KLWN Pride runs a small lending library of queer fiction and non-fiction. Around 30 books so far, with more donations to add every month. The library exists for one reason: to give people access to queer-focused books without asking them to hand over their full name, home address and phone number to do it.
What was wrong
The library was running on Koha, open-source software built for much bigger libraries. For a small, volunteer-run collection it was far too clunky. Adding a single book to stock took more than 15 steps.
Deciding to replace it was easy. Deciding what to replace it with was hard. Nothing off the shelf was small enough, simple enough and private enough, so I built it.
What I did
A custom web app, with privacy as the spine of the whole thing rather than a setting bolted on at the end.
The details:
- Borrowing needs an email address and a phone number. Nothing else. Both are used only to send reminders and updates.
- Row-level security in the database, so members can only ever see their own loans. That’s enforced by the database itself, not just hidden in the interface.
- The mailing list is kept entirely separate from borrower identities. Nothing on it can ever be traced back to what someone has borrowed.
- Passwordless sign-in with a six-digit code sent by email. No passwords to forget, reuse or leak.
- Accounts are 18+. That decision came entirely from UK GDPR and ICO rules on handling children’s data, which a two-person volunteer team shouldn’t be taking on.
Under the hood: Next.js (App Router), TypeScript and Tailwind v4, with Supabase Cloud in the EU for the database, sign-in and row-level security. It’s built, hosted and maintained by Stillworks.
The launch
The library went live on 4 July 2026.
What happened
It’s far more user friendly than Koha, for borrowers and for the volunteers running it, and far more private. The collection keeps growing as donations come in, and the library can grow with it without anyone needing a manual.
What I’d do differently
Sign-in first worked with magic links: tap the link in your email and you’re in. On a laptop, fine. On a phone, the link often opened in a different browser from the one you started in, a security check tied the link to the original browser, and people got locked out. I switched to six-digit codes that you type in, checked on the server. Codes work everywhere. I should have started there.