Privacy

Who this is

Nupik Wenpach LLC
noah@nupikwenpach.com
(575) 909-1701

Nupik Wenpach LLC is an independent software studio. This policy covers this website and the text messages sent from the studio's number. It is written to be read, so it says what actually happens rather than what a policy would be allowed to permit.

What this site collects

No cookies are set. No analytics run. There is no tag manager, no tracking pixel, no session recorder, no advertising script, no embedded video, and no font loaded from someone else's server. The one thing collected is what you choose to send with the contact form, described below.

That is not a promise offered on trust. Every page is served with a Content Security Policy that permits requests only to this site's own origin. A browser will refuse to load anything from anywhere else, whatever a page asks for. It is in the response headers, and you can read it yourself.

What your browser keeps

Three values are stored in your browser so the site remembers how you like it to look:

These stay on your device. They are never sent to the studio or to anyone else, and none of them identifies you. Clearing your browser's site data removes them, and the site works normally without them.

What the host records

The site runs on Railway, and Railway's edge writes one line for each request:

• the date and time
• the method and the path requested
• the host
• the response status and how long it took
• the IP address the request came from
• the browser's user agent string

This is ordinary server logging. It is what makes it possible to tell that the site is up, that a page is broken, or that something is hammering it. It is not read to build a picture of anybody, it is not joined to anything else, and it is never used for advertising. Railway holds these logs on its own retention schedule.

The contact form

The form on the Start a project page sends what you type to the studio's client portal, which runs on Railway like this site. It goes to this site first and is passed straight on, so your browser never talks to anyone else.

What is kept: your name, email, company, mobile number if you give one, what you need, and your message, with the time it arrived. Your IP address itself is not kept: only a code made from it with a secret key, used to stop the form being flooded and for nothing else. If you check the box to be texted, the time, your IP address, your browser, the page and the exact wording you agreed to are kept as the record of that consent.

The studio is told by email and by a notification on the studio's own phone, encrypted so the phone's push service cannot read it. Nothing is added to a mailing list. If the portal cannot be reached, the form says so and offers your mail app instead.

Messages sent to the studio by email sit in its mailbox, which is hosted by Microsoft 365. Ask for an inquiry or a message to be deleted and it will be.

Text messages

The studio's number does two things: it sends a verification code when one is needed, and it carries messages about work already underway.

• Messages go only to people who have given a mobile number and agreed to be texted about their own project. There is no list to join and nothing promotional is ever sent.
• Frequency varies with the project. There is no set schedule.
• Reply STOP, UNSUBSCRIBE or CANCEL to any message to stop them. Reply START to begin again. Reply HELP for help.
• Message and data rates may apply, according to your own plan.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

Consent to receive text messages is never sold, shared, or passed on. A number reaches the messaging carrier only so the carrier can deliver the message you asked for.

Who else handles anything

Swipe sideways for the rest of the table.

Each of these is a service the studio pays to do a specific job, and each is bound by its own agreement. None of them is handed anything for its own purposes.

What is never done

Personal information is not sold. It is not shared for cross-context behavioral advertising. It does not go to data brokers, ad networks, or list buyers. No profile is built about you, no decision about you is made automatically, and none of it trains anybody's model.

How long anything is kept

Server logs last as long as Railway's retention window and are copied nowhere. An inquiry is kept for two years after the last contact, unless it turns into work, when the agreement's own terms take over. The record of a consent to be texted is kept for five years after it is withdrawn or last used, as evidence. Email is kept while the conversation is still useful and then deleted. Browser storage lasts until you clear it. There is still no database of visitors: only of the people who write in.

Your rights

Write to noah@nupikwenpach.com and you can ask what is held about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted. There is no form to fill in and no account to log into. Requests are answered within 30 days, and nothing about how you are treated changes because you made one.

If you live in California

California residents have specific rights under the CCPA as amended by the CPRA: to know what personal information is collected and why, to receive a copy, to have it corrected, to have it deleted, to opt out of its sale or sharing, and to limit the use of sensitive personal information.

Two of those need nothing from you here. Nupik Wenpach does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of and no "Do Not Sell or Share My Personal Information" link to press. No sensitive personal information is collected at all.

In the statute's own categories, what is handled is: identifiers, meaning an IP address in a server log, a name, email address and company if you write in or send the form, and a mobile number if you give one; professional information, meaning what you say about your project; and internet activity, meaning which page was requested and when. They are collected for the purposes described above and for nothing else. You may use an authorized agent to make a request for you.

Do Not Track, and Global Privacy Control

Some browsers send a Do Not Track header or a Global Privacy Control signal. Nothing here follows anyone between sites, and nothing is sold or shared, so neither signal has any behavior to change. They are honored by there being nothing to honor.

Children

This site is not directed at children, and nothing is knowingly collected from anyone under 13. If you believe a child has sent something in, write and it will be deleted.

Work done for clients

This policy is about this website and the studio's own messages. Data held inside software built for a client belongs to that client and is governed by the agreement with them, not by this page. If you are using something the studio built for someone else, it is their privacy policy that applies to you. Offers, agreements and payments live in the studio's client portal, which has its own privacy notice at portal.nupikwenpach.com/privacy.

Security

The site itself is static: no database, no login, and no user content, so there is very little here to attack. The contact form is passed straight to the studio's client portal, which keeps inquiries in a database reachable only over its host's private network, with encrypted backups. Every page is served over HTTPS with a strict Content Security Policy, a nosniff header, a deny frame policy, and a referrer policy that withholds the path from other sites. Email is protected by the studio's Microsoft 365 account.

No system is perfect, and this one is not claimed to be.

Changes

If this policy changes, the date at the top changes with it, and anything material is called out on this page. Earlier versions are kept and can be had by asking at the address below.

Getting in touch

noah@nupikwenpach.com
(575) 909-1701

This policy is governed by the laws of the State of New Mexico.