napkin

Policies

What Napkin keeps about you, what it does not, and the terms you use it under. Written to be read rather than scrolled past. Effective the 13th of September 2026.

Privacy

Without an account

Napkin runs in your browser. Your sheets are stored there, in your browser's own database, and nothing you type is sent to us. You can use it with the network unplugged. There are no analytics, no advertising, and no tracking of any kind; the fonts are served from napkin.plus, so opening the page tells no other company that you did.

Two things are worth knowing. Currency rates come from Exchange Rate API, but your browser never talks to them: it asks napkin.plus about once a day, and our server asks them at most once an hour on everybody's behalf, so they see one server and never you. The app ships with a snapshot for a first run with no network. Share links carry the sheet inside the link itself, after the #, which browsers never send to a server; a link you share is read by the person you send it to and by nobody in between.

If you choose a language with ?lang=, a cookie called napkin_lang remembers it for a year. That is the only cookie until you sign in.

With an account

An account is an email address and a record that it has paid. We keep:

• Your email address, whether the account is current, when it was made, and, if a subscription lapses, when it went read-only and when it is due to be deleted.
• Whether you asked for notes about Napkin, and when. The box is unticked unless you tick it, it is only offered when an account is being made, and it turns off from your account page. If it is off we keep nothing, and we do not send them.
• Sign-in codes, hashed, for fifteen minutes. Sessions, as a hash of the token in your browser's napkin_session cookie, for ninety days from sign-in. Passkeys, if you add one: the credential's public key and a counter, which is what a passkey is; the private half never leaves your device.
• Your sheets, once sheet sync exists. It does not yet. Today the server holds no sheets at all; when it does, they will be yours to export in full and gone when you delete the account, like everything else here.
• Rate-limit counters keyed by email address and by network address, in fifteen-minute windows, swept every hour. This is what stops somebody guessing codes, and it is the only place a network address is stored by the app.

That is the whole schema. There is no name, no postal address, no device list, and no history of when you signed in beyond the session's own last-seen time. We could not keep those things if we wanted to, because there is nowhere to put them.

Payment

Subscriptions are sold through Stripe, using Link, and Stripe is the merchant of record. Your card is entered on their page and handled by them; we never see it. Your statement reads LINK.COM*, receipts come from Link, and your subscription can be managed at link.com. What Stripe tells us is your email address and that a payment settled.

Where it lives

Napkin runs on one server in the European Union, and a continuous copy of its database is kept with a second provider, also in the EU, so that one company's bad day cannot take both. Sign-in emails are sent through a transactional mail service. The web server keeps ordinary access logs of what was asked for and when, with the address a request came from cut short as it is written, so the log holds the network it came from and never the machine; a line lives thirty days. We read them to count visits and to find what is broken, by copying them to one of our own computers and deleting the copy as soon as we have read it.

The company behind Napkin is Leveret Avenue Computer Club LLC, in the United States.

Taking it with you, and leaving

From your account page you can download everything we hold about you as a zip: your sheets as plain .npkn text files, and a manifest in KDL you can read without us. You can do that whenever you like, whether or not you are going.

Deleting your account is immediate and cannot be undone. The rows are gone from the database at once, and from the replica within seven days. If a subscription lapses instead, the account goes read-only, stays downloadable for a year, and is then deleted the same way; nothing on your own machine is touched by any of it.

To see, correct, or remove anything else, or to ask what this page has not answered, write to hello@napkin.plus. A person reads it.

Terms

Napkin is made and run by Leveret Avenue Computer Club LLC. You can use it without an account, free, for as long as it exists. An account is $24 a year, billed annually, sold by Stripe as merchant of record under the terms shown at checkout; if it is not what you wanted, write to us before you dispute the charge and we will sort it out.

Your sheets are yours. Every number, note, and heading you write in Napkin belongs to you. We claim no rights in them, we do not read them, and we will not use them for anything. The only things we do with a synced sheet are store it, hand it back to you, and delete it when you say.

What we ask of you is only what the law asks: don't use an account to attack the service or other people's accounts, and don't try to get around the limits that protect them.

What we can promise, and what we cannot. Napkin is provided as it is. We work to keep it correct and available and to say so plainly when it is not, but we do not warrant that it will be free of errors or interruptions, and a calculator is not advice: check anything that matters before you act on it. To the fullest extent the law allows, Leveret Avenue Computer Club LLC is not liable for indirect, incidental, or consequential loss arising from your use of Napkin, and our total liability to you for any claim is limited to the amount you paid us in the twelve months before the claim arose, or $24 if you paid nothing. Nothing here limits liability that cannot lawfully be limited.

Changes. If these policies change in a way that matters to you, the date at the top moves and, if you have an account, you get an email first. If Napkin ever shuts down, you will be told well ahead of time and your export will work until the end.