Privacy Policy

Last updated October 9, 2026

Build Your Alpaca builds personal software. The short version of this policy is that there is no business model here that involves anyone's data, because there are no customers and no analytics.

Who operates this

Build Your Alpaca and the software described on this site are operated by Chris Thompson as an individual. Questions can go to support@buildyouralpaca.com.

Who this policy covers

The Assistant and the other private tools described on this site are single-user programs. They have no sign-up, no accounts, and no users other than their owner. If you saw this policy linked from a Google consent screen asking for access to Gmail or Calendar, that consent screen was shown to the owner authorizing his own account.

The apps are different. Apps such as CrossWise and Nightshift are open to anyone, and you can sign in to them with a Google or GitHub account, or with an email address and password. That is covered under Accounts for apps below.

The main buildyouralpaca.com pages set no cookies, run no analytics, and collect nothing from visitors. They load fonts from Google Fonts, which means your browser makes a request to Google's font servers when you open a page.

What Google data the Assistant accesses

The Assistant connects to its owner's Google Account only after he grants permission through Google's own consent screen. It requests access to two services:

Gmail. To read messages and summarize what needs attention, to label, archive and trash mail while tidying an inbox, to locate receipts and attachments, and to send or reply to messages that the owner has explicitly approved first.
Google Calendar. To read events in order to surface what is coming up and flag conflicts, and to create or update events so appointments land on the correct calendar.

Permissions are requested at the narrowest level that still does the job. The Assistant does not request permission to permanently delete mail.

Where the data goes

Message and calendar content is fetched from Google's APIs, held in memory while a task runs, and written only to storage on hardware that Chris Thompson owns and controls. Authorization tokens are stored on that same hardware.

Message content is processed by a language model that runs locally on that hardware. It is not sent to a third-party model provider.

Limited Use

Build Your Alpaca's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What never happens

Data received from Google APIs is never sold.
It is never transferred to anyone, except back to Google's own APIs while acting on the owner's behalf.
It is never used for advertising, and never used to build a profile of anyone.
It is never used to train a machine learning model.
No human other than the account owner reads it.

Keeping and deleting data

Information fetched from Google is kept only as long as it is useful for the task at hand, and is deleted along with the local storage it sits in. Because the only account involved belongs to the operator, deletion is a matter of removing files from his own machine.

Withdrawing access

Access granted to the Assistant can be revoked at any time from the Google Account permissions page at myaccount.google.com/permissions. Revoking it immediately invalidates the stored tokens, and the Assistant loses all access to Gmail and Calendar.

Accounts for apps

Apps on buildyouralpaca.com share one account system at accounts.buildyouralpaca.com. You sign in with Google, GitHub, or an email address and password.

Accounts are for people aged 13 and older; if a child under 13 has made one, email support@buildyouralpaca.com and we will delete it.

If you sign in with Google or GitHub, it tells us your name, email address, profile picture, and an account ID. We ask for nothing else: no access to your email, files, contacts or code. The tokens the provider sends are used once to confirm who you are, and are not stored.

If you use an email address and password, we keep your name, your email address, and your password in a scrambled form (a hash) that can't be turned back into the password. We email you only to confirm your address and when you ask to reset your password.

We also keep:

Sign-in sessions. When each session started and expires, plus the IP address and browser type it came from, so sessions can expire and be signed out.
What the apps save for you. For example puzzle progress or game saves.

The account system sets a sign-in cookie for buildyouralpaca.com and its subdomains, so one sign-in works in every app. It also sets a short-lived cookie that protects the sign-in step. Neither is used for tracking.

How app account data is used

It is used only to sign you in and to run the apps you use.
It is never sold, never shared for anyone else's use, never used for advertising, and never used to build a profile of anyone.
It is never used to train a machine learning model.
The apps run no analytics or ad trackers.

Account data is stored in a PostgreSQL database hosted by Neon, and the account system runs on Vercel. Confirmation and password reset emails are sent through Resend. All three store and process data on our behalf and for no other purpose.

Deleting your account

You can delete your account at any time at accounts.buildyouralpaca.com. That immediately removes your account, your sessions, your sign-in methods and what the apps saved for you. Copies may remain in the database host's short-term recovery history until it expires.

You can also remove Build Your Alpaca from your Google account permissions or your GitHub authorized OAuth apps. That stops future sign-ins with that provider but does not delete your account. To delete it, use the account page or email support@buildyouralpaca.com.

Changes

If this policy changes, the revised version is posted on this page with a new date at the top.

Contact

Chris Thompson, support@buildyouralpaca.com.