Privacy Policy

This policy explains what Limns does with information about you. Limns is an independent product run by one developer, and that developer is the person responsible for the data (the “data controller”). Everything below is decided and answered by them, at support@limns.cc.

Where your chats and images live

We keep a copy of your history under your account. Your threads, messages, prompts and generated images are stored on our servers, and also kept in your browser so the screens are instant and keep working offline. The two are reconciled whenever you open the app.

We keep that copy so that your history is still there when you sign in on another machine, and when this one forgets it — which browsers do on their own: Safari deletes everything a site has stored locally after seven days without a visit. Before we kept a copy, a week away meant an empty account.

What follows from that, and is worth knowing:

• Your history is on our systems, and the operator can technically reach it. We do not sell it or use it to train anything, and we do not read it — except the content a report or a model provider’s notice is about, which we look at to review it (see how content is moderated), or where the law requires us to.
• Settings → Data → Clear deletes it in both places, for good, along with your files. Deleting a single thread deletes it in both places too. Settings → Data also exports everything as a single JSON file.
• Clearing your browser alone no longer loses anything: the account’s copy is pulled back down the next time you sign in.

Files are kept under your account — both the pictures or PDFs you attach to a message and the images the models generate for you. A file is readable only by the account that uploaded or made it. We hold it until you delete the thread it belongs to, remove it before sending, or clear your data in Settings → Data. Generated images on an account with no paid plan are also deleted 90 days after they are made; download anything you want to keep. When a plan ends we wait a further 30 days before that applies to what it was holding. Each plan comes with a storage allowance, shown in Settings → Data.

One thing about a generated image is worth knowing before you share it: some providers write provenance metadata into the file, marking it as made by their model. We neither add that nor remove it, so it travels with the image you download. Ordinary photo metadata works the same way in the other direction — a picture you upload keeps whatever its camera or phone recorded in it, location included, and we do not strip that either.

Sending a message is different from storing one: to answer you, the message has to be transmitted to the model provider you chose. That is covered below.

What we collect

• Conversations and images. Your threads and their messages, the prompts you write, and the images the models generate for you — held under your account so they are there on your next device, as described above. We do not sell them or use them to train anything, and read them only in the cases just described.
• Account. Your email address, and your name and picture if you set them or they come from Google or GitHub sign-in. Held by our authentication provider, Clerk, along with your password (hashed) and a list of the devices and sessions signed in to your account.
• Usage records. One row per charged request: which model answered, how many input and output tokens it used, how many web searches or images it produced, what it cost and when. These carry no prompt or reply text — only the numbers the bill is made of.
• Files. The images and PDFs you attach to a message, and the images generated for you, held under your account so your threads can show them and so an attachment can be sent again with the rest of a conversation. We store the file, its type and its size. Nothing reads them but you, the model you send them to and — for an image generated for you — the automated check it passes before it is shown, except in the review of a report described above.
• Payments. Your order number, what it bought (a top-up, or a month of a plan), the amount, the currency, the status and Waffo’s reference for it. We never receive or store your card number; Waffo holds the payment details itself.
• Technical data. Ordinary server and network logs from Cloudflare, which serves the site: IP address, user agent, the request and when it happened.

We run no analytics, advertising or tracking scripts. There is no Google Analytics, no advertising pixel and no third-party session recorder on this site. We do not sell personal data, and we do not use your content for advertising.

What we do with it, and why

• To provide the service you asked for — sending your request to the model provider you chose and returning its answer. Legal basis: performance of our contract with you.
• To operate credits and payments, and to keep the accounting and tax records the law requires. Legal basis: contract, and legal obligation.
• To keep the service working and safe: rate limits, abuse and fraud prevention, debugging. Legal basis: our legitimate interest in a service that stays up and is not abused.
• To check image requests automatically against the acceptable use rules — the prompt before it is drawn, and each picture before it is shown (see how content is moderated). Legal basis: our legitimate interest in a service that is not used to harm people.
• To review content that is reported to us, or that a model provider tells us broke its policy, under the acceptable use rules, and to report child sexual abuse material to the authorities. Legal basis: our legitimate interest in a service that is not used to harm people, and legal obligation where the law requires a report.
• To answer you when you write to us. Legal basis: contract, and legitimate interest.

We do not use your prompts, files or generated images to train models, and we do not send them anywhere except the provider needed to answer the request in front of us and, for an image request, OpenAI’s moderation model that checks it — or, for child sexual abuse material, the authorities it is reported to.

No profiling, and no automated decision about you. We do not build a profile of you, and nothing here makes a decision about you with legal or similarly significant effect. The automated parts are arithmetic and limits — pricing a request against your balance, applying a rate limit — and the content check on image requests, which refuses a prompt or a picture and never an account. If an account is suspended or closed, a person decides that.

Who else processes it

These are every third party that handles data on our behalf, and what each one gets:

• Clerk — authentication. Holds your account identity, credentials and sessions.
• Cloudflare — hosting, database, file storage, email and the AI gateway your requests are routed through. Cloudflare’s AI Gateway sits between us and the model providers, and depending on its logging settings it may retain the content of a request and its answer for observability for a limited period.
• The model providers — OpenAI, Anthropic, Google, DeepSeek, and Black Forest Labs, reached directly. The one you picked receives your message, any files attached to it, and the earlier turns of that conversation, because that is what it needs to answer. If you turn on web search or link reading, your query and the page addresses go to the search tool that provider runs. OpenAI, Anthropic and DeepSeek also receive a code standing for your account — a one-way hash, not your name, email address or account ID — so that a provider that finds a request breaking its rules can act on that one account rather than on the whole service. The prompt of an image request, and each picture drawn for it, also go to OpenAI’s moderation model to be checked, whichever provider draws it. When a reply makes files, the code the model writes runs in a sandbox the provider hosts, together with the files this conversation made before. Anthropic keeps such a sandbox for up to 30 days, so a later message can carry on with it; OpenAI’s ends 20 minutes after it was last used, or when you delete the conversation. Each file a reply makes is copied to your account, and the provider’s copy is deleted. Each provider then handles the data under its own terms, not ours.
• This list is generated from the same catalogue the app runs on, so adding a model updates it here. The model list names every model and who serves it.
• Waffo Pancake — merchant of record for every payment. We send it your account’s email address, to fill in at checkout, and an internal account ID, so the payment is credited to your account. It collects your payment and billing details directly; we receive only the result of the order (order and payment references, amount, currency, status).

Site icons shown next to search results are fetched by our own server from Google’s public favicon service, so your browser never contacts it and your address is never disclosed to it.

International transfers

There is no version of this service that keeps your data in one country. Your account, your threads and your files are held on Cloudflare’s network, with the database and the file storage placed in the Asia-Pacific region; your identity record is held by Clerk; and the model that answers you is run by a company that is, for most of the list, in the United States. So using Limns means your requests cross borders, including out of the country you are in, every time.

Set out plainly, because some laws require it to be: the recipients are the ones named above under Who else processes it, each with what it receives; the purpose is to run the service and answer the request you made; the data is your message and any files attached to it, your account identity, and the usage and payment records the bill is made of. Each recipient then handles it under its own privacy terms rather than ours, and you can exercise the rights below against us for all of it, at support@limns.cc.

If you are in mainland China, that transfer out of the country is the service working, not an extra: a request that is not sent abroad cannot be answered, because no model here runs in China. Signing up and sending a message is how you agree to it, separately from everything else on this page, and you can withdraw that agreement at any time by closing your account in Settings → Profile — but not by continuing to use the service, since there is no way to answer you without it. Where the law requires a transfer mechanism for European data, for example the EU’s standard contractual clauses, we rely on the ones our providers have in place.

Cookies and browser storage

We use only what is strictly necessary to run the service. There are no advertising or analytics cookies, and so there is no consent banner to click through.

• Session cookies set by Clerk, which keep you signed in. Removing them signs you out.
• A language cookie (limns_lang), which remembers whether you read the site in English or Chinese. It is a cookie rather than browser storage because pages are rendered on the server, which has to know the language before it writes a word.
• Local storage and IndexedDB, which hold this device’s copy of your threads and images, your theme, accent and language choice, the state of the composer’s tools and panels, and cached copies of your credit balance and of your name, email address and profile photo, so the sidebar can show them immediately. Clearing your data in Settings → Data removes them.

How long we keep it

• Your account, for as long as it is open. Closing it in Settings → Profile deletes your conversations, your generated images and your files, and then the identity record itself. Only the payment records below survive it.
• Credit and payment records — your orders, and the one row per request that Settings → Spending shows — for six years from the end of the year the payment falls in, which is the period accounting and tax rules require, and then no longer. They outlive a closed account, because they are the records that prove what you were charged; they carry no prompt or reply text, only a model id, a token count and a price. Nothing else survives closing an account.
• Threads and messages: until you delete them, or clear your data in Settings → Data. Deleting removes our copy as well as your browser’s.
• Attachments: until you delete the thread they are in, or clear your data. Nothing expires them for you.
• Generated images: the same, except on an account with no paid plan, where they are deleted 90 days after they are made — and for 30 days after a plan ends, not even then.
• Files a reply made: the same as generated images.
• Server logs, for the short retention period our infrastructure provider applies.

Security

Traffic is served over HTTPS, credentials are held by our authentication provider rather than by us, payment details never reach our systems, and access to the production database and file storage is limited to the operator. Your history is stored under your account and is served only to that account: every read names the owner, so an id from another account finds nothing. No service can promise perfect security.

If something does go wrong and a breach puts your data at real risk, we will tell you — by email, directly, and without waiting to be asked — along with what happened, what it reached and what to do about it, and we will notify the regulators the law requires us to notify. One developer runs this, so there is no incident desk to route it through and no reason for it to take days.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to export it, to object to or restrict processing, and to withdraw consent. In the EU and UK that is the GDPR; in mainland China, the Personal Information Protection Law; in California, the CCPA/CPRA, including the right not to be discriminated against for exercising it.

Much of it you can do yourself: Settings → Profile edits your account and closes it, Settings → Data exports your history and clears it, on our systems and in this browser alike, along with your files. For anything else, write to support@limns.cc and we will answer within 2 business days and act within one month, which is the deadline the law sets. It costs nothing, and we will not make you give a reason.

Write from the address on the account. If you write from another one we will have to check it is yours before handing anything over — not to make it difficult, but because “send me everything you hold on this person” is exactly what someone else would write. We ask for no more proof than settles that. You also have the right to complain to your local data protection authority, and in the EU or the UK, to do so in the country you live in.

Children

Limns is not for children. You have to be 13 to use it, older where the law where you live says so — 16 in several EU member states, and under 14 in mainland China a guardian has to agree — and 18 to buy anything. We do not knowingly collect a child’s personal data, and we have no way of verifying an age beyond what an account tells us. If you believe a child has created an account, write to us and we will remove it and everything in it.

Changes

We may update this policy. The date at the top says when it last changed, and a material change will be notified in the app or by email before it takes effect.

Contact

Write to support@limns.cc — it reaches the developer who runs Limns directly, and is answered within 2 business days. See also our Terms of Service, our Refund Policy and our contact page.