← Back to The Lane Check

Privacy Policy

Who operates this service

The Lane Check is operated by Vent Pro NYC Inc., 1712 East 22nd Street, New York, NY 11229, United States. “The Lane Check” is a trading name used by that company for this service. Payments are processed by Stripe and appear on your statement as LANECHECK.

Contact: support@thelanecheck.com

The short version

We hold your email address, the vehicles you have run reports on, and whether you have a 30-day pass and when it ends. We never see your card. We do not sell anything to anyone, and we run no advertising. We count page views with Cloudflare Web Analytics, which sets no cookie and stores nothing on your device (see Page-view statistics). You can have your account data deleted by sending one email.

Your first report, before you sign in

You can run one report without an account. To count it, our server sets one cookie, lc_anon. It holds a random value, is HttpOnly and Secure, and lasts a year. With that report we store a one-way hash of the cookie’s value, a hashed form of your IP address (so one address cannot collect unlimited free reports: at most three a day), the VIN or year, make and model, and the date. We do not store your IP address itself. The cookie also tells our history-report link (see below) that the click came from someone who used the tool.

If you then sign in, that report is moved onto your account and counts as your free report.

Your account

A second report needs an account, so the free allowance is counted somewhere you cannot edit. An account comes with one free report in total, including any you ran before signing in (some older accounts have three). After that, reports need a 30-day pass. An account is created the first time you ask for a sign-in code at an email address, or when you buy a pass.

We store, for each account:

• Your email address. It is how you sign in, and it is how a Stripe payment is matched to your account.
• Sign-in records. When you request a code we store a one-way hash of that code and of the one-click link, never the code itself, along with when it was issued and how many times an incorrect code was submitted. These rows expire after ten minutes and are single-use.
• Your session. Signing in sets a cookie, lc_session. It holds a random value; our database stores only a one-way hash of it, so a copy of our database would not let anyone sign in as you. It is HttpOnly and Secure, lasts 30 days, and is removed when you sign out. It is strictly necessary for the service to work and is not used for tracking.
• The vehicles you have run. For each report we keep the VIN (or the year, make and model), and the date. This is what enforces the free limit, it is what lets you re-open a report you already ran, and it is your history.
• Your pass. Whether you have bought a 30-day pass, when it started and when it ends, plus your Stripe customer identifier. (Accounts from the earlier monthly subscription also keep that plan’s status and Stripe subscription identifier.)

What happens to a VIN you enter

A VIN is sent to our server, which queries the National Highway Traffic Safety Administration (NHTSA) public APIs to decode the vehicle and retrieve owner-complaint and recall records for that year, make and model. NHTSA receives the VIN or the year/make/model from our server, not from your browser. Their handling of that request is governed by NHTSA’s own policies.

We keep the VIN against your account as described above. A VIN identifies a vehicle, not a person, and we make no attempt to link one to an owner, a registration or any history record.

Explain My Dealer Quote and Compare Dealer Quotes

If you use Explain My Dealer Quote or Compare Dealer Quotes, you upload photos or a PDF of a dealer’s quote (two, to compare them). Before uploading, the page lets you black out your name, address, phone and account numbers; we ask you to, because we only need the prices. Your browser re-draws each page as an image before sending it, which drops photo metadata such as location.

• The document itself is not stored. Our server sends the page images to Anthropic, whose AI model reads the labels and amounts, and then discards them. They are not written to our database or our logs. Anthropic processes them to return the figures and handles them under its commercial terms, which do not allow it to train its models on them.
• What we keep: the figures read from the quote, the figures you confirm, the vehicle description, trim, mileage and VIN if you give them, the report and, if you compare two quotes, the comparison. They are linked to your account, visible only to you, and deleted automatically 30 days after you upload, or sooner when you press Delete on the page. Deleting a quote also deletes any comparison it is part of.
• To write the plain-English explanation, the confirmed labels and amounts (never the document, your email or anything else about you) are sent to Anthropic again.
• Draft My Reply to the Dealer builds a suggested message from your confirmed figures on our server, using fixed wording (no AI). We do not store or send it: you copy it and send it yourself.
• None of this is sent to our page-view statistics. The page keeps the quote’s identifier after a # in the address, which browsers do not send to servers.

Payments

The 30-day pass is a single payment taken by Stripe; it does not renew. Card numbers are entered on Stripe’s own checkout page and never reach our servers — we cannot see them and do not store them. Stripe tells us, by a signed webhook, the email address used at checkout, your Stripe customer identifier and, if you were signed in when you bought, which account to apply the pass to. That is what switches the pass on. Stripe’s handling of your payment data is governed by Stripe’s privacy policy.

Email

Sign-in codes are delivered by Resend, an email provider, which receives your email address and the contents of that message in order to deliver it. We send sign-in codes and service messages about your account. We do not send marketing email, and there is no mailing list.

Stored on your device

• The session cookie (lc_session) described above — strictly necessary, not used for tracking.
• The free-report cookie (lc_anon) described above — set when you run a report without signing in; it counts your free report and is not used for advertising.
• Recent VIN searches — the last six VINs you looked up are kept in your browser’s localStorage so the Recent buttons work. This never leaves your device and you can clear it with the Clear recent VINs button.

There are no advertising cookies and no tracking pixels. The page-view statistics described below store nothing on your device.

Page-view statistics

We use Cloudflare Web Analytics, provided by Cloudflare (which already hosts the site), to see which pages people read and how quickly they load. When a page loads, a small script from static.cloudflareinsights.com sends Cloudflare a report containing:

• the address of the page, without anything after a ? in it;
• the site that linked you to it, if your browser shares that;
• your browser, operating system and their versions, and the type of device;
• the country your connection comes from, which Cloudflare works out from the connection;
• how long the page took to load, and a random number that identifies that one page load only.

It sets no cookie and uses no local storage, so it does not recognise you from one page to the next or from one visit to the next. It never receives a VIN you type, your email address or your account. We see only totals, such as page views per page and per country. Cloudflare states that it does not track individual visitors across the websites it serves. Its handling of this data is governed by Cloudflare’s privacy policy. If your browser or an extension blocks cloudflareinsights.com, the site works exactly the same.

Separately, our own server keeps daily totals of views of our public pages (the home page, guides, calculators and quote pages, with all car model pages counted together), each with a coarse label for where the visit came from: another of our pages, the name of the referring site (for example a search engine), or “direct”. It stores the date, the page, that label and a count, and nothing else: no cookie, IP address, browser details or identifier. Known automated visitors are not counted. We also keep daily counts of how often the quote tools are used (for example, how many quotes were uploaded on a day). These counts are not linked to any account.

The browser extension

The Lane Check extension for Chrome shows our complaint signal on used-car listings at Cars.com, Autotrader, CarGurus and Craigslist. It is built so that we do not learn what you look at.

• Listings are matched on your computer. The extension reads the year, make, model and any displayed VIN from the listing you have open and compares them, inside your browser, with a public list of model-year scores. The listing, its address and its VIN are not sent to us or to anyone else.
• The only thing it downloads is that public list, one file from thelanecheck.com, at most once a day. It is the same file for everyone and carries no identifier. Cloudflare sees your IP address in order to deliver it, as with any page on this site.
• It stores that list in the browser’s extension storage, and nothing else. It has no account, no cookie and no analytics, and it does not read pages on any other website.
• A VIN reaches us only if you click “Check this VIN”, which opens this site with that VIN, exactly as if you had typed it. The links on the card also tell us that the visit came from the extension and from which listing site, not which listing.

The history-report link

Car pages and reports carry a link to EpicVIN, a vehicle-history-report company, for accidents, title brands and odometer records on an individual car. We take part in EpicVIN’s affiliate program and may earn a commission if you buy through that link; it does not change anything we report. The link goes through our own address first, where we count the click (the time, which page it came from and which model-year page, with no VIN, no account and no IP address) and then send you on. From a report, the link passes that car’s VIN to EpicVIN so its page opens on the right car. What happens on EpicVIN’s site, including any purchase, is governed by EpicVIN’s own terms and privacy policy.

Who else is involved

• Cloudflare — hosts the site, the API and the database, and processes connection information such as your IP address in order to deliver it and to rate-limit abuse. We store a hashed form of your IP address in short-lived rate-limiting counters, and alongside a report run before signing in (described above). Cloudflare also provides our cookie-free page-view statistics, described above.
• NHTSA — receives the vehicle you look up. Public US government API.
• Stripe — payments.
• Resend — delivers sign-in emails.
• Anthropic — reads uploaded dealer quotes and writes their explanation, only when you use Explain My Dealer Quote (see above).

What we never do

• We do not sell, rent or share your email address or your search history with anyone.
• We do not run advertising or behavioral profiling, and our page-view statistics carry no cookie or identifier that follows you between pages, visits or websites.
• We do not use your data to train anything.
• We do not tell a manufacturer, auction or dealer which vehicles you looked at.

How long we keep it

• Sign-in codes — ten minutes, then dead; the row is cleared on use.
• Sessions — 30 days, or immediately when you sign out.
• Rate-limiting counters — under a day.
• Uploaded quote documents — not kept at all. Figures, reports and comparisons from them — 30 days, or until you delete them on the page. Reply drafts — not kept.
• Account, report history and pass — until you ask us to delete it. We remove accounts that have been inactive for two years.
• Reports run before signing in, with their hashed cookie value and hashed IP address — kept with our other report records. We cannot tell who ran them, so to have yours deleted, email us roughly when you ran it and for which vehicle.

Your choices

Email support@thelanecheck.com from the address on the account and we will, within 30 days:

• send you a copy of everything we hold about you;
• correct anything that is wrong;
• delete your account and its history. Deleting it ends any pass that is still running.

Depending on where you live you may have these rights under law (for example the GDPR or the CCPA). We apply them to everyone regardless. We do not sell personal information as those laws define it. Our lawful basis for holding your email address and report count is performance of the contract you enter into when you use the service.

Children

This is a tool for adults buying a used car. It is not directed at children and we do not knowingly collect data from anyone under 18.

Where your data is

The database is hosted by Cloudflare in the United States. If you use the service from outside the United States, your information is transferred there.

Security

Sign-in codes and session tokens are stored only as one-way hashes. Everything is served over HTTPS. Payment card data never reaches us. No system is perfect, and we will tell affected users promptly if we ever become aware of a breach that puts their data at risk.

Changes

If we change this policy in a way that materially affects you, we will email account holders before it takes effect. The date at the top always reflects the current version.

Contact

Questions about this policy: support@thelanecheck.com