Privacy

VIN handling

When you request a sheet, the request is transiently processed by Cloudflare, our hosting provider, and sent to NHTSA vPIC for decoding. VIN pages are private and no-store. Factory VIN does not store VINs, decoded fields, camera frames, referrers, or response bodies. Worker observability is disabled.

Network Error Logging is disabled on both production domains so Cloudflare does not request browser network-error reports containing page addresses. Worker request logging is also disabled.

Public-page analytics

Factory VIN uses separate Google Analytics properties on public pages of factoryvin.com and factoryvin.ca to understand aggregate page use. Google may process the page address, browser and device information, and an approximate location derived from the network address. Advertising storage, advertising personalization, and Google Signals are disabled in both Factory VIN tags.

On factoryvin.com, the analytics tag may use analytics cookies. On factoryvin.ca, analytics storage is denied, so Factory VIN does not grant the tag permission to write analytics cookies. The Canadian tag provides cookieless measurement only.

Google Analytics is not loaded on VIN sheets, decoder redirects, U.S. vehicle-data entry or result pages, or Factory VIN preview hostnames. Factory VIN does not send VINs, decoded vehicle fields, province or state selections, camera frames, or official-site results to Google Analytics.

Analytics page addresses are limited to recognized public pages. Query strings and fragments are removed, and referring addresses are reduced to their website origin. We do not use these reports to follow an individual VIN through the service.

Anonymous factory-sheet counts

We count decode requests, factory and recall availability, camera opens, barcode reads, link copies, printing, and official-site exits using anonymous categorical counters. These counters contain no VIN, page URL, IP-derived identifier, make/model/year, province, state, plate, permit, email, camera image, or persistent user ID. They measure actions, not unique people. Google receives a decode-request event only from eligible public pages, with country, page category, and typed, pasted, or camera entry method.

Approved advertising campaign labels may be sent separately to Google Analytics. Unknown campaign values and click identifiers are not included by Factory VIN. Campaign labels remain in page memory; Factory VIN adds no campaign cookies or local storage. We do not use session replay, heatmaps, form recording, or fingerprinting.

When anonymous outcome measurement is enabled, Cloudflare Analytics Engine records the U.S. or Canadian site, whether a generated sheet was complete, partial, unsuccessful, or awaiting input correction, and a count of one. The service adds a timestamp and retains these points for three months. These counts contain no VIN, page address, vehicle details, jurisdiction selection, IP address, browser details, referrer, or user identifier supplied by Factory VIN.

We read combined counts to understand how often factory sheets work. A repeat request counts again; the counts do not identify unique people or vehicles and are not connected to Google Analytics visitors. Request logging remains disabled. Cloudflare Analytics Engine retention.

Public vehicle context

On the Canada face, decoded year, make, model, and engine fields may be matched with public Natural Resources Canada ratings and licensed aggregate Ontario data. On the U.S. vehicle-data page, decoded year, make, model, engine, drivetrain, and fuel fields may be matched with public FuelEconomy.gov configurations. These sources do not receive the VIN from Factory VIN.

Public NRCan and FuelEconomy.gov responses may be cached in memory by their public source URL. VINs and decoded identity objects are not cache keys. Ontario aggregate data loads only when Ontario is selected.

Jurisdiction selection

A Canadian province selection can appear in the noindex VIN-page address. A U.S. state or territory selection is sent to a guidance endpoint, or submitted to the result page when JavaScript is unavailable. The guidance request contains only the selected jurisdiction and no VIN. Factory VIN does not infer either selection and does not save selections in cookies, local storage, or a database.

Camera

Camera scanning is an optional browser feature for the VIN only. Frames remain in the browser and are not uploaded by Factory VIN. You can always type or paste a VIN instead.

Third-party exits

Next-check links take you to independent sites. Factory VIN does not add your VIN to those links, submit their forms, or receive their results. Their privacy practices apply once you leave Factory VIN.

Changes

We will update this policy before introducing any feature that stores a VIN or email. Factory VIN does not offer those features today.