Libby

Is Libby safe?

Yes. Libby is the free app that lends you e-books, audiobooks and magazines from your public library, and it is built to collect very little. OverDrive, its maker, says it never sells your data and shows no ads, and Apple's label links only crash data to you. We score it 82/100, far above Amazon's Kindle (67) and Audible (69), and above the rival library app Hoopla (63), whose privacy notice allows sharing with ad networks.

The catches are smaller. OverDrive pays nothing for bug reports, there is no two-step login, and the Kindle option in the US routes your loans through Amazon.

What Libby collects

Libby's own privacy statement, dated 20 November 2025, is short and specific. It says OverDrive will not sell your personal data, will not use it for third-party advertising and does not sell ad space in the app. Libby uses no third-party cookies and has no social media integration, and its AI book suggestions receive no identifying data about you.

What it does keep:

The store labels agree. Apple's App Store label lists crash data as the only data linked to you, with usage and performance data collected without your identity. Google Play says Libby shares no data with third parties. That is close to the 90+ end of our privacy scale; we stop short because your borrowing history sits on OverDrive's servers and its general policy keeps data for as long as it "deems necessary".

Kindle loans and Amazon

In the US, many Libby books can be read on a Kindle. Libby's help page explains that choosing Read With, then Kindle, takes you to Amazon's website, where you sign in and tap Get Library Book. From then on the loan sits in your Amazon account, and Amazon's own terms let the Kindle app report your last page read and your searches back to Amazon. If you care about reading privacy, read in Libby instead.

Security

OverDrive's security statement describes encryption in transit, ongoing vulnerability scans and third-party penetration testing, and the Libby statement adds encryption at rest and independent audits, though we found no published audit report. We found no breach of Libby. Kanopy, the film-streaming app OverDrive bought in 2021, had a lapse before the purchase: in March 2019 a researcher found an unprotected server holding 25 to 40 million daily logs of what users searched for and watched, tied to IP addresses but not to names or emails (TechCrunch). Kanopy runs as a separate app and does not affect Libby's score.

The gaps are the usual security extras. OverDrive's responsible disclosure policy says it offers "no compensation or public recognition" for reported flaws, and sign-in depends on your library card number and PIN, set by your library, with no two-step option. Little is at stake, though: there is no payment card and almost no profile.

Children and explicit books

Libby has no chat, no comments and no public profile, so strangers cannot reach your child. The App Store rates it 9+ "with content restrictions", noting that some titles are rated higher and controlled inside the app. The catalogue is your library's, so a card can reach adult fiction unless the library restricts it.

That catalogue has drawn political fire. In March 2025 Missouri's Secretary of State paused state funding for OverDrive after a state bill claimed that Sora, OverDrive's school reading app, let minors reach explicit material. That was a funding decision, not a legal order, and it concerned Sora rather than Libby.

How to use Libby safely

1. Read in the Libby app rather than sending loans to Kindle if you want Amazon out of the picture.
2. Turn off timeline recording (Shelf, Timeline, Actions) if you do not want a list of past loans on your device.
3. Leave the email field empty unless you want email alerts.
4. Use a PIN you do not use for anything else, since there is no second login step.
5. For younger children, ask your library about a children's card.

How we scored it

Privacy (88) is Libby's strongest factor: no ads, no sales and almost nothing linked to you. The regulatory record (86) and transparency and control (85) are close behind, with no fine and easy deletion. Security (72) is the weakest, because there is no bug bounty or two-step login, even though very little personal data is at risk.