Privacy policy

Who we are

RoadVitals is an independent site that republishes public U.S. vehicle safety data in a more usable form. We are not affiliated with any government agency or vehicle manufacturer. For privacy questions, write to [email protected].

No accounts, ever

There is no sign-up, no login, no password and no profile. We do not ask for your name, email address, phone number or postal address to use any part of this site, and we hold no account records because none exist.

What we collect

Server logs

Like every web server, ours records requests: the URL requested, the time, the HTTP status, the browser’s user-agent string, the referring page if the browser sends one, and the connecting IP address. These logs exist to keep the site running — diagnosing errors, spotting abusive traffic, and understanding load. We do not use them to build a profile of you, we do not combine them with any other dataset, and we do not sell them or hand them to advertisers.

We keep access logs only for as long as they are operationally useful and then let them rotate away. Full VINs are never written to a log: the logging layer redacts them, and anywhere a VIN could appear in a diagnostic it is truncated after the first eight characters, which identify the vehicle model but not the individual car.

Analytics

Analytics is currently disabled. This site ships with an analytics integration point that renders nothing at all unless an operator supplies a script URL, and there is no default provider and no fallback. If analytics is enabled later, it will be a privacy-conscious, aggregate provider chosen for not using cookies or building cross-site profiles, and this page will be updated to name it before it goes live. If a provider that requires consent were ever used instead, a consent mechanism would be in place first.

You may notice that links to official sources carry a small marker attribute in the page’s HTML. That is a hook so aggregate counts (“how often does anyone follow a link to NHTSA”) could be measured by whatever provider is configured, without embedding a vendor’s SDK in the page. On its own it collects nothing and sends nothing.

Search and site usage

Searches are processed to return results and are not tied to you. We do not keep a per-visitor search history, and we do not publish anything derived from what an individual visitor looked for.

VIN lookups

A VIN identifies one specific vehicle and, through a registration record, potentially its owner. It is the most sensitive thing anyone can type into this site, so it gets the strictest handling here:

• We never store the VIN. To avoid asking NHTSA to decode the same VIN repeatedly, we cache the decoded result under a salted SHA-256 hash of the VIN. The cache can answer “have we decoded this before” and nothing else — it cannot be read back into a list of VINs, by us or by anyone who obtained a copy of the table.
• The cached payload is stripped. We keep a fixed whitelist of decoded build attributes (make, model, year, body class, engine and similar) and drop anything that echoes the VIN back. An entry expires 30 days after it is written: past that point it is never served, and the next lookup of the same vehicle replaces it.
• A VIN lookup never becomes a page. We do not create, publish, index or list pages for VINs, and no VIN you enter is displayed to anyone else or shown anywhere in a public list.
• Nothing is cached in transit. VIN responses are marked private and no-store, so no shared cache or CDN retains them.
• The VIN goes to NHTSA. To decode it we send it to NHTSA’s public vPIC decoding service, which is a U.S. government system with its own privacy practices. That request is what makes a decode possible; we send the VIN and nothing about you.
• We never sell VIN data — or any other visitor data — and we do not share it with data brokers, dealers, insurers or advertisers.

Cookies and browser storage

We set no tracking cookies and no advertising cookies. The only thing this site stores in your browser is a theme value in local storage remembering whether you chose the light or dark appearance. It contains no identifier, it is read only by your own browser to avoid a flash of the wrong theme, and clearing your browser storage removes it.

No third-party fonts, script CDNs or tracking pixels are loaded. The site uses the fonts already on your device.

Advertising

Advertising is not currently enabled. No ad code is loaded and no ad slot renders — not even a placeholder.

If Google AdSense is enabled in future, that changes: Google and its partners would set cookies or use device identifiers to serve and measure ads, subject to Google’s own policies rather than ours. In that case a consent mechanism would apply for visitors in regions that require one, including the EEA, the UK and Switzerland, and you would be able to refuse non-essential cookies. We would update this page, and name the provider, before any of it went live.

Who else is involved

• Our hosting provider operates the server this site runs on and necessarily processes the network traffic reaching it.
• NHTSA receives a VIN when you use a VIN tool, as described above.
• Sites you click through to — NHTSA, FuelEconomy.gov and similar — have their own privacy policies. We have no control over them and no visibility into what you do there.

We do not use third-party trackers, social widgets, comment systems, chat widgets, tag managers or A/B testing services.

Retention

Access logs are kept only as long as they are useful for operating and securing the site. VIN decode cache entries expire 30 days after they are written and are never read back after that — and they hold a salted hash rather than a VIN either way. There are no user accounts, profiles or contact records to retain. If you email us, we keep the message for as long as needed to deal with it and to have a record of the correspondence.

Children

This site is aimed at people researching vehicles and is not directed at children. We do not knowingly collect personal information from children.

Your choices and requests

Because we hold no accounts and no profiles, there is normally nothing personal about you for us to export, correct or delete — which is the point of the design. If you believe we hold something about you and want to ask about it, email [email protected] and we will tell you honestly what we do and do not have. We may need enough detail to identify the relevant records; please do not send us a full VIN.

For a factual correction to a vehicle page rather than a privacy request, write to [email protected] with the page URL and the campaign or ODI number, or see contact for which address to use.

The records this site publishes come from NHTSA and the EPA. We cannot alter a government record, and complaints published by NHTSA are already redacted by them before release. If you believe a source record itself contains something it should not, that has to be raised with the agency that published it; see data sources for who publishes what.

Changes to this policy

We will update this page when what the site does changes — in particular before enabling analytics or advertising, not afterwards. The review date at the top always reflects the last time this text was checked against the running code.

Contact

Privacy questions: [email protected]. Anything else: [email protected].