Nupik Wenpach LLC
Privacy
Effective August 20, 2026.
The short version
This site does not track you. It sets no cookies, runs no analytics, and loads nothing from anyone else's server. The contact form opens your own mail app instead of sending anything here. Nothing about you is sold, and nothing ever has been.
Who this is
Nupik Wenpach LLC
1613 Live Oak Place
Carlsbad, New Mexico 88220
noah@nupikwenpach.com
(313) 407-1483
Nupik Wenpach LLC is an independent software studio. This policy covers this website and the text messages sent from the studio's number. It is written to be read, so it says what actually happens rather than what a policy would be allowed to permit.
What this site collects: nothing
No cookies are set. No analytics run. There is no tag manager, no tracking pixel, no session recorder, no advertising script, no embedded video, and no font loaded from someone else's server.
That is not a promise offered on trust. Every page is served with a Content Security Policy that permits requests only to this site's own origin. A browser will refuse to load anything from anywhere else, whatever a page asks for. It is in the response headers, and you can read it yourself.
What your browser keeps
Three values are stored in your browser so the site remembers how you like it to look:
| Name | What it holds |
|---|---|
nw-theme | light or dark |
nw-world | which color world you picked |
nw-admin | whether the admin view is on |
These stay on your device. They are never sent to the studio or to anyone else, and none of them identifies you. Clearing your browser's site data removes them, and the site works normally without them.
What the host records
The site runs on Railway, and Railway's edge writes one line for each request:
- the date and time
- the method and the path requested
- the host
- the response status and how long it took
- the IP address the request came from
- the browser's user agent string
This is ordinary server logging. It is what makes it possible to tell that the site is up, that a page is broken, or that something is hammering it. It is not read to build a picture of anybody, it is not joined to anything else, and it is never used for advertising. Railway holds these logs on its own retention schedule.
The contact form
The form on the front page sends nothing to this site. Submitting it opens your own email app with the fields already filled in, and nothing leaves your device until you press send in that app. Your message then arrives as an ordinary email.
Messages sent to the studio sit in its mailbox, which is hosted by Microsoft 365. Ask for one to be deleted and it will be.
Text messages
The studio's number does two things: it sends a verification code when one is needed, and it carries messages about work already underway.
- Messages go only to people who have given a mobile number and agreed to be texted about their own project. There is no list to join and nothing promotional is ever sent.
- Frequency varies with the project. There is no set schedule.
- Reply STOP, UNSUBSCRIBE or CANCEL to any message to stop them. Reply START to begin again. Reply HELP for help.
- Message and data rates may apply, according to your own plan.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes.
Consent to receive text messages is never sold, shared, or passed on. A number reaches the messaging carrier only so the carrier can deliver the message you asked for.
Who else handles anything
| Who | What they see | Why |
|---|---|---|
| Railway | request logs, including IP address and user agent | hosting and serving the site |
| GoDaddy | a request to the bare domain, before it is forwarded | the domain, and the redirect at the apex |
| Microsoft 365 | email you send to the studio | the studio's mailbox |
| Twilio | mobile numbers and the contents of messages sent | delivering text messages |
Each of these is a service the studio pays to do a specific job, and each is bound by its own agreement. None of them is handed anything for its own purposes.
What is never done
Personal information is not sold. It is not shared for cross-context behavioral advertising. It does not go to data brokers, ad networks, or list buyers. No profile is built about you, no decision about you is made automatically, and none of it trains anybody's model.
How long anything is kept
Server logs last as long as Railway's retention window and are copied nowhere. Email is kept while the conversation is still useful and then deleted. Browser storage lasts until you clear it. There is no database of visitors, because nothing is collected to put in one.
Your rights
Write to noah@nupikwenpach.com and you can ask what is held about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted. There is no form to fill in and no account to log into. Requests are answered within 30 days, and nothing about how you are treated changes because you made one.
If you live in California
California residents have specific rights under the CCPA as amended by the CPRA: to know what personal information is collected and why, to receive a copy, to have it corrected, to have it deleted, to opt out of its sale or sharing, and to limit the use of sensitive personal information.
Two of those need nothing from you here. Nupik Wenpach does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of and no "Do Not Sell or Share My Personal Information" link to press. No sensitive personal information is collected at all.
In the statute's own categories, what is handled is: identifiers, meaning an IP address in a server log, a name and email address if you write in, and a mobile number if you give one; and internet activity, meaning which page was requested and when. They are collected for the purposes described above and for nothing else. You may use an authorized agent to make a request for you.
Do Not Track, and Global Privacy Control
Some browsers send a Do Not Track header or a Global Privacy Control signal. Nothing here follows anyone between sites, and nothing is sold or shared, so neither signal has any behavior to change. They are honored by there being nothing to honor.
Children
This site is not directed at children, and nothing is knowingly collected from anyone under 13. If you believe a child has sent something in, write and it will be deleted.
Work done for clients
This policy is about this website and the studio's own messages. Data held inside software built for a client belongs to that client and is governed by the agreement with them, not by this page. If you are using something the studio built for someone else, it is their privacy policy that applies to you.
Security
The site is static. There is no database, no login, and no user content, so there is very little here to attack. Every page is served over HTTPS with a strict Content Security Policy, a nosniff header, a deny frame policy, and a referrer policy that withholds the path from other sites. Email is protected by the studio's Microsoft 365 account.
No system is perfect, and this one is not claimed to be.
Changes
If this policy changes, the date at the top changes with it, and anything material is called out on this page. Earlier versions are kept and can be had by asking at the address below.
Getting in touch
noah@nupikwenpach.com
(313) 407-1483
Nupik Wenpach LLC, 1613 Live Oak Place, Carlsbad, New Mexico 88220
This policy is governed by the laws of the State of New Mexico.