Privacy

• We don't store your VIN or registration anywhere — nothing is written to a database.
• Your IP address is held in memory only, to stop the site being abused — we never write it to our own logs or database.
• There are no accounts yet, so nothing is tied to your identity.
• We don't run analytics that identifies you, and there are no ad trackers.
• We never sell data. We don't collect enough to sell.

A US VIN is sent to NHTSA's own public vehicle-lookup service to fetch basic facts like make, model and engine.

A UK registration isn't actually looked up yet: that connection to DVLA hasn't been switched on, so today entering one falls back to asking you to type the vehicle's details in by hand instead of being sent anywhere. Once it's switched on, a registration will be sent to DVLA's own vehicle enquiry service the same way a VIN is sent to NHTSA — and this page will say so.

Neither a VIN nor a registration is ever written into a database. A short-lived, in-memory cache (up to 30 days for a VIN, 24 hours for a registration) avoids repeating an identical lookup while the site is running, keyed by a one-way cryptographic hash of the value — never the value itself — and it disappears whenever the server restarts.

Every request carries your IP address, the same as any website. We use it only in memory, to stop one visitor overloading the vehicle-lookup or decode tools — a rate limit, nothing more. It sits in a list of at most 10,000 addresses, and yours is dropped when the server process restarts or when 10,000 other visitors have pushed it out, whichever comes first. We never write it to our own logs or database, and never link it to anything else you've done. Our hosting provider keeps its own request logs, as every host does; those are theirs, and we don't use them.

obd_locale remembers whether you're using UK or US words, for up to a year.

obd_identify_result remembers the result of a vehicle lookup for a few hours so the next page can show it. It's signed so it can't be edited, and it holds the vehicle's facts — never your VIN or registration.

The codes you enter are read on the server to work out an answer for that one request. They aren't saved.

If you answer the "did that fix it?" prompt, that answer isn't saved anywhere yet either — there's no database wired up to record it in today. We log a short, anonymous line about it (which story, which likely cause, and your answer) to help us build that properly later; it never includes your fault codes, your vehicle, or anything that identifies you, and it's never written to a database.

Our server logs never contain a plain VIN or registration. Today, without a separately configured signing secret, they don't even keep a hash of one — they just record that a VIN or registration was present, as the word "redacted". If a signing secret is added later, a log line would carry a keyed cryptographic digest instead — still never the original value, and never reversible back to it.

This page describes what OBDwiki does today. If that ever changes — an account system, or switching on the UK registration lookup, for example — this page changes first, and says so plainly.