Privacy
Crumple is a to-do board. This page says what it keeps about you, where that lives and who else is involved.
Last updated November 13, 2026
Who runs Crumple
Crumple is made and run by Taita Nakayama — one person, working as a sole proprietor in the United States, not a company. If that changes, this page will say so. For anything on this page, write to taita@nakayama.io.
What Crumple keeps
- Your Google sign-in details. You sign in with Google, and Google passes on your name, email address, profile picture and an ID for your Google account. That is all Crumple asks for. It cannot see your Gmail, Drive, Calendar, contacts or anything else in your Google account. Your email address is how Crumple knows which board is yours, and where I would write if there were something you needed to know about your account.
- Your notes. The text of each note, the column it is in, and when it was added, changed or finished.
- Your subscription. Which plan you are on, whether it is active, when the trial or the current period ends, and the reference numbers Stripe uses for you. Not your card: Crumple never sees or stores card details.
- A count of the steps people reach. So that I can tell which page and which video is working, Crumple records that a step happened and when: opening the front page, pressing the start button, signing in, starting Checkout, a trial starting, turning into a paid subscription or being cancelled, an assistant connecting, and a first note being added. With each one it keeps where the visit came from (the campaign words on the link you followed, the name of the site that linked here, and whether you were inside an app's built-in browser such as TikTok's), a random ID your browser makes up so that one visitor's steps can be counted as one visitor, and your account once you have one. It does not keep your IP address, your browser's details, or anything you type or write in a note. These records are kept in Crumple's own database, beside your notes, and are not passed on to anyone. If your browser sends Global Privacy Control or Do Not Track, nothing is recorded before you sign in and no ID is made.
- A link you ask to be emailed. If you are inside an app's built-in browser and ask for the link by email, your address goes to Resend (below) to send that one email, and Crumple does not store it. To stop the same address getting more than one a day, Crumple keeps a one-way scrambled form of it (a hash, which cannot be turned back into the address) and one of your IP address, for two days.
- A copy on your device. Your browser keeps your board so it opens straight away and works offline, along with your sign-in session, the random ID above, and whether you chose the light or dark theme. That copy stays in your browser's storage; clearing this site's data removes it.
- Ordinary server logs. The companies that host Crumple record the usual technical details of each request — IP address, browser, what was asked for and when — to run the service and keep it secure.
What Crumple doesn't do
No adverts, no advertising or analytics company's tracker, and no cookies of its own. The only counting is the list of steps above, which Crumple does itself and keeps to itself. Your notes and details are not sold, not shared for marketing, and not used by Crumple to train AI models.
Who else is involved
Crumple is built on a few other companies' services. Each one handles only what it needs to do its part:
- Google confirms who you are when you sign in.
- Supabase runs the sign-in and stores accounts and notes, in a database in the United States.
- Vercel serves the site and the small amount of server code behind it.
- Stripe takes payment. Subscriptions are sold through Link, a Stripe service, which makes Stripe the merchant of record: it collects your payment details, charges you, works out and collects any sales tax or VAT, emails your receipts, and answers billing questions. It does that under its own privacy policy. Crumple is told only whether your subscription is active, and the references above.
- Resend sends Crumple's own emails: the reminder before a trial ends, and a link you ask for. It receives the address and the email, and nothing else.
- jsDelivr delivers one open-source code library that the page loads. Like any web host, it sees your IP address when your browser fetches it.
- An AI assistant, if you connect one. Connect Claude, ChatGPT or another assistant and it can read and change your notes when you ask it to. What it reads goes to the company that runs that assistant, and is covered by your agreement with them rather than this page. You can disconnect it from that assistant's settings at any time.
Beyond that, your information is handed over only if the law requires it.
Where it lives, and for how long
Accounts and notes are stored in the United States. If you are somewhere else, that is where your data goes.
Your notes are kept until you delete them. Emptying the basket deletes the notes in it, but Crumple keeps a record of what you finished and when, so the calendar can still show it: the text for about a year, and only the date after that. Deleting a single note permanently leaves none of its text behind. Backups kept by the database host can hold a deleted item for a few weeks more.
The step records are deleted along with your account. One from a visitor who never signed in holds a random ID and where the visit came from, and nothing that says who they are.
If you cancel, your notes are kept so they are there if you come back. To have your account and everything in it deleted, email me and I will do it within 30 days. Stripe keeps its own records of payments for as long as tax and accounting law requires.
Your choices
You can ask for a copy of what Crumple holds about you, ask for it to be corrected or deleted, or object to how it is used, by writing to taita@nakayama.io. In some places — the EU, the UK and California among them — the law gives you these rights formally; Crumple offers them to everyone. You can also complain to your local data protection authority.
For those who need the legal footing: Crumple uses your data to provide the service you signed up for, to keep it secure and working, and to meet legal obligations.
Security
Everything travels over HTTPS. In the database, each account can read and write only its own rows, and it is the database that enforces that, not just the app. As the person who runs Crumple I am technically able to see what is stored; I look only when it is needed to fix a problem, keep the service secure or comply with the law. Nothing online is perfectly secure, and if something goes wrong that affects your data I will tell you.
Children
Crumple is not meant for children under 13 and does not knowingly collect their data. If you think a child has signed up, email me and I will remove the account.
Changes
If this page changes in a way that matters, I will change the date at the top and tell you by email or in the app before it takes effect.