Privacy Policy

Effective 2 October 2026

In short: if you sell here, we hold your account, your products and your orders. If you buy from a store here, we hold what it takes to ship to you — your name, email address and address — plus the messages you send. We run one cookie, and only when a seller signs in. There are no advertising or tracking scripts on this site, we do not sell personal data, and we do not share it with anybody to advertise with. Deleting your account deletes the store and everything in it.

Who this covers, and who we are

Limn Land is an independent service run by one person in the United States. There is no company behind it, and no data-protection officer: privacy questions come to the person who wrote the code, at the address at the bottom of this page.

This policy covers three kinds of people. Sellers, who open a store. Buyers, who buy from one — you do not need an account to do that. And visitors, who read the marketing pages. It covers limn.land and every store on it, and it does not cover anywhere else: when a payment leaves for Stripe, or a parcel leaves for a carrier, their own policies take over.

Two things are worth saying before the lists. A storefront is a public page — artwork names, prices, photographs, formats and production times are visible to anyone, including search engines, and that is the point of having one. The artwork sale is the seller's, so a seller may keep their own records of what they sold you under their own policies; Limn takes the payment as settlement merchant and keeps the payment, tax and fulfilment records that go with it.

What we collect

If you sell

• Your account. Your email address, your name if you give one, and your password — stored only as an Argon2id hash, which cannot be turned back into your password, not even by us. If you sign in with a code instead of a password, we hold that code until it expires, and a record that you verified the address.
• Your store. The handle you chose, the name and blurb on it, the links you add, and the appearance choices you make. All of this is public by design.
• Your artworks. Titles, descriptions, prices, formats, and the images you upload, which are stored with our file-storage provider and served from it.
• Your business details. The address and phone number you give for returns and correspondence. Buyer delivery details are passed to our print supplier so it can produce and ship the order.
• Your Stripe account. The identifier of the account created for you and whether it can take payments. Your bank details, tax numbers and identity documents are given to Stripe and never to us.
• Your orders and conversations. Every order placed in your store, including the buyer's name, email address and delivery address, and the messages between you and your buyers. Orders are the record of what you sold, and they exist because a sale happened.

If you buy

Your name, email address and delivery address, a phone number if you give one, what you ordered, and any messages you send the seller — including any image you attach to one. We also hold whether you marked the purchase as recommended, which is the count shown on the storefront. You do not create an account and there is no password. Your card number goes to Stripe and never reaches us or the seller: we cannot see it, store it or charge it.

One thing worth knowing about how a conversation works. You reach it through the link in your order email, which contains a long random token instead of a login — so treat that link like a key, because anyone holding it can read the thread. If you want it retired, write to us: there is no button for that, but we can do it by hand and will tell you when it is done.

If you are just reading

Your IP address, which is used to rate-limit requests and block abuse, and the pages you ask for, which appear in our server logs. Page views and Core Web Vitals are counted without cookies by our hosting provider. Errors — a page that fails to render, a request that throws — are sent to our error monitor with the route and technical detail; we do not send it your name, your email address or your password, and it does not build a profile of you across other sites.

What we do not collect

Card numbers, bank details, government identity documents. Your data from brokers, social networks or advertising networks. Your buyers' details for marketing of any kind. Anything at all about what you read elsewhere on the internet — there is no advertising tracker, no pixels, and no profile built about you to sell.

Cookies

There is one, and it exists to keep a seller signed in. It is called auth_token, it is set when you sign in or claim a store, it expires after seven days, and it is cleared when you sign out or delete your account. It holds a signed token that identifies your account and nothing readable by scripts on the page.

If you never sign in, no cookie is set at all, and that is why this site has no cookie banner. There is no advertising cookie, no analytics cookie and no third-party cookie: page-view counting is cookieless, and the ad networks that would set one are not here.

Who else sees it

Running a store needs other companies, and each of these sees only the part it has to:

Stripe

Payments, seller accounts and payouts. This is where your card details live and where money moves. Stripe processes the payment, and Limn is the settlement merchant for the payment leg of every sale.

Lumaprints

Our print and delivery supplier. It receives the buyer's name and delivery address and the artwork specification so it can print, frame and ship the order.

Resend

Our transactional email: order confirmations, tracking updates, sign-in codes, password resets, message notifications and the recommendation request that follows a delivery.

Cloudflare R2

File storage for product photographs and store images, served from a public address — anything a buyer can see, anyone can fetch.

Neon

The managed PostgreSQL database the whole product runs on. Everything described above as "we hold" is a row in it.

Vercel

Hosting, request logs, and cookieless page-view and performance counting.

Upstash Redis

Rate limiting. Each route keeps a short-lived counter against the IP address a request arrives from, so that one client cannot exhaust the site for everybody else. The counters expire on their own.

Sentry

Error reports and performance traces, so a page that breaks is noticed and fixed. A report carries the request path and the technical detail of the failure. Your name and email address are not attached to it, and your password and card details never reach us in the first place.

Beyond those: the seller sees the buyer details attached to their own orders, because they are the seller of the artwork and may have to answer questions about it. Public storefront pages are visible to everyone, including search engines. And if a court order, subpoena or valid legal demand requires it, we hand over the minimum that it asks for, and we tell you afterwards unless we are not allowed to.

We do not sell personal data. We do not share it for advertising, and we do not share it for the kind of cross-context behavioural advertising that most privacy laws give you a right to opt out of — there is nothing of that kind here to opt out of.

Why we hold it

To run the thing you asked for: your store, your orders, your returns, your messages, and the emails that tell people what happened to their purchase. To keep it secure and working — rate limits, error reports, abuse prevention. To meet obligations we cannot opt out of, such as keeping records of a payment dispute. And to answer you when you write in.

Email is transactional. We send order confirmations, tracking, sign-in codes, password resets, message notifications, a recommendation request three days after a delivery, and — only if somebody asked for it — a notification that a drop has launched. We do not send newsletters and we do not run campaigns into your inbox.

How long we keep it

• Your account, store, products, images, orders and conversations: while your account exists. Deleting the account deletes them.
• Sign-in and verification codes: they expire within minutes, and the rows are cleared once expired.
• Records of webhooks we have processed from Stripe: 90 days, so that a redelivered event cannot double-charge anyone.
• Reservations made while a checkout is open: 30 minutes, plus a day of slack before the sweep removes them.
• A storefront created and never claimed: deleted about an hour later, along with its claim link.
• Server logs and error reports: kept for a limited period and rotated. We would rather say that than name a number nothing enforces.
• Backups: copies exist in rotating backups for a limited period after a deletion, and disappear as those rotate. A deletion request is carried out on the live system immediately and reaches the backups on their own schedule.

Your data, and what you can do about it

Ask for a copy. Write to us and we will send what we hold about you and about your store, in a form you can read and take elsewhere.

Correct it. Name, handle, blurb and links are editable in your dashboard. For anything else, write to us and we will fix it.

Delete it. Settings → delete account, in the dashboard. You cannot delete an account with orders still open, because buyers have paid and their piece has not moved; once those orders are completed or refunded, deletion removes your storefront, products, uploaded images, order records and conversations from the live system, and closes the Stripe account created for you. Keep anything you need for your own income records first — your payout history lives in your Stripe account, and Limn cannot give it back to you afterwards.

If you bought something. Your order details are held both with us and with the seller whose artwork it is. Ask us and we will delete what we hold and tell you about anything we are required to keep, such as a record of a payment dispute; the seller keeps their own records of their own sale, and you can ask them directly through the store.

We answer these requests within 30 days, and we will not treat you differently for making one. If you are not satisfied with how a request was handled, you can complain to your state's attorney general.

Children

Limn Land is for adults: you must be 18 or older, or the age of majority where you live, to sell here or to buy. We do not knowingly collect anything from children, and we do not allow an underage account to keep running. If you believe a child has given us their details, write to us and we will delete them.

Security

Passwords are stored as Argon2id hashes. Traffic to and from this site is encrypted in transit. Card numbers never reach our servers. The session cookie cannot be read by scripts, and it is invalidated everywhere the moment a password changes. Requests are rate limited and origin-checked, and access to the database is limited to the application that needs it. The architecture page documents all of it in more detail than most companies publish.

No system is perfect, and a one-person platform makes no claim to be unreachable. If a breach ever affects your data, we will tell you and the authorities as the law requires, and we will say what was taken rather than what was not.

Changes to this policy

The date at the top is the version in force. When a change materially affects what we collect or who sees it, we will tell you by email or in the dashboard before it takes effect — never afterwards.