Your VIN and your privacy

There’s no account to make and no email to hand over. I never ask who you are, and the site works the same with an ad blocker on.

The three places your VIN goes

NHTSA’s vPIC decoder gets it first and turns it into a year, make and model. The manufacturer’s own label service is asked for the PDF. NHTSA’s recall and crash-test services are asked about that vehicle. fueleconomy.gov is asked too, but only with the vehicle’s description — it never sees the VIN.

That’s the whole trip. Nothing else receives it.

What I keep

I keep a copy of every window sticker the site retrieves, filed under its VIN in Cloudflare R2, and nothing else. As of 18 September 2026 that’s 35 PDFs.

I keep them because manufacturers switch these services off — Toyota and Lexus closed public access during 2026, and a label nobody saved is a label nobody can get again, which is the whole reason a free lookup should be holding copies in the first place.

A VIN names a vehicle. It’s stamped on the dashboard, readable through the windshield by anyone walking past. Someone holding other records can still tie one to an owner. Email me a VIN and I’ll delete its sticker.

What gets counted

A table in Cloudflare D1 keeps daily tallies by make and by result. A second one notes which site sent each visitor. Neither holds a VIN or an IP address. The row for a failed Ford lookup reads “Ford, not published, 1” and nothing more.

Analytics

I run PostHog. It records page views and clicks against a random ID kept in a cookie and in local storage. Before anything leaves your browser, every VIN in a URL is cut to its first 8 characters — enough to describe the model and engine, short of the serial number in positions 12 to 17 that makes a vehicle unique.

Session recording is off. I’ve never turned it on.

PostHog normally stores the IP address each event arrives from. This site stops that by sending a blank address, 0.0.0.0, with every event; PostHog keeps the blank one and never learns your city or country. I tested it on 18 September 2026 with two events. The one with the blank address was stored as 0.0.0.0. The control was stored with my own address and tagged US. Until that day the real addresses were kept, and I haven’t gone back to delete them. An ad blocker stops PostHog entirely and costs you nothing here.

Cloudflare

Cloudflare hosts the site, so it sees your IP address the way any host does, and it enforces the rate limit at its edge — 10 requests per 10 seconds per address, which someone looking up a car or two won’t reach and a scraper hits in a second. Its request logs include the URLs you visit, VINs included, and are kept for up to 7 days (Cloudflare’s retention, which I don’t control). Cloudflare Web Analytics runs too; it doesn’t set a cookie.

What I don’t do

I don’t run ads or deal with data brokers. Nothing gets sold or traded — there’s nothing here worth selling. I can’t build an email list either, because I never collect an address.

Contact

contact@windowsticker.org reaches me directly. Last updated 18 September 2026.