Privacy

Your VIN lookup and your data.

Updated November 6, 2026.

Information used for a lookup

When you enter a VIN, our server sends that identifier to NHTSA to retrieve available vehicle specifications. It then sends the decoded model year, make, and model to NHTSA’s recall service. You do not need to provide your name, email, payment information, or vehicle documents.

Cached results and URLs

We cache decoded results for up to 30 days and recall campaigns on a daily cycle. A report’s URL contains the VIN. That address can appear in your browser history and hosting logs, and anyone with the link may open it. Report pages request exclusion from search indexing; this is not a privacy or access-control mechanism.

API usage limits

The API uses a short-lived hashed client-IP identifier in server memory to apply a per-instance burst limit. These counters are not stored as analytics. Hosting infrastructure may separately log IP addresses and lookup URLs. The limit is not a shared quota across all servers.

Hosting and external services

Vercel hosts the application and may process technical information such as IP addresses, request URLs, and diagnostic logs to operate the service. NHTSA processes requests under its own policies. External links open services governed by their own privacy policies.

Advertising

The current release reserves spaces for advertisements but does not load an ad network, third-party analytics, or tracking pixels. If advertising technology is enabled, this notice and any necessary visitor controls must be updated before it runs. Optional sponsored links, when configured, take you to the named external provider.

Questions

You can contact the maintainer through the project’s public issue tracker. Do not post personal information or documents there.