The negative space

Five guarantees a platform structurally can’t make.

Trust is also what you leave off the page. The five below aren’t promises that lean on goodwill — they’re guarantees the business model makes free to keep, and that a platform funded by a rake, by ads, or by lock-in structurally can’t make without ending its own business. Each one names the mechanism that enforces it — what isn’t in the code, what isn’t loaded in the <head>, what isn’t hidden behind a sales call — so you can check instead of trust. If any stops being true, the changelog will say so before you do.

  1. Never — one

    I will never lock you in.

    The free tools run entirely in your browser — there’s no account to open and no copy of your work kept on a server, so there’s nothing to hold hostage if you walk away. The library is licensed CC BY-NC 4.0 — copy it, translate it, keep it. And the numbers behind the Cost Index are published as machine-readable data, not locked inside a dashboard. No proprietary format sits between you and your own work.

  2. Never — two

    I will never resell your data.

    Your invoices, your covers, your prime cost, the email of the regular who left a one-star review — none of it gets aggregated, none of it gets brokered, and none of it trains a model. The free tools run entirely in your browser, so most of it never reaches a server at all. Muntin Ledger does read the invoices you hand it — and there, no language model ever does: extraction runs on Muntin’s own infrastructure, your invoice text is never sent to an outside AI provider, and a build gate blocks any release that would so much as add a language-model library. The model that reads an invoice is fixed; it never learns from your corrections, so the same invoice gives the same numbers and your data trains nothing. The proof is on the wall — the data-handling claims, each with a test you can run yourself, at /security/, and the code that enforces it at ledger.muntin.digital/promises.

  3. Never — three

    I will never hide pricing behind a call.

    Muntin Ledger’s tiers are posted in writing at ledger.muntin.digital, with the per-invoice cost math published beside them — no call, no form, no “contact us for a quote.” The retired services business kept this same rule from its first day.

  4. Never — four

    I will never run a remarketing pixel on the library.

    No Meta pixel. No Google Ads tag. No LinkedIn Insight. No third-party retargeting on any page that exists to teach — that’s articles, glossary, research, tools. Plausible is the only analytics that loads, it is cookieless, and as of Phase 3B the script is self-hosted from this domain (/assets/p.js) with events proxied through /api/event — your browser never makes a request to a third-party analytics origin. Read an article in peace; nobody will follow you home.

  5. Never — five

    I will never take a cut of your sales.

    No per-order rake, no sales commission, no slice of your revenue — ever. Muntin sells software and publishes data; it does not sit between you and your guest taking a cut of the ticket. The platforms that do are the thing these tools exist to measure, not to copy. You keep every dollar a guest hands you.

These five aren’t a manifesto. They’re the spec for the kind of company I’d trust with my own numbers. If a sixth shows up that’s worth keeping, it lands here, dated, and the changelog records the addition.

Spotted one I’m about to break? don@muntin.digital. Receipts on the wall, in writing, with my name on them.

Sister surfaces

  • Security — the data promise, claim by claim
  • Methods — where every claim on the site comes from
  • Receipts — the public counts and KPIs
  • Changelog — what shipped, when
  • AI policy — how I use AI in this work, and how I don’t