Privacy

Accounts

You can read every verdict without an account. You need one only to buy a Car Hunt Pass or Pro. An account holds your email address, which we use to send your sign in link and to tie your plan to you. Accounts are stored for us by Supabase.

What we keep about your plan

Which plan you have and until when, a record of each pass you bought, and the Stripe customer number that links your account to your payments. We do not keep card numbers.

My Garage and its alerts

If you save cars to My Garage, we keep the year, make and model of each one, the trim and miles you checked it at if you typed them, any name you give it, and the recall numbers already on file for it, so we can tell you when a new one appears. With Pro, we email you when NHTSA lists a new recall for a car in your garage, and once a week when owners file new complaints about one, so we also keep how many complaints were on file for each car when we last looked. Those emails are sent for us by Resend, which handles your email address only to deliver them. Every alert has a link to stop them, and you can turn them off on your garage page.

If you add deal notes to a car, we keep what you type: the asking price, the seller, where you stand with it and your notes. With Pro, the service log keeps each service you add (the date, the miles, what was done, the cost, the shop, a recall number and your notes) and the oil change interval you set for a car. Only you can see these, and they stay if your plan ends, so you can still read them.

Payments

Payments are handled by Stripe. You type your card on Stripe’s own page, not ours, so we never see or store the card number. Stripe keeps its own records of each payment, as its privacy policy (opens in a new tab) explains.

Cookies

If you ask for a sign in link, we set a short lived cookie that remembers which page to bring you back to. Once you sign in, we set the cookies that keep you signed in: Supabase’s session cookies and one small cookie that says this browser has signed in. None of them are for ads or tracking. If you never sign in, we set no cookies. There are no ads on the site and no ad trackers.

How we count visits

We use Vercel Web Analytics to see how many people visit, which pages they read, and which tools get used, such as the odometer check or a tap on a partner link. It counts them without cookies, a tool’s count names the tool and never what you typed into it, and it does not follow you from site to site. Vercel explains what it records on its analytics privacy page (opens in a new tab).

Server logs

As with almost every website, our host keeps standard server logs. A log entry records things such as the page asked for, the time, your IP address and the kind of browser you use. They are used to keep the site running, stop abuse and fix problems.

When you look up a car

The car picker sends only the year, make and model you choose, so the site can show the right lists and the right car. Our server then asks NHTSA and the EPA for that car’s records. Those requests come from our server, not from your browser.

Links to other sites

Pages here link to NHTSA, the EPA and other sites so you can check our numbers. Once you follow a link, that site’s own privacy policy applies.

We do not sell or share personal data

We do not sell personal data, and we do not share it with anyone for their own use. The only outside companies that handle any of it are the ones that run the site for us: our host and its visit counter, Supabase for accounts, Stripe for payments, and Resend for the alert emails, and only to do that job.

Deleting your account

Write to help@whipworthy.com from the address on your account and we will delete the account, its plan record and its garage, with its deal notes and service log. Stripe keeps its own records of past payments under its own policy.

Changes to this page

If what we collect changes, we will update this page first, and the date at the top will change.

Questions

Write to help@whipworthy.com. A person reads every message.