What is kept
The VINs people check. A free check keeps a copy of the factory record it read, so the next check of the same car does not ask Tesla again. Nothing ties a free check to you. Totals across those records, such as how many early Model S still have free Supercharging, are published on this site; never a VIN or anything that points to one car.
For a Factory Report: the report itself, its VIN and date, and Stripe's reference for the payment. The report is kept so that its link keeps working.
The email address you give at checkout, so the report link can be sent to you, and sent again if you lose it.
For an account: the email address and name from your Google sign-in, Google's ID for your account, and your credit balance with its history. If you buy credits, Stripe's reference for you as a customer too.
For a Live Diagnostic: the VIN, the owner's Tesla account email you enter (Tesla sends its access request there), the report, the readings it is built from, and Tesla's record of the car's state at the time (software, settings, charge and connection status), kept so a later reading can be compared with it. Never the car's location, or the owner's contacts, accounts or media: the car sends its full list of readings during the session, and only the ones the report uses are kept.
A waitlist: the email address you leave there, used only to tell you when the Live Diagnostic is open.
Messages: the contact form sends your message by email to the support inbox, and the site keeps no copy. A message the spam filter stops is kept in the site's log (the email address and the first 200 characters), so that a real message caught by mistake can still be answered.
What is not kept
Card numbers. You pay on Stripe's page, and card details never reach this site.
IP addresses. The free lookups are counted per connection in the server's memory only. No IP address is written to disk or kept in a log.
The visit counter sets no cookie and keeps no IP address. It adds one to a daily count of visits, of where they came from (a search engine, another site, or typed in), of the page they started on, of the kind of device and of the country Cloudflare reports. Free checks are counted the same way: by country, and by whether a browser, an AI assistant or something else ran them.
There are no advertising or tracking cookies, and nothing is sold.
Cookies
tbx_session keeps you signed in, for 30 days.
tbx_oauth_state, tbx_vin and tbx_next last 15 minutes or less. They carry a Google sign-in through, with the VIN you were looking at and the page to come back to.
tbx_paid lasts 10 minutes. It shows a note once on a report: "Payment received" on the one you just bought, or that you already have it when you try to buy the same car again.
tbx_bought is set only when you buy a report without an account, and lasts up to 400 days. It remembers on this device which cars you bought reports for, so the site offers you the report you already have instead of selling it again.
Your light or dark choice is kept in your browser's own storage and is never sent to the site.
Who else handles your data
Stripe takes payments. Google handles sign-in. Resend sends the emails that carry report links, and delivers contact-form messages to the support inbox. Cloudflare serves the site, so every page you load passes through its network; it also counts page views with its Web Analytics script, which sets no cookie, and routes email for support@tbx.report to a Gmail inbox. ntfy.sh carries phone alerts to me. An alert about a car names only the last four characters of its VIN; one about a Live Diagnostic also links to the job, which opens only for me and for the account that asked.
The VIN you check is sent to NHTSA's public decoder and recall service, and looked up in Tesla's parts catalog to read the car's factory record. No name, email address or payment detail goes with it. A Live Diagnostic reads the car through Tesla's own diagnostic service, after the owner approves Tesla's access request.
Each of these companies has its own privacy policy.
Deleting your data
Email support@tbx.report from the address you used, and I will delete your account, your reports and your email address from this site. Encrypted backups are kept for 30 days, so a deletion reaches them within that time. Stripe keeps its own record of a payment.
Do Not Track
The site does no tracking across other sites, so it treats every visit the same whether or not your browser sends a Do Not Track signal.
Changes
Changes to this page are posted here, with a new date at the top.