Privacy Policy

1. Who we are

This policy describes how TrulyCar LLC, a Wyoming limited liability company ("TrulyCar", "we", "us"), handles information when you use trulycar.com. The short version: we collect little, we sell nothing, and the reports we produce contain vehicle records, never people's.

2. What we collect

Account information: your email address and a password we store only as a cryptographic hash. We cannot read your password and cannot recover it, only reset it.

Order information: which reports and packs you bought and when. Card payments are processed entirely by Stripe; your card number never reaches our servers. Stripe's own privacy policy governs the payment data it processes.

Search activity: the VINs and plates you look up, kept to deliver your reports, power your 30-day re-checks, and prevent abuse of the free decoder.

Technical basics: standard server logs (IP address, browser type, pages requested) retained briefly for security and debugging. We also keep, with your account, the IP address and approximate location (city and country) from which it was created and last signed in, to detect fraud and automated sign-ups.

3. What we never collect or show

Our reports contain vehicle history only. In line with the federal Driver's Privacy Protection Act, they never include the names, addresses, or contact details of a vehicle's owners, and we do not offer any product that identifies a person from a plate or VIN.

We do not buy marketing profiles about you, and we do not sell or rent your personal information to anyone.

4. How we use information

To run the service: delivering reports you bought, maintaining your credit balance, and keeping your account secure.

To communicate: order confirmations and answers to messages you send us. We do not send marketing email unless you have opted in, and any such email includes a working unsubscribe.

To improve the site: we measure how pages are used (see Sharing for the services involved) and which ads lead to purchases. You can block these tools with any content blocker without affecting the service.

To protect the service: limiting repeated requests and sign-in attempts per connection and per account, and checking new sign-ups for automated abuse.

5. Cookies

Sign-in cookies keep you signed in and protect forms against cross-site requests; they last until you sign out or the session expires.

tc_sid: a random identifier for your browser, kept 180 days, used to count distinct visitors to vehicle pages and to limit abuse of the free lookup. It contains nothing about you.

tc_ref: the affiliate code of the link that brought you, kept 30 days, so the partner who referred a purchase is credited.

tc_se: which search engine sent you to the site, kept one day, used to decide which vehicle pages are worth publishing.

tc_buyer: set after you complete a purchase or sign in to an account with one, kept two years, so the first-report offer is shown only to first-time buyers.

Your browser's local storage keeps your light or dark mode choice, whether you dismissed a banner, and which of your orders were already counted, so a purchase is not reported to our analytics twice.

Google Analytics, Google Ads, Contentsquare, and Tidio set their own cookies when they load. None of them is required for the site to work.

6. Sharing

We share data only with the service providers that run the site, and each receives only what its job requires:

Stripe processes payments and receives your email and card details. Vercel hosts the site and counts page views without cookies. Supabase stores our database. Cloudflare runs our DNS and the bot check on sign-up.

Our vehicle-data suppliers receive the VIN or plate you look up, never your name or email.

Anthropic generates the AI summary of a report and answers questions you ask in report chat; it receives the report's vehicle data and your questions. Google's Gemini reads a VIN from a photo when you use the camera scan, and receives that photo.

Google Analytics and Google Ads measure how visitors reach the site and which visits lead to a purchase. They receive the steps you take (a lookup, opening the report offer, starting checkout, completing an order) with the pack and price, never the VIN you looked up, your name, or your email. Contentsquare records how visitors move through pages, including clicks and scrolling, so we can find what confuses people. Tidio runs the live chat and receives the messages you send.

Zoho Mail sends our order and account emails. Klaviyo stores your email only if you ask for the inspection checklist.

We disclose information beyond that only if the law compels us to.

7. Retention and deletion

We keep account and order records, including the sign-up and last sign-in IP address and approximate location, while your account exists and as long as tax and accounting rules require. Sign-in links and verification tokens are deleted automatically after they expire, and rate-limit counters after their time window ends.

To delete your account and its personal data, email contact@trulycar.com from the account address; we will confirm and complete the deletion within 30 days, keeping only what the law obliges us to retain.

8. Security

Passwords are hashed, API credentials are stored encrypted, connections use TLS, and access to production systems is restricted. No system is breach-proof; if an incident affects your data we will notify you as the law requires.

9. Children

The service is for adults making vehicle decisions and is not directed at children under 13. We do not knowingly collect their data.

10. Changes and contact

If this policy changes materially we will update this page and its date. Questions or requests: contact@trulycar.com, or +1 321 878 3513.