Check your VIN

Privacy

What happens when you check a VIN — in plain English.

MyAutoRecalls is a free VIN recall check. This page says plainly what happens when you use it, including the parts most privacy pages leave vague.

What happens when you check a VIN

When you type in a VIN and hit Check, your browser sends it to our recall-check API as part of the request URL — a GET request to /v1/check?vin=…. The API then forwards your VIN to two NHTSA services: the vehicle decoder (which turns the VIN into a year, make, and model) and NHTSA’s VIN-specific recall lookup. That is how the check works — there is no way to look up recalls by VIN without sending the VIN to NHTSA.

The API stores the VIN, the decoded vehicle, and the recall result in a cache for 24 hours, so a repeat check is fast. After 24 hours the entry expires.

What the request URL means

Because the VIN travels in the request URL, it appears in our server-side request logs (Cloudflare, our host) and in that 24-hour cache. That is the tradeoff of using GET, and it was a deliberate choice: the check is a read, not a submission, and GET matches how NHTSA’s own lookup works. The cost is that the VIN is part of a logged request URL instead of a POST body.

What it does not mean: the VIN never appears in your browser’s address bar or browser history — the page URL never changes when you check a VIN. We never put your VIN in a cookie, in localStorage, or in any link we show you.

If you would rather NHTSA be the only party that sees your VIN, check it directly on NHTSA.gov instead. Same data, no MyAutoRecalls in the middle.

What we never do

  • No accounts. There is no sign-up, no login, nothing to create.
  • No cookies. This site does not set any cookies.
  • No trackers. No analytics scripts, no ad pixels, no third-party code watching what you do.
  • No selling or sharing. We do not sell data, share it with advertisers, or use it for anything but answering your check.
  • No linking your VIN to you. We never ask for your name, email, or anything else. We have no way to connect a VIN you checked to a person.

What a VIN is — and isn’t

A VIN identifies a vehicle, not a person. It does not contain your name, address, or anything about you. But it does identify one specific vehicle, so treat it like a license plate: fine to give to a recall lookup, not something to post publicly.

Server logs

Cloudflare, which hosts this site, keeps standard request logs (which pages were requested, when, from which network address). We do not mine them, and we do not sell or share them. The 24-hour VIN cache described above is the only place we deliberately keep VINs, and it expires on its own.

Questions

Anything unclear? Email [email protected]. See also how the data works.