Data used for a report
We store the submitted VIN, selected billing region, returned vehicle information, report state and demonstration order details. A random, HttpOnly browser cookie controls access. The server stores a hash of that session identifier.
For public decoding, the submitted VIN is sent to the NHTSA vPIC service. No commercial factory equipment API is called in this MVP.
Storage and access
Local development stores data in an ignored .data directory. A configured PostgreSQL database uses the supplied Prisma schema. Reports, PDF downloads and purchase history require the browser session that created them; they are not publicly indexed.
Clearing the browser cookie removes access from that browser but does not delete server records. During development, the operator can delete the local .data directory to reset all local records. Do not use real customer data in this preview.
Cookies and analytics
Public pages use Vercel Web Analytics to measure visits, page views, referring sites, approximate location, browser and device type without analytics cookies. Report pages, purchase history, admin pages and API paths are excluded. URL query parameters and fragments are removed before page views are sent. VINs and report contents are not sent as analytics events.
The session cookie lasts up to 30 days. Country, language, currency and theme preferences are saved in local storage and a non-sensitive preference cookie for server rendering. Automatic theme follows the visitor’s local time: light from 07:00 until 19:00, otherwise dark. A separate admin cookie expires after one hour. No third-party marketing scripts or advertising trackers are included.
Operational audit records measure lookups, deliveries, failures and provider requests. They are accessible only behind the configured administrator authentication.