Privacy Policy

Who we are

Car Face Off (carfaceoff.net) is an independent car-comparison voting site. If you have questions about this policy or want to request removal of something you submitted, contact us at andrewjrider@gmail.com.

What we collect

Voting on the main site

Voting doesn't require an account. Each vote is tied to a one-time random ID generated in your browser at the moment you vote, not to a persistent identifier we can trace back to you across visits.

Anonymous usage analytics

We collect basic, first-party usage data: a random session ID (created fresh each browser session and stored only in that tab's session storage, not a cookie), the page path, your browser's user-agent string, how long you were on a page, and whether you voted or skipped. We don't use this to identify you personally, and we don't share it with advertising or analytics networks.

Dream Garage

Dream Garage uses a random anonymous visitor ID stored in your browser to save vehicles and collections without an account. Shared garage links use opaque public tokens and do not reveal that visitor ID. Garage and collection names are optional, length-limited, and should not include personal information.

Accounts

You need a free account to enter a car in the Garage. Voting and Dream Garage never need one. When you create an account, we collect:

• Your email address. We use it to sign you in and to contact you about your account or the cars you entered.
• A display name you choose. It is shown publicly next to cars you enter, so don't use your email address or anything you want kept private.
• Your password, stored only as a salted one-way hash. We can't read it.
• Whether you opted in to email updates, and when.
• Which version of the Terms of Service and this policy you agreed to, and when.
• A hashed version of your IP address at sign-up, used only to limit abuse. It is never stored or shown in plain form.

We don't connect your account to the anonymous analytics session or the Dream Garage visitor ID described above.

Garage submissions

If you enter a vehicle in the Garage, we collect:

• The VIN you provide, which we send to the National Highway Traffic Safety Administration's public vPIC decoding service to look up the year, make, model, trim, and body style. No other data about you is sent to NHTSA.
• One photo you upload. Before it's stored, we automatically strip all EXIF metadata from the file, including GPS location data, camera/device information, and timestamps. The photo is also automatically re-scanned for prohibited content before it can go live.
• An optional one-line caption, if you choose to provide one. Your account's display name is shown with the car.
• A link between the submission and your account, so you can see its status and remove it.
• A hashed version of your IP address, used only to enforce submission rate limits and is never stored or shown in plain form.

Everything in an approved Garage submission — the photo, decoded vehicle details, display name, and caption — is displayed publicly on the site. Your VIN and your email address are never shown publicly. Don't submit a VIN or photo for a vehicle you don't own or don't have permission to feature.

Server logs

Like most hosted websites, our hosting provider's infrastructure may briefly retain standard server logs (including IP addresses) as part of normal operation and security monitoring. We don't use these logs for tracking or profiling.

How we use it

We use the information above to run the voting and ranking features, save anonymous Dream Garages, sign you in to your account, decode and display Garage submissions, moderate content before it's public, prevent abuse (duplicate VINs, submission spam, fake sign-ups), and understand aggregate site usage so we can improve it.

Email from us

We only send news or marketing email if you ticked the optional box when you signed up or turned it on in your account. You can turn it off at any time on your account page. Whatever you choose, we may email you about your account or a car you entered, for example to send a password reset link you asked for or to tell you about a removal.

What we share

We don't sell your information, and we don't give your email address to advertisers or other companies. A few narrow exceptions where data leaves our system:

• NHTSA vPIC — VINs submitted to the Garage are sent to this public U.S. government API to decode vehicle details.
• Content moderation — Garage photos may be automatically screened by a third-party image moderation service (AWS Rekognition) solely to check for prohibited content before anything is approved.
• Advertising (not yet active) — We may enable Google AdSense on this site in the future. If and when that happens, Google may set cookies and collect data to serve and measure ads, governed by Google's own privacy policy, and we'll update this section accordingly. As of this writing, no advertising is running on Car Face Off.

Cookies

Car Face Off does not use tracking or advertising cookies. If you sign in to an account, we set one functional, HttpOnly cookie that keeps you signed in for up to 30 days or until you sign out. It isn't set for visitors who don't sign in and isn't used for tracking. The site's own admin login uses a similar cookie.

Your choices and rights

• Remove a car. Sign in and use Remove under My cars on the Garage page. This takes the car off the site and deletes its photo, VIN, and caption from our records.
• Delete your account. Use Delete account on your account page. This deletes your email address, display name, and password hash, and removes every car you entered, including the photos.
• Change your details or email preference. Use your account page.
• Ask for a copy or a correction. Email andrewjrider@gmail.com from the address on your account.

Votes already cast on a car that is later removed are kept as anonymous totals with nothing identifying the car's owner. If you can't sign in, or you submitted a car before accounts existed, email andrewjrider@gmail.com and we'll remove it promptly.

How long we keep it

We keep your account details and submissions until you remove them or delete your account. Sign-in sessions expire after 30 days.

Children's privacy

Car Face Off is not directed at children under 13, and we don't knowingly collect information from them. Accounts are for people 18 or older.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page. If a change affects how we use account information, we'll also tell members before it takes effect.