Nopal Build

Privacy Notice

Last updated July 15, 2026

The short version: we collect the minimum we need to run Nopal, we tell you before we collect anything new, and we don't run any analytics, advertising, or tracking scripts on this site. If that ever changes, we'll ask first — not after.

Who can even use Nopal

Nopal is currently invite-only. Every account starts because someone at Nopal (or another Nopal user) invited that specific person by email — there's no public sign-up form. A few pages are the exception and are covered separately below: the workers' comp waiver form and the newsletter sign-up, both of which don't require an account.

What we collect, and why

Account & login

Name and email address (whatever your inviter entered, and whatever you update it to). If you set up a passkey, your device stores your private key — we only ever see the public key, which can't be used to sign in as you without your device.

Session cookie

A single cookie (_auth) that keeps you signed in. It's first-party, marked httpOnly so JavaScript can't read it, and only used to know who you are — never for tracking or advertising. This is the only cookie Nopal sets, and it's why you won't see a cookie banner here: it's strictly necessary for the site to work, not optional tracking.

Files you upload (Vault & Daily Log)

Photos, PDFs, and documents you upload are stored privately — only you (and anyone you've explicitly shared a folder with) can access them. Every request for a file's contents is checked against who's signed in; files are never made public by default.

Workers' Comp Waiver form

If you sign the Arizona Independent Contractor Workers' Compensation Acknowledgment, we record what's on the form (name, business/license/insurance details, contact info, signature) plus your IP address and the time of signing, to keep a legal record of that acknowledgment. A copy is emailed to you and to Nopal staff; it's otherwise only accessible to staff and to you, if you view it from a Nopal account under that email address.

Only if you check the opt-in box on the contact page: your name and email, sent to our email provider (Resend) to deliver the newsletter. You can unsubscribe any time from the link in any email we send.

What we don't do

No analytics, no advertising pixels, no third-party trackers of any kind — we checked, and there simply aren't any on this site. Videos embedded in our content use YouTube's and Vimeo's privacy-enhanced modes, which don't set tracking cookies unless you press play.

Who we share data with

We use a small number of infrastructure providers to run Nopal, all acting only on our instructions:

Resend — sends the emails Nopal sends you (login codes, invites, notifications) and, if you opt in, the newsletter.
Fly.io / Tigris — hosts the app and stores uploaded files (Vault, Daily Log, signed documents).
Notion — powers some of our public building content (materials, guides). It doesn't receive any of your personal data.

We don't sell data, and we don't share it with anyone else for marketing or advertising purposes.

How long we keep it

Account data and files are kept while your account exists. Signed legal documents (like the WC waiver) are kept as long as required for legal/compliance record-keeping. Newsletter contacts are kept until you unsubscribe. If you'd like something deleted sooner, just ask — see below.

Your rights

You can ask us what we have on you, ask us to correct it, or ask us to delete it, at any time. Because Nopal is small and invite-only today, we handle these requests directly — email human@nopal.build and we'll sort it out. If you're in the EU/UK, this includes your rights under GDPR (access, rectification, erasure, portability, and objection); if you're a California resident, this includes your rights under the CCPA.

Changes to this notice

If what we collect or how we use it changes meaningfully, we'll update this page and, where it affects something you've already agreed to, ask you again before continuing.

Questions

Email human@nopal.build — a human will answer.