What we collect. What we don't.

VINly is built to need as little of your data as possible. There are no accounts, ads, or advertising identifiers. Most saved research stays on your device. This policy explains the limited data sent off-device to provide VIN research, photo recognition, listings, support, and optional product analytics.

What we collect

• VIN and vehicle details you scan, enter, or research, such as year, make, and model. These are used to request vehicle data.
• Photos you choose to capture or select when using the photo-based VIN reader. In the iOS app this is read entirely on your device and no image is uploaded. On the website, a resized copy is sent to a text-recognition provider, because a browser has no on-device option.
• Listing searches, including the vehicle and ZIP code you submit, so we can return nearby inventory.
• Optional product analytics, including app interactions and a randomly generated device identifier, when analytics is enabled. It is not an Apple advertising identifier and is not used for ads or cross-app tracking.
• Support information you voluntarily send through our contact form or by email, including your name, email, and message.

What we don't collect

• No account profile, password, contact list, or precise location.
• No photos beyond those you explicitly capture or select.
• No advertising identifier and no third-party advertising pixels.
• No session recordings or replays.
• We do not sell personal information.

Where data goes

VINly uses the following services to provide the product:

• Supabase hosts the server functions that receive photo-VIN and listing requests. API keys remain server-side.
• OpenAI performs text recognition on a VIN photo submitted through the website only. In the iOS app, both photo and barcode VIN reading happen on your device and no image is uploaded.
• NHTSA and EPA provide VIN decode, recall, complaint, crash-test, and fuel-economy data. Requests include only the vehicle identifiers needed for the lookup.
• Auto.dev provides dealer inventory. The request includes vehicle criteria, ZIP code, and search radius.
• PostHog may receive product-interaction events and the random device identifier when in-app analytics is enabled.

VIN photos are processed to return recognized text and are not stored as a user photo library. Third-party providers may retain transient request data according to their security and abuse-prevention policies.

Data stored on your device

• Saved and recently researched vehicles.
• Your most recently used listing ZIP code.
• A random identifier used for optional product analytics.

Retention and deletion

Use Clear Garage in Settings to remove saved vehicle research. Deleting the app removes VINly's local data from the device. Support messages are retained as long as needed to answer and maintain a reasonable support record. Analytics retention follows our provider configuration.

To request deletion of support or analytics data that can reasonably be associated with your request, email support@vinly.dev.

Children's privacy

VINly is rated 4+ but is intended for adults making a vehicle purchase decision. We do not knowingly collect data from children under 13. If you believe a child has used VINly and you'd like us to scrub any related data, email support@vinly.dev.

Changes to this policy

If we change this policy, we'll update the date at the top and post a note in the app's settings screen on next launch.

Contact

Questions about privacy? Email support@vinly.dev or use the form at vinly.dev/support.

---

Trademark notice. VINly is not affiliated with, endorsed by, or partnered with Facebook, Marketplace, Meta, Cars.com, AutoTrader, CarGurus, Auto.dev, or any other listing platform or data provider. Third-party names identify sources only.