This page explains exactly what dec.vin uses cookies for. Analytics cookies are optional, and one functional cookie is used only if you sign in.
dec.vin uses Google Tag Manager (GTM) to load Google Analytics (GA), which helps us understand how the site is used — pages visited, general usage patterns, nothing more. That's the only tracking on this site: no advertising cookies, no third-party trackers, no fingerprinting.
When you decode a VIN, we run Cloudflare Turnstile to tell real visitors from automated traffic. It loads a script from Cloudflare and checks your browser and connection; it does not need an account and we don't use it for advertising or tracking. It runs regardless of your analytics choice because it is needed to keep the service available. See Cloudflare's privacy policy.
Beyond page views, we record anonymous usage events: whether a decode was started and finished, how long it took, whether you left during the wait, which car model, series and year was decoded (never the VIN itself), whether you compared two VINs, downloaded a PDF, and how far you got in the checkout (viewed, started, completed, failed). We never send your email address or full VIN to Google Analytics.
The cookie bar shown on your first visit isn't just a notice — accepting or rejecting actually controls whether GTM/GA load. If you reject or simply close the tab without choosing, no analytics script runs and no analytics cookie is set. You can change your choice at any time using the "Cookie settings" link in the footer.
Decoded VIN data is stored in our database to avoid re-querying the upstream API for VINs we've already looked up. This is functional caching, not tracking — it's tied to the VIN itself, not to you as a visitor, and no analytics cookie is required for it to work.
If you buy scan credits or a mileage report, we store your email address (it is your account — there is no password), your credit balance, your purchased reports and order records. Sign-in uses a one-time link sent to your email and a functional session cookie (dv_sess) that keeps you signed in; it is not used for tracking. Payments are processed by PayPal or Stripe — we never see or store your card details. To limit abuse, we keep your IP address against a rolling 24-hour scan counter.