Privacy policy

1. What we collect

Three categories, and nothing else:

• Account data. Your email address, and a display name if you sign in with Google or Apple. Authentication is handled by Firebase Authentication; we never see or store your password.
• Product data. The VINs and plates you check, the reports you’ve unlocked, the vehicles you’ve saved, and your preferences. This is what lets you reopen a report you paid for.
• Diagnostic data. Anonymous product events (a check ran, a paywall was seen, a report was purchased) and crash reports, through PostHog. We deliberately keep this set small and disable automatic capture beyond it.

We do not collect precise location, contacts, photos, or advertising identifiers, and Vinrack carries no third-party advertising SDKs.

2. Vehicle records are about cars

The records we compile describe vehicles: specifications, recalls, listings, prices, mileage readings, title and accident indicators. They are keyed to a VIN, not to a person.

Where a source record happens to carry a name, a signature or a street address, we drop those fields at ingestion rather than storing them. Dealer names and business addresses are commercial information and are kept, because a buyer needs to know which lot a car sat on.

3. Why we process it

• To run the Service. Returning a check, delivering a report you bought, and keeping it reachable afterwards.
• To take payment. Recording which vehicle a purchase unlocked, so a report can’t be charged twice or lost with a device.
• To keep it working. Diagnosing crashes and slow endpoints, and finding abuse or automated scraping.
• To email you. Receipts, report links and material changes to these documents. Marketing email is opt-in and separately unsubscribable.

Where GDPR applies, our bases are performance of a contract for the first two, and legitimate interests for the rest, balanced against the minimal, non-profiling nature of what we keep.

4. Who processes data for us

We use a small number of subprocessors, each bound by a data-processing agreement:

• Google Firebase. Authentication, database and serverless functions. Hosts your account and your saved vehicles.
• Vercel. Hosting and edge delivery for this website.
• RevenueCat and the app stores. Purchase verification for in-app Full Report purchases.
• PostHog. Product analytics and error tracking, on the reduced event set described above.
• OpenAI. Generates the written summary sections of a report from record data we send. We do not send your account details, and the content is not used to train their models under our agreement.

Data feed providers (NHTSA, the EPA, Marketcheck and the review platforms) receive a VIN or a dealer identifier from us. They receive nothing about you.

We never sell personal data. There is no data-broker relationship, and no advertising exchange, at any tier.

5. How long we keep it

• Account and purchase records. For as long as your account exists, then up to 7 years for the transaction record where tax and accounting law requires it.
• Check history and saved vehicles. Until you delete them, or your account.
• Cached vehicle data. Between one hour and ninety days depending on the source, because a listing price changes hourly and a VIN decode never does.
• Diagnostic events. 12 months, then deleted.

6. Your rights

You can access, correct, export or delete your personal data. Deleting your account from Settings removes your profile, saved vehicles and check history, and is irreversible; purchase records are retained as described above.

If you’re in the EEA, the UK, California or another jurisdiction with equivalent law, you also have the right to object to processing, to restrict it, and to complain to your supervisory authority. We don’t discriminate against anyone for exercising a right.

7. Removing a vehicle record

If you believe a record we show about a vehicle is inaccurate, or that a listing of yours should not appear, email privacy@vinrack.com with the VIN and what’s wrong. We respond within 10 business days.

Where the record came from an upstream source we license, we correct our copy and pass the correction on, but we can’t change the source. Where a record is a public government filing, we can annotate it but we won’t suppress it.

8. Cookies

This website sets a session cookie when you sign in, and nothing else. There are no advertising or cross-site tracking cookies, so there is no consent banner to dismiss.

9. Children

Vinrack is not directed at children under 13 and we don’t knowingly collect their data. If you believe a child has created an account, email us and we’ll delete it.

10. Contact