No cookies to accept, no trackers to block

What VINlist stores, and why

• Your preferences

  The theme and language cookies exist only because You picked a theme or a language. They identify nothing and nobody.

• Your sign-in

  When You sign in, I keep a session token and either Your wallet address or, for a passkey, its public key and an account number derived from it — that is the entire “account”. No name, no email, no password. For security, I log sign-ins, changes to sign-in methods and admin actions (time, account, an anonymous visitor tag and country) and keep them for 180 days.

• Your listings

  A listing You publish is public by design: VIN, specs, photos, price and location. Buyers reach You through on-site messages.

• Messages

  A message You send a seller, and the reply contact You attach to it, are stored encrypted and shown only to that seller. Your wallet address or account is never revealed to them.

• Authenticity checks

  If You check a car, its photos are taken live in VINlist and kept only until I've looked the check over, never more than 7 days after its certificate is issued; a check that doesn't pass loses them as soon as it's scored. A short fingerprint of each photo stays, so a photo used before is recognized; the photo can't be rebuilt from it. From the registration document I keep the car's fields and the registration's own: VIN, make, model, engine, masses, seats, years, plate, document number, issuing office, dates and official annotations. The holder's and owner's names, PESEL numbers and addresses are never kept: the outside of the document, where they are, is read on Your phone, and neither that photo nor that data ever leaves it. The plate, document number and dates are encrypted and never shown. The odometer reading, the result and the car's fields stay in the VIN's history, and the car's fields can appear on /specs and in the decoder. A certificate is public for a month, or until You retire it. On a German Part I, the panel with the holder's name and address, on a Greek certificate its middle panel, on a Spanish permiso its holder's rows, on a French certificate its holder's block and the coupon's name, on a UK V5C the keeper's column and the declaration, on a Lithuanian, Hungarian or Romanian certificate the holder's or owner's fields, and on a Belgian Part I its address-change box, are blacked out on Your phone before the photo is sent; only the back of an Austrian, Czech, Dutch, Portuguese or Slovak certificate, the side of a Belgian one with the VIN and box 2 of an Italian one are photographed, none of which names anyone. For other countries' documents, You black out names and addresses on the photo on Your phone, and only what stays visible is sent.

• Notifications

  Push subscriptions exist only if You switch them on — and switching them off deletes them.

• Keeping the lights on

  VINlist runs on a rented server in a data center in Germany, in the EU, behind Cloudflare’s network, which shields it from attacks. Cloudflare is a US company; data that passes through its network outside the EU is covered by the EU–US Data Privacy Framework. Backups are kept, encrypted before they leave, with a cloud storage provider in Europe that never has the key. Technical logs are short-lived and contain no profiles.

• What Your browser fetches itself

  A few public services answer Your browser directly, only when a page needs them: vehicle recalls from NHTSA (the US road-safety agency), exchange rates, city suggestions while You type a place, and a translation You ask for. They see an ordinary web request — no account, and no cookie of ours.

Your rights

VINlist is one person — me, Mateusz Mysiak. Under the GDPR You can ask what is stored about You, have it corrected or deleted, and complain to Your local data-protection authority. The fastest way is right below: signed in with Your wallet, Your request proves itself — or reveal the email address if You prefer.

Send a data request