Terms

These terms govern your use of Culma: the app on your own devices, and the server that keeps those devices in step. They are written to be read, and where something is awkward they say so rather than leaving it in a defined term.

Two things before the numbering starts. Your notes stay yours and stay readable without us. And nothing here takes away a right the law gives you as a consumer.

1. Who you are contracting with

Culma is made and operated by:

ZNIPP GmbH
Underschwändlistrasse 10
6048 Horw
Switzerland

Commercial register of the canton of Lucerne, company number CHE-105.642.181, managing director Stefan Hess. The full details are in the legal notice.

Licenses and subscriptions are sold by Paddle.com Market Limited, United Kingdom, as the merchant of record. Paddle sells to you in its own name: it takes the payment, issues the invoice, and collects and remits the sales tax. Your payment relationship is therefore with Paddle and Paddle's buyer terms apply to the transaction itself. These terms govern the software and the service, which are provided by ZNIPP GmbH.

2. What Culma is, and what costs nothing

Culma is a note application for Linux, Windows, macOS, Android, iOS and the browser. Your notes are Markdown and SVG files in a folder you choose.

Everything that runs on your device is free and complete: writing and formatting, whiteboards, imported documents, search including search by meaning, dictation, the whole history of every note, and export — because the files never left. One device, no server, no account, no time limit.

A paid plan is for what a server has to do: a second device, the copy in the cloud, inviting other people, share links, and a device fronting a language model for a vault. The prices and what each plan states are on the pricing page.

3. Accepting these terms

Using Culma means accepting these terms. If you accept them for an organization, you confirm that you may bind it.

4. What we grant you

While your plan is paid, you have a non-exclusive, non-transferable right to use Culma for the number of people the plan states, on the devices those people use, anywhere in the world. A perpetual license carries the same right for the major version you bought, without an end date and without needing to ask us anything.

The software is licensed rather than sold, and we keep its copyright and the Culma name and mark.

What you write is yours. We claim no right in your notes, your drawings or your files, and we could not make use of them in any case: they are encrypted on your device and what our server holds is ciphertext it cannot read.

5. What you may not do

• Resell, rent out or sublicense access, or share a credential with people a plan does not count.
• Work around seat counting, storage reporting or the license check.
• Attack, overload or probe the server beyond what an ordinary client does. If you find a weakness, tell us — contact@znipp.ch — and we will answer.
• Use Culma to do something unlawful, or to store what it is unlawful for you to store.
• Remove or obscure the copyright notices, or present Culma as your own product.
• State or imply that we endorse, review or vouch for what you publish with it.

Where the law gives you a right to decompile for interoperability, it stands and this section does not touch it.

6. Your keys, and the one thing we cannot do for you

This clause is a consequence of how Culma is built rather than a term we chose, and it is the most important one here.

Culma encrypts your notes on your device. We hold sealed bytes and no key to them. It follows that:

• We cannot read a note back to you, recover a vault, or reset anything that would let us.
• If you lose every one of your devices and your recovery phrase, the keys are gone and nobody can bring them back — ourselves included.
• Keeping your recovery phrase somewhere that survives a lost phone is your responsibility, and it is the single thing worth doing today.

Everything else that can go wrong, we can help with. This one, no support ticket can fix, which is why it is written here in plain words.

7. Plans, seats and storage

A plan states how many people it counts, how many strangers may read what those people share, and how much storage it includes. Seats count people, including the person who pays.

Storage is stated, not metered against you. What you use is measured on your own devices and reported to us as a band rather than a figure. You are warned at 90% and at 95% of what your plan states, nothing is refused the moment you pass it, and a real stop happens only when no further store can be opened for you. We never delete your content to make room.

Where a plan says unlimited devices, fair use is ten devices for one person.

8. The trial

A trial is 30 days of a full plan. It asks for no payment details, there is nothing to cancel, and it cannot turn into a charge. When it ends it simply ends, and your notes are where they always were. One trial per person.

What it does ask for is an email address, because a trial includes syncing: the server has to know whose seat it is, and we have to be able to send you the license and tell you when the trial is ending. That address is used for the things in section 17 and for nothing else. The free app on one device needs none of this — no account, no address, no server.

9. Prices, payment and price changes

Prices are published on the pricing page in euros and Swiss francs. Paddle adds the tax that applies where you are and shows the total before you pay. Business orders above about €1,000 can be invoiced for bank transfer instead — ask us.

How prices change, because this is where products like this one disappoint people:

• A price moves only at a version boundary, and the change is published before it happens.
• An existing subscription keeps its price for at least twelve months after any increase.
• A change takes effect at your next renewal, never inside a period you have paid for.
• A perpetual license is never repriced. What you bought is what you have.

10. Term, renewal and cancellation

A subscription runs for the period you chose, monthly or annually, and renews at the end of it unless you cancel. You can cancel at any time: use the link in the receipt Paddle sent you, or write to us and we will do it. The subscription then runs to the end of the period you have already paid for.

Refunds, and the statutory right of withdrawal, are on the refunds page: 30 days from any payment, no questions asked.

11. When a subscription ends

• Changes from your devices stop reaching the server a short while after the end — the app shows you the date rather than making you guess.
• The vault on your devices is untouched and complete. It opens, it searches, it keeps its history.
• The copy the server holds stays readable for 90 days and is then deleted. We write to your billing address twice before that happens.
• There is nothing to export. The notes have been files in your folder the whole time.

12. Deleting things, and four limits worth knowing

When you purge a note, the server's copy of it goes and your storage is freed. Four things are true, surprising, and better read here than discovered later:

• A record that the note was purged remains. Forgetting it would let a device that was offline bring the note back from the dead, so the record is kept on purpose. It holds the note's identifier and the fact of the deletion, not its content.
• In a shared folder, a purge is not a recall. On the device of somebody who never saw that note reach the trash, the file goes to their trash rather than being destroyed, so that work nobody has synced yet is not lost. Your storage is freed and the server's copy is gone; nobody's machine is reached into.
• There is no shortcut that makes an existing copy unreadable. A note's key is derived rather than stored, so there is no key to throw away: deletion has to be deletion of bytes. It is also why the server's sweep is verified rather than best effort.
• Destroying something at the server is not instant. For 30 days the sealed bytes are set aside where our operator — never a key of yours — can put them back, and then they are deleted. It exists because an owner who turned against the other members could otherwise destroy a shared folder's history for everybody, and the server cannot tell that act from an ordinary deletion. The bytes stay sealed throughout, so nobody reads them in the meantime, ourselves included. It also means the 90-day window above is followed by this one: a lapsed vault's copy is gone within 30 days of the end of it.

These four decide what we can honestly answer when somebody asks us to erase something, so we state them rather than implying more.

13. Availability and support

Every device holds a complete, authoritative copy of your vault. The server is a convenience, not the system of record: while it is unreachable you keep writing, and sync catches up afterwards.

We promise no uptime figure on a self-serve plan, and we may take the service down for maintenance — in quiet hours where we can choose. A service level with remedies exists only where we have signed one.

Support is by email. We aim to answer within three working days on Personal and Family, within one working day on Business, and as agreed on Enterprise. Write to contact@znipp.ch; it reaches the person who wrote the software.

14. What is not finished

Culma is young, and the site says where. The home page carries a list of what is missing or rough with the date it was last reviewed, and the security page marks what is still in preparation. Nothing marked that way is promised, and we do not bill for what we have not built.

15. Warranty and liability

On a paid plan we owe you the service as this site described it when you bought. Used for nothing, Culma is provided as it is.

We are liable without limit for intent and gross negligence, for injury to life, body or health, and wherever the law allows no limit. Otherwise our total liability for any claim is limited to what you paid us in the twelve months before it arose.

We are not liable for keys we never held (section 6), for content lost on a device we do not control, or for your own backups. Your mandatory rights as a consumer are unaffected by any of this.

16. Data protection

What this website processes is on the privacy page. What the server stores, what we can read and how long it keeps it is on the security page, stated per surface.

Business customers who need a processing agreement under Art. 28 GDPR should write to us. It is a short document, because a processor that only ever receives ciphertext has little to promise and can promise it precisely.

17. The address we write to, and what it is not joined to

When you start a trial you give us an email address, and that is the account. When you buy, we also receive the billing details Paddle passes to us — your name, your country, and what you bought. We never receive your card details.

What we use it for, and this is the whole list: sending you your license, telling you before these terms or a renewal price change, warning you before the server's copy of a lapsed subscription is deleted, reaching you if there is a security problem you need to know about, and answering you when you write.

What we do not use it for. It is not a channel for anything happening inside a vault. We cannot see what you write or when you write it, and we will not use a billing address to tell you that a note changed — doing that would join the payment to the activity, which is the one join this whole design exists to prevent. The app itself does that job, on your own device.

And it is joined to nothing on the storage side. Our billing records contain no vault, folder or storage identifier; the server that holds your sealed bytes never receives your email address; and the tokens your devices present to it are signed without us learning which device asked. So a payment and a stored byte cannot be put side by side — not by an attacker who takes the billing database, and not by us.

The free app on one device asks for nothing and tells us nothing. There is no account until you sync — a trial or a paid plan — because a server that holds a seat has to know whose seat it is. What an account gets us is an address we can write to, and nothing more.

We send no marketing mail unless you ask for it. You can object to our using your address at any time, and what we have to keep for invoicing and bookkeeping we keep for as long as the law requires.

18. If the business changes hands

Your license and these terms travel with it. A perpetual license in particular cannot be revoked by whoever comes next: it has no expiry, it needs nothing from us, and a server you run yourself does not ask anybody's permission. That is deliberate, and it is one of the reasons the perpetual license exists.

19. Changes to these terms

This page is dated, and we keep its earlier versions and will send you one on request. A material change is announced before it takes effect and, for a subscription, takes effect at your next renewal; if you do not want it, cancel before then and the terms you agreed to govern the period you have paid for.

20. Law, jurisdiction, and the rest

Swiss law applies, and the courts of Lucerne, Switzerland have jurisdiction. If you are a consumer in the EU or the EEA, you keep the protections of the law where you live and may bring a claim before your own courts.

We are not obliged to take part in consumer dispute-resolution proceedings and we do not; we answer complaints ourselves, at the address in the legal notice. There is no link here to the European online dispute resolution platform because the Commission shut it down in July 2025.

If a clause here turns out to be invalid, the rest of these terms still stand.

Questions about any of this: contact@znipp.ch, or +41 41 589 80 75.