The Napkin is built to keep your group's memory, not to profile you. This page describes what the app does and does not do with data.
Your Napkins, receipts, House Rules, and obligations are stored locally on your device. A group chat is recognized only by a salted, non-reversible fingerprint — never raw message content or participant identifiers.
Signing in with Apple is optional and only needed to share a group across devices, claim your spot on a receipt, or sponsor a group. When you sign in, the receipts and House Rules of your shared groups, your chosen display name, and your Apple account identifier are synced to enable those features. This data is linked to your account solely to make sync work; it is never sold or used for advertising.
If enabled, product analytics carry only coarse, non-identifying event names and properties (for example, that a receipt was created). They never contain the text of a call, stake terms, participant names, handles, tokens, or conversation identifiers.