Draft, not legal advice. This page hasn’t been reviewed by a lawyer yet.
Nabora Privacy Policy
Nabora ("we," "us") runs naboralocal.com, a local-offers site for independent shops in Aurora, Colorado and the surrounding area. Nabora is a trade name of Zack Miller, a sole proprietor in Aurora, Colorado: Nabora (Zack Miller, sole proprietor).
This page explains, in plain English, what information we collect, why, how long we keep it, and what you can do about it. We try to collect as little as we can.
The short version
- No tracking cookies, no ads. We measure visits with Cloudflare Web Analytics, which uses no cookies and reports totals only, plus our own anonymous daily view counts.
- We don't sell your information. Not to anyone.
- We don't take payments. Nabora never asks for or handles card or bank details.
- Claiming a code doesn't identify you. We don't store your name, contact details, or IP address with a code. To stop abuse, we keep a scrambled (hashed) form of your connection's IP address, separately from the code, for 24 hours.
What we collect, and why
1. If you apply for the shop pilot
When you fill out the "Ask about the pilot" form (naboralocal.com/#business), we store:
- What you type in: business name, your name, email, phone (optional), city or area (optional), business category, and your message about the business
- Technical details sent with the form: your IP address, your browser type (user agent), and the time you submitted
- Our own notes: whether the email about your application was sent (or the error, if it wasn't), and an internal status we use to track the application
Why: to review your application and reply to you about the pilot. We use the IP address and browser type only to spot spam and to limit repeated submissions from the same connection.
Where it goes: your application is stored in our database (Cloudflare D1) and emailed to the Nabora team through the Resend email service (sent from [email protected] to our support inbox, [email protected]).
2. If your shop is in the pilot
For each shop in the pilot, we store:
- Shop name, contact name, email, phone, category, and area
- When you agreed to the pilot terms, and which version you agreed to
- A scrambled version (a "hash") of your shop token. We never store the token itself.
- Whether your shop is a Founding Partner, and when your offer first went live
- Timestamps, such as when your shop's record was created or changed
- Your offer details: the offer and fine print you submit. Nabora reviews them before they go live.
- Activity for your offer: how many times it was shown, codes claimed, redeemed, expired, and unused, which link tags they came from, and recent redemptions. You can see these in the shop portal.
Why: to show your offer on the site, let you redeem codes, show you how your offer is doing, and run the pilot. See the Pilot Terms for more.
Signing in to the shop portal: shops sign in at naboralocal.com/shop with their private shop token. After you sign in, your browser keeps a session cookie for up to 30 days so you stay signed in. The cookie is set as "HttpOnly," which means scripts on the page can't read it. Your shop token is not saved in your browser.
Failed sign-ins: when a sign-in attempt fails (shop portal or admin), we store a scrambled (hashed) form of the IP address, the type of attempt, and the time. We use this only to slow down repeated guessing, and we delete it after 24 hours.
Keep your shop token private. It works like a password. Because we only keep a hash, we can't look up your token for you, but if you lose it or think someone else has it, contact us and we'll issue a new one.
3. If you claim a code as a customer
When you claim a deal, we create a one-time referral code and store:
- The code
- Which deal it's for (deal ID, business name, and offer text)
- Its status (issued or redeemed)
- When it was claimed, when it expires (30 days after it was claimed), and when it was redeemed
- Which shop redeemed it
- The link tag you arrived from, if there was one. Some of our links and QR codes end in a tag such as
?src=flyer-havencoffeeor?src=nextdoor. The tag tells us which flyer, post, or link worked. It describes the link, not you.
We don't store your name, email, phone number, or IP address with a code.
Claim limits: each browser gets one code per deal, and each internet connection can claim a deal up to 3 times a day. To enforce the daily limit, we store a scrambled (hashed) form of your connection's IP address, the deal, and the time, in a separate table that isn't linked to your code. The hash is made with a secret key, so it can't simply be looked up. We delete these records after 24 hours.
Why: so each code works only once and expires on time, so the shop can redeem it and see how its offer is doing, and so we can see which links and flyers bring customers to local shops.
Checking a code: the "Check a code" box on the home page lets anyone who has a code see whether it's valid, unused, and unexpired, and which offer it's for. It doesn't redeem the code. Codes are redeemed only by the shop, in the shop portal.
4. Visit counts and analytics
- Cloudflare Web Analytics. Our host, Cloudflare, adds a small script to our pages that reports page visits, the pages viewed, the referring site, and general browser and country information. Cloudflare says it does not use cookies or local storage for this and does not fingerprint visitors. We see only totals.
- Our own anonymous counts. When the home page loads, it tells our code service to add one to a daily count of home page views and of how many times each live deal was shown, grouped by date, deal, and link tag. Nothing about you is sent or stored: no IP address, no cookie, and no identifier.
We use these numbers to understand whether the site is working, and to show shops (in aggregate) how their offers are doing.
5. What's stored in your browser
- "My offers": your browser keeps a copy of the codes you claimed on this device in local storage, with each code's expiry date. It's there so you can find your codes again and so the same browser gets one code per deal. It stays on your device until you clear your browser's site data. Clearing it removes the list from this device but doesn't cancel the code on our side. If you switch devices or browsers, the list won't come with you.
- Link tag: if you arrived through a tagged link, the tag is kept in this browser tab's session storage so it can be saved with a code you claim. It's cleared when you close the tab or browser.
- Shop portal session cookie (shops only): described above. It lasts up to 30 days.
We don't use tracking or advertising cookies.
6. Logs and technical information
Like any website, when you visit naboralocal.com your browser sends technical information such as your IP address and browser type.
- Nabora's own code doesn't log visitors' IP addresses or browser details. Short technical messages (for example, errors) may be visible to us briefly through Cloudflare's tools.
- Cloudflare, our host, handles these requests under its own policies to deliver and protect the site.
The details listed in sections 1 to 3 (for example, the IP address saved with a pilot application, or the hashed IP used for claim limits) are stored as described there.
Who processes information for us
| Provider | What they do for Nabora |
|---|---|
| Cloudflare | Hosts the site, handles web requests under its own policies, stores our database (Cloudflare D1), provides Cloudflare Web Analytics (cookie-free, aggregate), and may hide email addresses on our pages from automated scrapers. |
| Resend | Delivers pilot application emails to the Nabora team and keeps its own records of the emails it sends. |
| Google (Gmail) | Hosts our support inbox, [email protected], where application emails and messages you send us are received. |
These providers have their own privacy policies. If you contact us by text at 972-785-7157, your message is handled by our phone service.
We may share information if the law requires it.
What we don't do
- We don't use tracking or advertising cookies.
- We don't sell personal information.
- We don't take payments, so we never collect card or bank details.
- We don't show third-party ads.
How long we keep information
- Pilot applications from shops that don't join: deleted 12 months after our last contact with you. This includes the copies of application emails in our support inbox ([email protected]).
- Shop records (for shops that join the pilot, including their application): kept while the shop is active, plus 12 months.
- Codes and redemption records: kept for 24 months. They contain no customer identity.
- Failed sign-in and claim-limit records: kept for 24 hours, as hashed IP addresses, then deleted automatically.
- Anonymous daily view counts: kept as long as they're useful. They contain no personal information.
- Shop portal session cookie: up to 30 days.
- "My offers" in your browser: stays until you clear it.
- Records kept by Cloudflare, Resend, and Google follow their own policies.
You can ask us to delete your information at any time by emailing [email protected].
Your choices: access, correction, and deletion
You can ask us to:
- Tell you what information we have about you
- Correct it
- Delete it
Email [email protected] or text 972-785-7157. Tell us what you're asking for and how we can find your information (for example, the email you applied with, or your shop name). Customers: we don't store who claimed a code, so the code itself is the only way we can find a record. We'll reply as soon as we can, and within 30 days.
We may need to confirm it's really you before we act on a request.
Age
You must be 18 or older to claim a code. Nabora isn't meant for children, and we don't knowingly collect personal information from anyone under 18. If you think a child has sent us information, contact us and we'll delete it.
Security
We take reasonable steps to protect the information we keep. For example, we store only a hash of each shop token, never the token itself; we store only keyed hashes of IP addresses for rate limits and delete them after 24 hours; the shop portal cookie can't be read by page scripts; and we rate-limit repeated failed sign-ins. No website is perfectly secure, so we can't promise that information will never be accessed without permission.
Changes to this policy
If we change this policy, we'll post the new version here and update the date at the top. For important changes, we'll also post a note on the home page and email shops in the pilot.
Contact
Nabora (Zack Miller, sole proprietor) · Aurora, Colorado
Email: [email protected]
Text: 972-785-7157