CatalogLense
Privacy Policy
Summary
CatalogLense is a cataloging app for library staff. It connects to the Koha servers whose addresses you enter yourself (your library's, or each library you catalog for) and to a CatalogLense account that holds your plan and AI credits. The app never sends us anything from your Koha, and we don't connect to it, unless your library has asked us to host its Koha under an Enterprise agreement (see "If we host your library's Koha").
What your CatalogLense account holds
- Your email address. It is also how you sign in: we email you a code.
- Your library account's name, its plan, its owner and staff, and the email addresses of staff invites still waiting to be accepted.
- How many AI credits your library has used, and when.
- When you signed in, and from which IP address, kept by our hosting provider for security.
- Whether we have sent you the welcome email, and when.
People in the same library can see each other's email addresses. Only the owner sees pending invites.
What stays on your device
Stored only on your device, and removed when you uninstall the app:
- Your Koha username and password, or API key, for each saved server where you use "Remember Me" (kept in the iOS Keychain or Android Keystore).
- Your own AI key, if you use one on the Free plan (also in the Keychain or Keystore).
- Your CatalogLense sign-in and a copy of your library's account details (name, plan and staff emails), so the app can start without internet.
- The Koha servers you save, and each one's cataloging defaults and barcode settings.
- Your recent cataloging history: titles, record IDs and times.
- Item counts from Reports: how many items each saved server's Koha holds under each collection code and shelving location, and when they were counted.
- Book photos taken without internet, until the AI reads them.
- Records captured while offline, and their photos, until they are sent.
- A log of corrections you make to AI-read values.
- A log of errors, for troubleshooting.
None of this is sent to us unless you choose to share the error log or correction log with us.
What is sent to your library's Koha server
Your Koha credentials and the catalog, patron and circulation data you work with. This goes only to the address you configured and is governed by your library's policies.
If that server is on your local network and uses a plain http:// address, the connection is not encrypted, and others on the same network could read it, including your sign-in details. The app warns you when this applies. Use a staff network separate from public Wi-Fi, and prefer an API key where your server supports it.
If we host your library's Koha
Hosting is part of the Enterprise plan and happens only under a written agreement with the library. We then run the library's Koha server in the cloud, so we hold what that Koha holds: its catalog and items, its patron records, its circulation and fines history, and its staff accounts.
The library decides what goes into its Koha and why. We handle that data only on its behalf, to run, secure, back up, update and support the server, as the agreement says. Under the Data Privacy Act, the library is the personal information controller and we are its personal information processor.
- Where it is kept: with the cloud provider, and in the region, named in the agreement.
- Who can see it: only the people who run the server, and only to operate, fix or back it up, or when the library asks.
- How it is protected: encrypted connections, access limited to those people, and regular backups.
- What we never do with it: use it in AI accuracy reports, combine it with other libraries' data, sell it, or use it for anything the library hasn't asked for.
- If something goes wrong: we tell the library without delay about any breach affecting its data, so it can meet its own duties.
- When hosting ends: the library gets a full export of its Koha database, and we delete our copies within the period the agreement sets.
The same applies to other systems and plugins we set up for a library under an Enterprise agreement; the agreement lists what each one holds. Patrons with questions about their records should ask their library, which decides what happens to them.
Book photos and the AI
When you catalog with AI credits, the photos you take pass through our server to the AI provider we use, Google (Gemini) or Anthropic (Claude). We pass them on and do not keep them. If you use your own AI key on the Free plan, the photos go from your phone straight to that provider, and we never see them.
Photograph only book covers and copyright pages with this feature, never patron records, library cards or other personal documents.
Book data lookups: to fill in and check bibliographic details, the app sends ISBNs, titles and author names to Open Library (Internet Archive), Google Books and the Library of Congress. These requests describe books, not people, and never include your photos or credentials.
Data these providers receive is kept under their own privacy policies.
AI accuracy reports
For each book the AI reads, the app sends us a report of how well it read:
- The book details the AI read (title, author, ISBN and so on), exactly as it wrote them.
- For each field, whether staff kept, corrected, cleared or filled it in, but not what they typed.
- Whether the book was saved or abandoned, or the AI step failed.
- The AI provider and model, app version, pages photographed, time taken and AI tokens used.
- Which library it came from, and a random ID for this installation.
Reports are always on in the Free plan: sharing them is the condition for using it. On Starter and Pro they are on by default, and your library can turn them off in Settings; turning them off stops collection and deletes anything not yet sent.
To stop anyone flooding us with fake reports, we count reports per sending network address. The address is stored only as a keyed hash, never as the address itself, and the counts are deleted after two days.
A report never includes anything from your Koha (records, holdings, circulation, record numbers or the server address), barcodes, anything about patrons, photos, anything staff typed, or credentials. We use reports only to measure and improve the accuracy of AI cataloging, and only CatalogLense can see them.
Other services we use
- Supabase (Singapore region) hosts CatalogLense accounts and accuracy reports.
- Resend sends our emails: your sign-in codes, and the welcome email when you first sign up.
- Vercel hosts the website at cataloglense.app, including the account deletion page. On the website's main pages it also counts visits with Vercel Web Analytics: the page, the site you came from, your country and region, and your browser, operating system and device type. It uses no cookies, doesn't follow you to other sites, and forgets a visitor after 24 hours. The app and the account deletion page are not counted.
- The App Store and Google Play handle purchases, and RevenueCat keeps track of them for us, under your library account's id. We learn which plan is active and which top-ups were bought, never your card details.
- For hosted Koha and the other Enterprise systems, the cloud provider named in the library's agreement.
What we do not do
- No analytics, crash reporting or advertising in the app, and no telemetry other than the AI accuracy reports above. (The website counts visits anonymously; see Vercel above.)
- No tracking across apps or websites.
- No marketing email. Apart from sign-in codes, the only email we send is one welcome message when your account is created.
- No selling or sharing of personal information.
- No profiles about you.
Permissions
- Camera: to photograph books and scan barcodes.
- Photo library (optional): to use a photo you already took. The app sees only the photos you pick.
- Local network (iOS): to reach a Koha server on your library's network.
Children
This is a workplace tool for library staff and is not directed at children. We do not knowingly collect information from children.
Retention, deletion and your rights
Your account data is kept while your account exists. Delete your account in the app (Settings → Library account → Delete account) or at cataloglense.app/account/delete. That removes your email and sign-in. If you own a library, it also removes the library's CatalogLense account, and its staff lose access. It does not cancel an App Store or Google Play subscription; cancel that in the store.
One thing is kept after deletion: a fingerprint of your email (a one-way code made from it, which cannot be turned back into the address), so that an account created again with the same email does not receive the Free plan's credits a second time.
AI accuracy reports already sent to us can be deleted on request. What the app stores on your phone is erased by uninstalling it. Records saved to Koha live on your library's server, so ask your library to access or remove them.
Personal data of Philippine residents is protected by the Data Privacy Act of 2012 (Republic Act No. 10173). You may ask us to access, correct or delete the data we hold about you, and you may complain to the National Privacy Commission. Our Data Protection Officer can be reached at cataloglense@gmail.com.
Contact
Privacy questions: cataloglense@gmail.com
The same policy is in the app, under Settings → About & Legal.