Privacy Policy

This policy describes what CarWorthIt actually does, not what a template says a website does. It covers what you type in, what we record, what we set cookies for and who else sees any of it.

What you type in

• The VIN. We send it to NHTSA to decode the vehicle, and we use the decoded year, make and model to look up open recalls, crash-test ratings and EPA fuel economy.
• Mileage, ZIP code and, if you enter one, the seller's asking price. These are only needed for a paid report. They go to our vehicle-data provider to price the car, and they are carried through Stripe checkout so we can rebuild your report when you come back from paying.

There is no account, no signup and no password. We never ask for your name, your address or your phone number.

What we record when you run a lookup

Every VIN lookup, free or paid, writes one row to our database. That row holds:

• A salted hash of the VIN, not the VIN itself. We take a SHA-256 hash of the VIN combined with a secret salt that only our server holds. It is one-way, so the row cannot be turned back into a VIN, and the salt is what stops anyone testing candidate VINs against it. If that salt is not configured we log nothing at all rather than log a weak hash.
• The decoded vehicle: year, make, model, trim, body type and fuel type.
• The country and state our host derives from your IP address. This is coarse, region level at best. We do not store your IP address and we do not store a precise location.
• The mileage, when you have given us one.
• The page that referred you and the utm_source on the link, so we know which channels work.
• Whether the request looked like a bot or a crawler.

We use this in aggregate: which models get searched most, in which states, and how that moves over time. Aggregate figures from it may appear in our data studies and buying guides. There is no name, no account and no email address attached to any of these rows, and we do not publish individual lookups.

If you buy a report

• Card details go to Stripe and never to us.Payment happens on Stripe's own hosted checkout page. We never see, handle or store a card number.
• Stripe collects your email address at checkout, and we store it. It is saved alongside the Stripe session id, the product you bought, the amount, the hashed VIN and your state. We use it to identify you if you contact support, to process a refund, and to reconcile payments against our own records. We do not add it to a mailing list and we do not send you marketing. Buying something never signs you up to anything.
• If you type your email into the guides sign-up form, we store that separately. That form is the only place we ask for an address for marketing, it is never pre-filled or ticked for you, and it is entirely optional: nothing on this site is withheld if you skip it. We store the address, the page you submitted it from, and a hashed VIN if you were looking at a report at the time. We use it to send occasional guides about buying a used car, nothing else, and you can unsubscribe from any of them or email support@carworthit.com to be removed. We do not sell or share it.
• We store your finished report. It is saved against your Stripe session id so that revisiting your link serves the same report instead of re-querying the paid data services. That stored copy does include the full VIN, because it is your report. It can only be read back by someone who already holds the session id from your URL, which is unguessable, and the table cannot be listed or browsed.

Cookies and analytics

We do not use only essential cookies, and we are not going to claim otherwise. We run Google Analytics 4 (measurement ID G-GKFGSRW0KL) on every page. It sets its own cookies, typically _ga and _ga_*, to count visits and tell a returning visitor from a new one. Stripe also sets cookies on its checkout pages, which it uses for fraud prevention and to hold your session together.

One thing worth knowing about our analytics setup: we deliberately strip the query string before reporting a page to Google. Your paid report URL contains the Stripe session id that unlocks it, and that token has no business sitting in an analytics property where it could be read or replayed.

We run no advertising cookies, no retargeting pixels and no ad networks. You can block or delete cookies in your browser, or use Google's official opt-out browser add-on, and the site still works normally.

Who else handles your data

• Stripe, for payments, checkout and the email address collected there.
• Google Analytics 4, for the site analytics and cookies described above.
• Vercel, which hosts and serves the site, keeps standard server logs, and supplies the coarse country and state signal we record.
• Supabase, the database that holds the lookup rows, the purchase records and the stored reports described above.
• A licensed US vehicle-data provider, which receives the VIN, ZIP code and mileage for a paid report and returns the market pricing and the factory build record. Its responses are cached for 24 hours so a refresh does not re-query it. We will name the provider if you ask us at the address below.
• NHTSA, a US government service, which receives the VIN to decode the vehicle, and the year, make and model to return recalls and crash-test ratings.
• EPA fueleconomy.gov, a US government service, queried by year, make and model. It never receives your VIN.

Each of these processes data under its own terms.

What we don't do

We don't sell your personal information. We don't require an account, we don't build advertising profiles from your searches, and we don't hand your email address to anyone to market to you.

Your rights

To ask what we hold about you, or to have it deleted, email support@carworthit.com. For a purchase, include the email address you paid with or your Stripe receipt so we can find it. For a free lookup, give us the VIN: we can hash it the same way and find the matching row, which is the only way that row can ever be traced back to a vehicle.

Contact

Questions about any of this, including anything here you think is wrong or incomplete, go to support@carworthit.com.