Privacy
Privacy policy
Short version: no account, no email, nothing to buy. Google Analytics and Google AdSense set cookies, described below. A VIN that decodes is cached on our server, with nothing that links it to you.
What we do not collect
We do not ask for or store your name, email address, phone number or payment details. There is no account system. We do not build a profile of you, and we do not sell data to anyone.
VINs you enter
When you decode a VIN, it is sent to our server and looked up against NHTSA's databases. If NHTSA identifies the vehicle, the VIN and its specification are stored so the same VIN can be answered instantly next time. A VIN that does not decode is not stored. Cached entries are not linked to you, your IP address, or your session — the stored record is the vehicle specification, not who asked for it.
Recall results are stored by year, make and model, not by VIN: for 24 hours for vehicles from the last five model years, and for 30 days for older ones. The recall lookup page works the same way and never asks for a VIN.
Two things worth knowing. First, a VIN identifies a vehicle, not a person, but it can be connected to an owner through records we do not have. Do not enter a VIN anywhere, including here, if that connection matters to you. Second, the specification cache does not expire, because a VIN's specifications never change.
The check digit validator sends nothing at all. It runs entirely in your browser.
The camera
The barcode scanner asks for camera access and decodes frames on your device. No image, video or frame is ever uploaded. Only the resulting VIN text is sent, and only when you decode it. Camera permission can be revoked in your browser settings at any time.
Server logs
This site runs on Cloudflare, which records standard request logs including IP address, user agent, timestamp and requested URL. These are used for security, abuse prevention and rate limiting. Cloudflare's own privacy policy governs their handling of that data.
Cookies
Google Analytics sets cookies to distinguish one visitor from another and to measure how pages are used. Google AdSense and its partners set cookies to select and measure advertising, described under Advertising below. Cloudflare may also set cookies necessary for security and bot protection. We set no cookies of our own beyond these.
You can block them in your browser settings or with an extension. Nothing on this site depends on cookies — the decoder, the scanner and the validator all work with them blocked.
Analytics
We use Google Analytics 4 to count visits and see which pages get used. It records things like page views, approximate location derived from IP address, device type and referring site. It does not tell us who you are, and we do not combine it with anything else.
The analytics script does not load immediately. It waits until you interact with the page or three seconds pass, whichever comes first, so it never delays the tool itself.
Google's handling of this data is governed by their privacy policy. You can opt out across all sites with Google's opt-out add-on.
VINs are not sent to Google Analytics. A VIN you decode goes to our server, not to Google. It is not recorded as an analytics event, a page path or a custom parameter. When you open a link that carries a VIN, such as a shared result or a link from one of our make pages, the VIN is taken out of the page address before the analytics script loads.
Advertising
This site carries advertising through Google AdSense, which pays for running it. Ads never appear above the decode results or inside them, and there is still nothing here to buy from us.
Google and its advertising partners use cookies to select and measure ads, and may use your earlier visits to this or other sites to decide which ones you see. Two ways to stop that. You can turn off personalised advertising in Google’s ad settings, which applies across every site that uses Google ads. You can opt out of a wider list of vendors at optout.aboutads.info. Blocking cookies outright works too, and nothing on this site stops working if you do.
How Google handles data from sites that use its products is set out in their partner sites notice.
VINs are kept out of the advertising request. The VIN is removed from the page address before the advertising script loads, and it is never put in a page title or passed to the script. The lookup itself is handled entirely by our own server.
Third parties
Decode requests reach NHTSA's public APIs from our server, not from your browser, so NHTSA does not see your IP address. Google Analytics and Google AdSense, both described above, are the only third-party scripts on the site. If your browser lacks a built-in barcode reader, the scanner downloads the ZXing library — served from this domain, not a third-party CDN.
Children
This site is not directed at children under 13 and we do not knowingly collect information from them.
Changes
Material changes will be reflected in the date above. Continued use after a change means you accept the revised policy.
Contact
Privacy questions can be sent to inquiry@pixoware.com or through pixoware.com.