Your VIN and your privacy
There’s no account to make, and you never have to hand over an email. We never ask who you are, and the site works the same with an ad blocker on.
Where your VIN goes
NHTSA’s vPIC decoder gets it first and turns it into a year, make and model. Then it may be shared with the provider that holds the window sticker for that make, so the label can be retrieved.
NHTSA’s recall and crash-test services and fueleconomy.gov are asked about the vehicle too, but only by year, make and model. None of them sees the VIN. The recall link on a result page does carry it to nhtsa.gov — if you click it.
That’s the whole trip. Apart from the company that hosts the site (more on that below), nothing else receives it.
If you ask to be emailed
When a sticker isn’t available yet, a result page may offer to email you the sticker once it comes through. That’s optional. If you use it, we keep your address next to that one VIN for up to 14 days, and send one email: the sticker, or a note that it never came. Then the address is deleted from that request. The email goes out through the host’s email service.
If you also tick “occasional updates”, your address goes on a separate list, without the VIN. Nothing has been sent to that list yet, and anything that is will carry an unsubscribe link. To be removed, write to contact@windowsticker.org.
On some Ford and Lincoln result pages you can ask to hear when a factory options report is ready. If you do, we keep your address with the year, make and model only, never the VIN, and send one email when the report exists. Write to us and we’ll delete it.
If you watch for a car
Spec watch emails you when a used car with the factory options you picked is listed. We keep your email address, the model, the options you ticked, any filters you set, and the dates you signed up and confirmed. For each car we have emailed you about, we keep its VIN so the same car isn’t sent twice. Apart from the confirmation email, nothing is sent until you confirm your address. An unconfirmed watch is deleted after 7 days, and a request for a model we don’t cover after 30 days. Every email except the notice that a watch was stopped has a stop link, and stopping deletes the watch rather than pausing it. Neither your address nor any VIN goes to analytics.
If you send feedback
Result pages ask “Did this help?”, and there’s a form at /feedback. Both are optional. We keep your answer, anything you write, the page you were on (which on a result page includes the VIN), and an email address only if you give one so we can reply. Write to contact@windowsticker.org to have it deleted.
What we keep
We may retain documents retrieved for a VIN.
A VIN names a vehicle. It’s stamped on the dashboard, readable through the windshield by anyone walking past. Someone holding other records can still tie one to an owner. Email us a VIN and we’ll delete anything we hold for it.
What gets counted
Database tables keep daily tallies: lookups by make and result, which site sent each visitor, and the page each visit started on. The row for a failed Ford lookup reads “Ford, not published, 1” and nothing more. When a manufacturer says no outright, another row notes which kind of no and the model year: “Ford, not yet released, 2019, 1”.
There’s a country tally too. Each visit adds 1 to that day’s total for the country the host places your connection in (US, GB, or XX when it can’t tell). That’s the whole record: a day, a two-letter code and a number.
None of these tables holds an IP address. Since 25 September 2026 none holds a VIN either. Before that, one did; see below.
API callers
The API asks nothing of you, but a caller can name itself in an X-Contact header, usually with an email address or a domain. Whatever string it sends is stored in the database by day and route, and for /api/v1 lookups and the MCP server’s get_window_sticker calls in the analytics service too. We use it to see who builds on the API, and to warn them before something breaking ships.
Analytics
We use a third-party analytics service. It records page views and clicks against a random ID kept in a cookie and in local storage. Before anything leaves your browser, every VIN in an event is replaced with “:vin” — in the page address, the referrer, the title, a campaign tag, anywhere. The search box is the one exception. It sends the first 8 characters of a VIN you type: enough to describe the model and engine, short of the serial number in positions 12 to 17 that makes a vehicle unique.
Session recording is off. It has never been turned on.
The analytics service normally stores the IP address each event arrives from. This site stops that by sending a blank address, 0.0.0.0, with every event; it keeps the blank one and never learns your city or country. We tested it on 18 September 2026 with two events. The one with the blank address was stored as 0.0.0.0. The control was stored with our own address and tagged US. Until that day the real addresses were kept, and we haven’t gone back to delete them. An ad blocker stops the analytics entirely and costs you nothing here.
A leak we missed
Until 25 September 2026 the VIN rule above only knew this site’s own result-page addresses. A link with a VIN anywhere else in it — AI assistants invented ones like /lookup/kia/ followed by a VIN — put the full VIN in two places: the page addresses the analytics service records, and the database count of landing pages. A VIN in a referrer or a campaign tag would have reached the analytics service whole too. In the database, 3 of the 75 landing-page rows held one. We rewrote them on 25 September 2026, and each now reads :vin where the VIN was. The analytics events are still there, and they stay for as long as that service’s data retention keeps them. We haven’t deleted them.
Hosting
The company that hosts the site sees your IP address the way any host does, and it enforces the rate limit at its edge — 10 requests per 10 seconds per address, which someone looking up a car or two won’t reach and a scraper hits in a second. Its request logs include the URLs you visit, VINs included, and are kept for up to 7 days (the host’s retention, which we don’t control). The host’s own traffic analytics run too; they don’t set a cookie.
What we don’t do
We don’t run ads or deal with data brokers. Nothing gets sold or traded — there’s nothing here worth selling. If this site is ever sold, the logs and stored documents are deleted first. We don’t build a marketing list from the addresses people leave, and we only ask for one when you want to hear back.
Contact
contact@windowsticker.org reaches a person directly. The rules for using the site and the API are in the terms of use. Last updated .