Privacy
What openvin stores, why, and for how long. It is short because there is little to describe.
This page is published in English only, and the English text is the one that applies.
No accounts, no tracking
You do not need an account to decode anything. There is no analytics script, no advertising network, no tracking pixel and no third-party embed on any public page. Nothing is sold or shared.
Two cookies exist, and neither tracks you. Choosing a language stores that choice — the language, and any currency or units you set — so the site remembers it on your next visit; it contains nothing else and no identifier. Administrators signing in get a session cookie. If you never change a setting and never sign in, no cookie is set at all.
What happens to an identifier you enter
A VIN or chassis number you submit is used to look up vehicle data and to render your result. It is sent to the providers listed below so they can answer.
The plain-language summary on a result page is cached so the same vehicle does not need generating twice. That cache is keyed by a keyed hash of the identifier, not the identifier itself — a one-way value that cannot be turned back into your VIN. The identifier is not stored anywhere in readable form.
What is counted
Two things, both stripped of anything identifying:
- Daily totals — how many decodes happened, how many succeeded, and how many were VINs versus chassis numbers. Counts only, attached to nobody.
- Request rate — to stop automated scraping, requests are counted per visitor for one hour. Your IP address is hashed with a secret key before it is written down, so the stored value cannot be turned back into an address, and it is deleted automatically within the hour.
Who else sees a request
Answering a lookup means asking public vehicle databases. Each receives the identifier or the make, model and year — never anything about you:
- NHTSA (United States Department of Transportation) — vehicle specification, recalls and owner complaints.
- EPA (United States Environmental Protection Agency) — fuel economy.
- European Commission Safety Gate — European recall alerts.
- Google Cloud — hosting, the database, and the model that writes the plain-language summary. The summary is generated from decoded attributes such as make and engine; the identifier itself is deliberately never sent to it.
How long things are kept
Your rights, and a plain admission
If you are in the EU or UK you have rights of access, correction, erasure and objection over personal data about you. In practice there is very little here to exercise them against: no account, no readable identifier, no address, no profile.
Because nothing stored is linked to you, a request to see or delete “your” data cannot usually be matched to anything. That is a deliberate design choice rather than an evasion — the less collected, the less there is to protect or misuse.
Hosting and data storage are in the European Union. To ask anything about this, or to raise a concern, get in touch with the site owner.
What this site is not
This is not a vehicle history report. It cannot tell you a mileage, an accident history, a title status or who owned a car, because none of that is encoded in a vehicle identifier. Treat everything shown as information to check rather than a guarantee.