disclose information when legally required or when reasonably necessary to address fraud, abuse, or threats to the service or its users.

Browser storage and security

liimb uses browser local storage to keep you signed in. Google sign-in uses temporary cookies and verification values to complete authentication securely. Clearing browser storage can sign you out; it does not delete your server-stored account.

We use access controls and password hashing to protect account data. No service can guarantee absolute security. Keep your account credentials private and avoid putting sensitive information in public content or image uploads.

Retention and your choices

Account and content data is retained to provide the service until it is removed or an account-deletion request is processed. Limited records may remain where needed for security, legal obligations, or backup recovery. We do not promise that copies in third-party caches or backups disappear immediately.

You can edit your profile and links, hide links, unpublish your page, remove unused images, and export your page data in the editor. Account deletion is currently handled through support rather than an in-app button. Contact us to request access, correction, or deletion of account information; we may need to verify account ownership. Depending on where you live, additional privacy rights may apply.

You can revoke liimb’s access from your Google Account’s third-party connections settings. Revocation does not by itself delete your liimb account or content. Contact support if you want those removed too.

Changes and contact

We will update the date on this page when the policy changes. If we change how Google data is used, we will provide an appropriate notice and request consent where required before using it for the new purpose. Questions about this policy or requests concerning your information can be sent to the contact address below.