Privacy

A VIN is sensitive. We store it so we can decode it, attach photographs, and generate your fact pack. We do not sell VINs, emails, or photos. We do not run advertising trackers.

Retention: walks, photos, and official snapshots stay on the account until you ask us to delete them, or until the operator of this instance purges the database. Local demo databases live in prisma/dev.db on the machine that ran the seed.

Auth is email/password or a one-time magic link. Payment cards go to Stripe when live keys are configured. Mock checkout stores only a “paid” flag — no card numbers.

Server-side fetches to NHTSA and EPA include the year/make/model (and VIN for vPIC). Those agencies’ own privacy statements apply to their logs.