Legal
Privacy Policy
Last Updated: July 22, 2026
Introduction
This Privacy Policy explains how Napkin, LLC, operating its marketing lab at naepkin.co, collects, uses, and protects information when you use our marketing experimentation platform.
This policy applies to all users of naepkin.co and the Napkin platform.
Information We Collect
Personal Information
When you create an account, we collect:
- Your name
- Your email address
Usage Data
As you use the platform, we collect:
- Pages and features you visit
- Experiments you create and run
- Actions taken within the platform
We use this data to operate and improve the service. We do not sell it, use it for advertising, or share it with third parties except as described below.
How We Use Your Information
We use your information to:
- Deliver and maintain the Napkin service
- Send transactional emails — account notifications, experiment activity updates, and billing receipts (via Resend)
- Respond to your support requests
- Improve the platform and marketing site based on how they are used, via Google Analytics 4 and PostHog (see Cookies and Third-Party Services below) — only with your consent
We do not use your data for advertising. We do not sell your data to anyone.
Cookies
Napkin uses cookies and similar technologies in two categories:
Essential
Required for the service to function. These are never subject to consent and cannot be disabled.
| Cookie | Purpose |
|---|---|
next-auth.session-token | Keeps you logged in |
next-auth.csrf-token | Prevents cross-site request forgery |
Analytics
Used to understand how the marketing site and platform are used. These do not load until you accept analytics cookies — nothing is set beforehand.
| Service | Purpose | Scope |
|---|---|---|
| Google Analytics 4 | Marketing website traffic and campaign attribution | naepkin.co only |
| PostHog | Product usage, feature adoption, session replay | Napkin application only |
You can accept or decline analytics cookies at any time using the Cookie preferences link in the site footer. Declining does not affect your ability to use Napkin — it only stops analytics data collection.
We do not use advertising cookies, and we do not sell or share cookie data with third parties for advertising purposes.
Third-Party Services
We work with a small number of third-party services to operate Napkin:
Stripe
Handles all payment processing. When you subscribe, you enter your payment details directly into Stripe's secure interface — we never see or store your full card number. Stripe is PCI-DSS compliant.
Resend
Delivers transactional emails from Napkin (account confirmations, experiment notifications, billing receipts). Your email address is shared with Resend for this purpose only.
Vercel
Hosts the Napkin platform and processes request metadata (including IP addresses) as part of standard infrastructure operation.
Google Analytics 4
Used on the marketing website (naepkin.co) only — never inside the Napkin application — to measure traffic, campaign performance, and marketing conversions. Loads only after you accept analytics cookies.
PostHog
Used inside the Napkin application to understand feature usage and improve the product, including session replay of in-app activity. Loads only after you accept analytics cookies. Password fields and free-form content you write — landing page copy, email bodies, social post text — are automatically excluded from session recordings.
We identify you to PostHog using an internal account ID, never your name, email, or payment information.
Sentry
Used to detect and diagnose errors in Napkin so we can fix them quickly. Sentry may capture technical details about an error (browser, page, and relevant application state). It is used for error monitoring only, never for marketing or behavioral tracking, and is not subject to the analytics cookie consent described above.
Your Rights
Depending on where you are located, you may have rights regarding your personal data:
- Access — request a copy of the data we hold about you
- Correction — request that we correct inaccurate data
- Deletion — request that we delete your account and associated data
- Portability — request your data in a machine-readable format
- Withdraw analytics consent — use the Cookie preferences link in the site footer at any time to change your decision on Google Analytics and PostHog
To exercise any of these rights, email us at legal@naepkin.co. We will respond within 30 days.
If you are in the European Union or California, these rights are provided under GDPR and CCPA respectively. We will honor them regardless of where you are located.
Data Retention
We retain your account data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days, except where retention is required by law.
Changes to This Policy
If we make material changes to this policy, we will notify you by email or through the platform before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.
Contact
Napkin, LLC c/o Northwest Registered Agent 418 Broadway Ste N Albany, NY 12207
Email: legal@naepkin.co