Privacy

We keep as little as we can. We count visits on our own server, without cookies, except one that says which version of the front page you see while we test a change. We advertise TyreKicker on Facebook and Instagram, so a few of our pages also run Meta's pixel to see which of those ads bring people who make an account (see Meta's pixel below). We also advertise on Reddit: if one of those ads brings you and you make an account, our server tells Reddit (see Reddit below). We never sell your details.

What we keep

• Your account: your email address, your name if Google or Apple sends it, the account ID Google or Apple gives us so we know it's you next time, and when you joined and last visited. If you came to us from one of our ads, from a link with a tag (such as ?ref=) or from a link on another website or app, which one (for a website, only its name, such as reddit.com, never the page): your browser keeps that in a small cookie of ours for up to 7 days, and we note it on your account if you make one, so we can tell which ads and sites bring people. If you use a password, we keep only a scrypt hash of it (a one-way scramble), so we can never read it, and when you last changed it. If you make an account with a password and never confirm your email, we close the account after 7 days but keep the email address it was made with.
• Your searches: what you typed, the postcode, what we understood and the report, until you delete your account (reports stay at their links). We remember the postcode you last used so the form can fill it in. A search you type before signing in, or one you can't start yet (while you confirm your email, add a code or buy searches), is also kept for an hour (never with a code), so it isn't lost if you sign in or confirm in another browser.
• Car checks: if you check one advert on the front page, we keep which advert it was and what the check found for 30 days, not linked to you or your account (to limit how many checks one connection can run, we count them by IP address for a day).
• On the computer that runs the searches: its own copy of each search (what you typed and the postcode), kept until we clear it out, and a note of where each postcode is, for 90 days.
• Searches and codes you buy: for each purchase, which pack, the price, when you bought it, whether it was for friends, whether it was paid, refunded or disputed, and Stripe's references for the payment and its payment page. We keep these for seven years, because UK tax rules ask us to keep sales records for six years after the end of the financial year, and that includes after you delete your account (then they no longer lead to your email address here). We never see or keep your card details.
• Full history checks: for each one you buy, the car's registration, the advert as it was in your report, and what came back from our data supplier (the car's records: theft, finance, write-offs, keepers, logbook dates, mileage, MOT, tax, value and specs), for a year after the check, then deleted, or sooner if you delete your account. We keep only the last 5 characters of the car's VIN, and never its engine number or any finance agreement number.
• Your feedback: any thumbs up or down and any ideas you send us, for a year. A vote also keeps a scrambled form of the IP address it came from, so it counts once.
• Your notes on your report's cars: if you mark a car To call, Called, Viewing or Sold / ruled out, we keep that mark for a year after you last change it, or until you delete your account. Only you see it, never anyone you share the report with.
• Your free search: a scrambled fingerprint of your email address and, if you sign in with Google or Apple, of that Google or Apple account (made with a secret key, so it can't be turned back into the address or account), kept even after you delete your account, so each inbox and each Google or Apple account gets one free search only once.
• Security records: the IP address of sign-ins, new accounts, password changes, requests for password links, code use, payment pages opened, account deletions and failed attempts, for up to 90 days, and the browser of each sign-in while it lasts (up to 30 days). Our web server also logs the IP address, browser and page of every request, for up to 30 days.
• Visits: each day's visitors get a scrambled id, made from the IP address and browser with a key we keep only in memory and throw away that night. We keep those ids with the steps each one reached (such as signing in or opening a report), and daily totals such as pages viewed, devices, browsers and the sites or ?ref= tags that sent people, for 60 days.
• Front-page test: while we try out a small change to the front page, your browser keeps a cookie of ours for up to 30 days that says only which of the two versions you see (none if you're signed in or your browser sends Global Privacy Control: we delete it then), and if you make an account we note that version on it, so we can tell which one works better. We delete that note from every account once the test is over and we've read the results.
• Admin notes: if we add searches to your account, disable or re-enable it, or lift a pause on it, a note of that with your email address, for a year.
• Emails and backups: copies of the emails we send you, for 30 days (90 if one can't be delivered; for emails with codes for friends, we delete the codes from our copy as soon as it's sent or we stop trying to send it, though a backup taken before then can still hold them until that backup is deleted), the last 7 nightly backups of the site's data, and a copy taken just before each update of the site, deleted after 7 days.

Who else sees what

We send your postcode to the car ad site we search, so it can search around it, and to postcodes.io to find where it is. Neither gets your name or email address.

To understand your description and judge the adverts, we send them to an AI model. It never gets your email address.

When you buy searches or codes, Stripe takes the payment on its own secure page, by card, Apple Pay or Google Pay. Your card details go to Stripe (through Apple or Google if you use their wallets), never to us. We send Stripe your account's email address so it can email you a receipt, plus the pack and price; Stripe keeps its own records of the payment under its privacy policy.

When the box for buying searches is on your screen on My searches (or on the page where you check a search, when you have none left), we load Stripe's own code from js.stripe.com to show Apple Pay and Google Pay buttons if your device has them. From then on, on that page, Stripe's code can set its own cookies and look at your browser and device to help stop fraud, under Stripe's privacy policy. It never runs on our other pages, and your card details still go only to Stripe.

Meta's pixel: on our front page, About, the example report, My searches and the page where you check a search (never on a report, an emailed link, the sign-in pages or a page whose address holds a private link, such as a car check's), we load Meta's code from connect.facebook.net. It tells Meta (Facebook and Instagram) that the page was viewed, with its address, your browser and your IP address, and Meta's code can set its own cookies (_fbp, and _fbc if you came from one of our ads) so Meta can link the visit to an ad you saw or tapped. When you make an account, the next of those pages you open also tells Meta that an account was made and, if your email address is already confirmed (as it is when you sign in with Google or Apple), a scrambled form of it (a SHA-256 hash) that Meta can match to a Meta account; until then we keep a note of when the account was made, for a day at most. Meta uses this to measure our ads and to show them to people likely to find TyreKicker useful, under Meta's privacy policy. Meta never gets what you search for or your postcode. If your browser sends Global Privacy Control, or blocks Meta's code, none of this happens.

Reddit: if you come to us from one of our Reddit ads and make an account within a week, our server tells Reddit once your email address is confirmed (straight away when you sign in with Google or Apple): that an account was made and when, the click number Reddit adds to the ad's link (rdt_cid, which your browser keeps in a small cookie of ours, tk_rdt, for up to 7 days), a scrambled form of your email address (a SHA-256 hash) that Reddit can match to a Reddit account, and the IP address and browser you made the account with. We keep those last two only until then, at most 8 days, and send it once. Reddit uses this to measure our ads and to show them to people likely to find TyreKicker useful, under Reddit's privacy policy. Reddit never gets your name, your postcode or what you search for, and no Reddit code runs on our pages. If your browser sends Global Privacy Control, none of this happens.

When you buy a full history check, we send the car's registration (never your details) to our data supplier, CheckCarDetails, which looks up its records (including the DVLA's and the DVSA's). Stripe takes the payment the same way as for searches and emails you its receipt. We don't email you the result: it's on the check's page and on My searches.

Reports show the nearest town, the distances, a summary of what you asked for and, for train-town searches, your nearest station, never your postcode or email address. Anyone with a report's link can open it, and apps you paste the link into (WhatsApp, Facebook, X and others) show a preview with that summary and the area.

Deleting your account

You can delete your account at any time from My searches. That removes your email address, your password and your sign-ins, takes your email address out of our records and wipes the wording and postcode of your searches from the site. Reports stay at their links. Records of codes you bought stay for accounting (see above), without your email address, and so does the fingerprint that your inbox has had its free search. Security records, email copies and backups go on the schedule above. Deleting your account doesn't reach the computer that runs the searches: email us and we'll delete its copies of your searches.

Check the car yourself

Our reports are a head start, not a guarantee. Adverts can be wrong or out of date. Before you pay, always see the car in person and check the V5C logbook matches the seller and the car.

Data we use

We read online car ads and Facebook Marketplace adverts. MOT histories come from the DVSA, and postcode locations from postcodes.io, which uses the ONS Postcode Directory. For train-town searches, journey times come from Network Rail's open timetable data, station locations from NaPTAN and station usage figures (to pick the bigger towns) from the Office of Rail and Road.

Contains public sector information licensed under the Open Government Licence v3.0. Contains OS data © Crown copyright and database right. Contains Royal Mail data © Royal Mail copyright and database right. Source: Office for National Statistics, licensed under the Open Government Licence v3.0. Train times: timetable information of Network Rail Infrastructure Limited, used under that licence.

Questions? Email mail at tyrekicker dot uk.