Privacy Policy

This Privacy Policy is effective as of the date shown in the header above. We may update it from time to time; material changes will trigger a re-acceptance prompt the next time you load the site.

When you sign in with Google, we receive from Google: your email address, your public display name, and (if you have one) your profile picture URL. We never receive or store your Google password. While you use the site we store: VINs you mark as favorites, the timestamp of when you do so, the VINs you visit on the detail page (used for the trending ranking — never tied to your identity in public output), and an audit record of when you accept these legal documents — including the IP address you accepted from, the user agent of your browser, and the language version you saw on screen. We do not use third-party advertising cookies, do not perform cross-site tracking, and do not run any fingerprinting beyond what Vercel Analytics performs by default (which is privacy-preserving and does not require a cookie banner under EU rules).

Information is used to: (a) authenticate you and keep you signed in, (b) sync your favorites across devices, (c) compute the anonymous trending ranking, (d) prove legal acceptance in the event of a dispute, (e) improve the service through aggregate usage analytics, and (f) comply with applicable laws.

To operate the Service we use: Supabase (authentication, database, real-time sync — your data is stored on Supabase infrastructure in the United States); Google OAuth (authentication only — Google's privacy policy applies to that handshake); Vercel (hosting + analytics — privacy-preserving, no cookies); NHTSA vPIC API (public vehicle-decode API — no personal data is sent). We have data processing arrangements in place where required.

Under the Texas Data Privacy and Security Act (DPSA) and similar laws, you have the right to: (a) know what personal information we hold about you, (b) correct inaccurate information, (c) request deletion of your account and associated data, (d) export a copy of your data in a portable format, and (e) opt out of any profiling for decisions producing legal or similarly significant effects (we do not perform such profiling). To exercise any of these rights, sign in to your account and visit /account, or email legal@kbuckgroup.com from the email address associated with your account. We will respond within thirty (30) days as required by Texas DPSA.

Account data (email, profile, favorites) is retained for as long as your account is active. Legal acceptance records are retained for seven (7) years for legal-compliance purposes, even after account deletion. Trending view counts are retained indefinitely in aggregate form (no personal identifiers).

We use industry-standard security practices: TLS 1.2+ on every connection, HSTS preloading, Content Security Policy, Strict-Transport-Security headers, row-level security on the database, and per-user data isolation. No system is perfectly secure; if you suspect unauthorized access, contact legal@kbuckgroup.com immediately.

We may revise this Privacy Policy from time to time. The current version is shown in the header. Material changes will trigger a re-acceptance prompt before you can continue using the site.

Privacy questions, data requests, and complaints: legal@kbuckgroup.com General support: info@kbuckgroup.com Kbuck Group is operated from Texas, United States. Disputes are governed by Texas law and resolved in Harris County, Texas (see Terms of Service).