A file you drop in
You pick a file; your browser sends it to our server; the server reads it in memory, finds the numbers and the tables, and sends the result back. The file is then gone. We don’t keep it, open it again or pass it on. The tables, the file map and the hex view are drawn in your browser from your own copy. A compare works the same way with two files.
We keep the result: what we found (maker, family, numbers), how sure we were, the file’s size and a fingerprint of it (SHA-256). We don’t keep the file name. If the file contains a VIN or the ECU’s serial number, we show it to you and don’t store it.
If we can’t recognise a file and you press “Keep it for 90 days”, we store that file for up to 90 days to work out what it is, then delete it. We never publish it or pass it on. Ask for it to be deleted sooner at the address on the About page. If you leave an email to hear when a file type is supported, we use it for that one message.
A car check
When you leave “Add this check to the database” ticked, we keep:
- the software IDs (CAL IDs) and fingerprints (CVNs) of every module that reports them;
- the make, model, year, trim, engine and fuel type that NHTSA’s decoder returns for the VIN;
- the check-engine light, fault codes, readiness tests and the counters since codes were last cleared;
- the adapter type and version, and what the adapter answered, with the VIN removed;
- what you told us about the car (stock, tuned or not sure), if anything;
- a keyed hash of the VIN, so each car is counted once.
If you untick the box, the check is compared and shown to you but not stored. Numbers you type in by hand are stored with the lookup (with a VIN hash only if you give a VIN) and are never used to judge other cars.
We never keep the VIN itself; the hash can’t be turned back into it. The VIN you type into the VIN check goes from our server to NHTSA’s public decoder (vPIC) and nowhere else. We cache NHTSA’s answer for a week under the same keyed hash, never the VIN. Recalls, complaints and crash ratings are looked up by make, model and year, not by VIN.
Each saved check gets a link with a random code. Anyone with the link can see the result page: the make, model and year, the software codes and the fault-code summary. It never shows the VIN. To delete a check, send its link to the address on the About page.
If you ask to be told when there’s enough data for a car’s software, we use your email for that one message and nothing else, and we don’t share it.
For both
To limit abuse we keep a one-way hash of your IP address that changes every day. It can’t be turned back into your address and can’t be joined across days. Our web server logs requests like any web server (address, time, page). The site owner may get a short message for each saved car check (make, model and the result), with no VIN, IP address or email.
No analytics companies, no ad trackers, no fonts or scripts loaded from other sites. The site sets no tracking cookies.
The legal basis (for visitors in the EU and UK)
Legitimate interest (GDPR Art. 6(1)(f)) for the file result log and abuse limits; your consent (Art. 6(1)(a)) for files you let us keep, car checks you add to the database, and emails you leave. The 90-day timer is how we keep stored files no longer than needed (Art. 5(1)(e)).