Privacy Policy

1. The short version

• We never sell your Personal Information as the CCPA/CPRA defines “sell”, and we never share it for cross-context behavioural advertising. There are no ad networks, no social pixels and no third-party analytics on this site.
• We do record what happens on the site — searches performed, listings viewed, saves, alerts, forum activity, page views and how long a page was in view, in rounded steps — into an append-only log where each actor is a salted one-way hash rather than a name. How long you spend never chooses what you are shown.
• We use that log to run and improve the product, to fight abuse, to train our own internal models, and to produce aggregated, de-identified statistics that we publish as research and license to businesses such as dealers, lenders, insurers and manufacturers.
• We commit not to re-identify De-identified Data, to keep the technical controls that make it de-identified, and to bind every recipient to the same commitment by contract.
• There is a list of things we never write down — your search text, your IP address, your user agent, your email inside an event — and it is in section 5.
• You can correct your Personal Information or delete your account by emailing [email protected]. If the law where you live gives you a right to a copy of your Personal Information, you can request it the same way (section 12).
• If your signed-in home or your For You page is personalised, it is built from what you asked for — models you follow, saved searches, your watchlist, your picks, what you hid — and from what you looked at only if you switch that on. Every card says why it is there, you can turn it off at any time, and search is never personalised (sections 7 and 9).
• We may build new things from what we learn — new products, AI models and data products — using De-identified Data, and a business that takes over Throttle may do the same. That never changes the first promise above.
• When this policy changes, you accept the new version before you keep using your account. Information we collected before is used only as the version in force then allowed, unless you accept a later one.

2. Who and what this covers

This policy covers throttle.toys and the services on it, operated by Throttle Toys and, after any transfer, by a Successor (as defined in the Terms of service). It applies to visitors, account holders, forum participants, dealers who appear in our index, businesses that contact us about data, and anyone who sends us a legal notice or an opt-out request, whether through our forms or by email or post.

It does not cover a dealer's own website once you click through to it, or any other third-party site. Listing content we index from dealer websites is business information about a vehicle, not Personal Information about you.

Capitalised terms such as Personal Information, De-identified Data and Successor mean what section 1.1 of the Terms of service says.

3. What we collect

3.1 What you give us

3.2 What we record automatically

• Behaviour events — the log described in section 4.
• Session records — the signed-in session that keeps you logged in.
• What your signed-in home or your For You page showed you — when your home or your For You page (/for-you) is personalised, which listings and updates it showed — a change to a listing on your watchlist, a live auction or an auction result for a model you follow, a dealer new on Throttle in the area you chose, a forum thread in a category you follow — where and for what reason, kept for 30 days so we do not show you the same listing again and again and can answer “Why am I seeing this?”. It is never part of the behaviour log and never exported.
• Activity for your home, only if you switch it on — with “Use my activity on Throttle” on, which it is not by default, we count on how many different days you opened listings of a category, brand, model and price range, picked a model from the search box's suggestions, ran a search with a category, brand or model set, or opened a recommendation. We keep the counts, not the listings and never the words you typed, for 90 days after the last day counted. Nothing is counted while your browser sends Global Privacy Control or Do Not Track.
• Operational logs — request path, status code and timing, kept for about three days for debugging and abuse prevention. Our web server's log does not record your address, your user agent, the referring page or anything after the ? in a web address, which is where search words go. Rate limiting holds an address in memory for a few minutes and never writes it down. Where we keep an address for an audit trail, for abuse triage on the enterprise waitlist, or as evidence that you accepted our terms, we store a salted hash of it, never the address itself. The salt is a secret held only on our server — without it the hash cannot be worked backwards, which for a 32-bit IPv4 address would otherwise take seconds.
• Coarse technical context — a browser family (for example chrome-desktop), a two-letter country, and the host part of a referring URL. Not the full user agent, not the IP, not the full referrer.
• Anti-abuse signals — rate-limit hits, cooldown state, and an internal trust score used to decide how much automated trust to extend to a dealer submission. The score is described in section 7 and is never shown to other users.
• Your agreement — which versions of the Terms and this policy you accepted, when, and how (at sign-up, at sign-in, or through the API), with a salted hash of your IP address and your browser family. It is our evidence that you agreed. The raw address and user-agent string are not stored.

3.3 What we get from others

• Stripe tells us that a payment succeeded, which plan, and a customer identifier. We never receive your card number.
• Google, if you choose to sign in with it, tells us your email address and name.

3.4 What we deliberately do not collect

• Card numbers, bank details or any payment credential.
• Passwords — sign-in is a magic link or Google, so there is none to leak.
• Advertising identifiers, ad-network cookies or social tracking pixels.
• Your precise location. A ZIP code or a map viewport you use in a search is used for that query and is not stored against your account, and a “near me” position you ask a map for is never stored at all. If you choose to save a home ZIP code, or the town from your profile, in your feed preferences, we keep it and the approximate centre of it — never your device's location — until you remove it. If you choose a US state as the general area for your signed-in home, we keep the state.
• Any special-category or sensitive Personal Information, which we have no use for.

3.5 Your profile, and who can see it

A Throttle account has no public face unless you give it one. If you fill in a profile, your handle, display name, avatar, bio and location can be seen by anyone who reaches it — and only while you have it switched on, which it is not by default. You can switch it off at any time in your account. Your email address, saved searches, watchlist, alerts and billing are never shown to anyone, whatever that setting says.

Two things are published on a different basis, and switching your profile off does not retract them. What you post — threads, replies, votes and vehicle stories — stays public with your handle on it, because other people replied to it; delete an individual post to remove it from public view. What you have looked at is the opposite: your most-viewed machine and your favourite category are worked out from the behaviour log in section 4, never from anything you posted, and they appear on your profile only if you separately switch them on. That one is off by default too.

An avatar you upload is stored and served by us, not by a third party. Camera metadata, including any location recorded by your phone, is removed before the image is stored. Deleting your account deletes your profile and your avatar with it — see section 13.

4. The behaviour log

The part most privacy policies bury. Here it is in full.

Throttle keeps an append-only log of what happens on the site. Each row is one event: a page view, a search, a listing view, a save, an outbound click to a dealer, a forum post, a profile view. The log is how we tell which features earn their keep, how we detect abuse, and — aggregated and de-identified — how we produce market research and train our own models. If you use the For You feed, the log also records that a listing was shown to you and whether you liked or passed it, with its category, brand and price range — never the model you typed, your ZIP code or the listing's title. If your signed-in home is personalised, the log records that a recommendation was seen, opened or dismissed, with its section, its position and a code for the reason it was shown — never which model you follow, a price range, or anything you typed — and nothing in the log is used to choose what your home shows you.

The log also records how long a page was open and in view, in rounded steps (for example, between one and three minutes), never to the second; which kind of page it was — the home, search, a listing, the For You page and so on, never which listing; and whether you left it by opening another page, switching away or closing it. Time is counted only while the page is on screen and in use. We group one browser's rows into visits, a new visit starting after 30 minutes without activity; a visit is worked out when we count, and is never stored as a record of its own. We use it like the rest of the log (section 7), and above all to see, in totals that hold no identifier, whether people find what they came for and come back. How long you spend never chooses what you are shown, on your home, your For You page or anywhere else.

4.1 What a row contains

4.2 How the hashing works

The actor hash is a SHA-256 of a fixed prefix, a secret 32-byte salt and the subject (your user id, or an opaque session id when you are signed out), truncated. The salt lives only in the server environment: it is never committed to source control, never logged, and never included in an export. Without it, an exported partition plus a copy of our user table still does not rejoin — which is what makes these rows de-identified rather than pseudonymous in name only.

4.3 The one place it is not anonymous, and why

When you are signed in, the row also carries your user id. That is deliberate, and it is the honest trade: without it we could not find and erase your rows when you ask us to, and a “de-identified” store we cannot erase from is a worse privacy position than an identified one we can. It is empty for signed-out visitors, and it is the column the erasure path uses.

5. What we never record

A hard list, enforced in code at the point of write.

The following never enter the behaviour log, at any point, by anyone. The rules are enforced by the API that writes events, not by convention:

• A raw IP address. Nothing derived from it survives except a two-letter country.
• A raw user agent. Only a coarse family such as safari-mobile or bot.
• An email address, a name, a phone number, or anything else a person typed about themselves.
• A full referring URL. The host only.
• Your search text. We log the shape of a search — which filters you used, how many results came back, how you sorted — and never the words you typed. The free-text box is where people put their own name, their VIN and occasionally their address, so it is the one field the log refuses.
• Nested objects. Event properties are flat scalars, capped in number, and every key is screened for fragments like email, phone, address, token and vin — a rejected key is a rejected event, not a cleaned one.

6. Cookies and storage

• Session cookie — set only when you sign in. Strictly necessary; without it there is no signed-in state.
• Anonymous browser identifier — an opaque random value our server sets the first time your browser sends us an event, kept for 180 days from then and not renewed. It links the behaviour-log rows that come from one browser, so we can tell one visit from the next and count, in totals, how often people come back — someone who returns a season later included. It carries no Personal Information, cannot be read by scripts on the page, is never used for advertising or shared with anyone, and is not set at all while your browser sends Global Privacy Control or Do Not Track. Clearing your cookies ends it.
• Local preferences — things like a remembered view mode, stored in your browser and never sent anywhere.

There is no consent banner because there is nothing optional to consent to: no advertising cookies, no third-party trackers, no cross-site profiling. If that ever changes, a banner appears first and the default is off.

7. How we use it

About the trust score. It exists to keep automated dealer submissions from becoming a fetch-any-URL service for strangers. It is never displayed to you or to anyone else, is never returned by a public API, and is visible only to administrators and moderators — a visible score is a score to farm, and the moment it is visible it stops measuring anything. It is still data about you: ask and we will tell you your score and the inputs behind it.

8. Selling, sharing and de-identified data

The commitment, in the terms the law uses.

We do not sell your Personal Information as defined by the CCPA/CPRA, and we do not share it for cross-context behavioural advertising. We have never done either, and we have no plan to start. We do not disclose your email address, your name, your handle-to-email mapping, your saved searches, your watchlist or your event rows to a data broker, an advertiser, a dealer or anyone else for money or for anything else of value.

Here, “sell” means what the CCPA says: disclosing Personal Information to a third party for money or anything else of value. “Share” means disclosing it for cross-context behavioural advertising. A transfer to a Successor as part of a sale, merger or reorganisation is not a sale under the CCPA, and the Successor is bound by this policy (section 10).

What we do license is aggregated, de-identified market data. Examples of the shape of it: the median advertised price of a model year in a region and how it moved over a quarter; typical days-on-market by category; how often listings in a segment are discounted and by how much; demand signals expressed as indexed, rounded counts across thousands of visitors. Buyers are businesses — dealers, lenders, insurers, manufacturers and researchers.

We hold ourselves to the CCPA/CPRA de-identification standard, which means all four of:

1. the data cannot reasonably be used to infer information about, or be linked to, a particular person — small cells are suppressed or widened before anything is published or licensed;
2. we publicly commit not to attempt to re-identify De-identified Data, and that commitment is this sentence;
3. we keep the technical controls that make it so — the secret salt, the forbidden-field list in section 5, no raw IPs or user agents, no search text;
4. we contractually bind every recipient to the same no-re-identification obligation, in the Data Licence, and terminate the licence of anyone who breaks it.

If we or a Successor ever wanted to do something that amounted to selling or sharing Personal Information, we would first publish a new version of this policy, ask you to accept it, and give you a way to opt out before anything started. We would never do it for anyone under 16.

9. Your choices, GPC and Do Not Track

• Global Privacy Control and Do Not Track. If your browser sends either signal, we stop recording you: the behaviour log refuses the request before anything is read, parsed or stored, no session cookie is set, and no activity is counted for your signed-in home. We also treat a GPC signal as a valid opt-out of sale and sharing, though there is nothing for it to switch off because we do neither. You do not have to find a setting on our site to repeat what your browser already said. We do not keep a record of the signal itself — refusing the data is the response.
• Email. Every alert email carries a List-Unsubscribe header, so your mail client can offer its own unsubscribe control, and links in its footer to the page where you turn that alert off. Alerts are configured per saved search. We do not send marketing email to people who did not ask for it. Sign-in links and essential service notices are transactional and cannot be switched off while you have an account.
• Your signed-in home and your For You page. Personalised recommendations are on once you accept this version, with an off switch in your account; with it off, your home shows the same kind of listings to you as to everyone and reads nothing about you beyond that switch, and your For You page goes back to the feed built from your feed preferences and your likes, passes and thumbs (section 7), which you can reset or delete in your account. “Use my activity on Throttle” is off unless you turn it on. You can clear the home's history or reset everything it uses, and both keep working even if we switch the feature off.
• Your profile. What you post is public. Your email address never is.
• Activity on your profile, which is off unless you turn it on. Your public profile at /u/your-handle can show two things that are not things you posted: the listing you have viewed most, and the category you look at most. Both are derived from the behaviour log described in section 4, and if you switch them on they are visible to anyone, signed in or not, including search engines. They are off by default. You can turn them on or off at any time in your profile settings, and you always see your own whether they are on or not. Nothing else derived from the behaviour log ever appears on a profile.

10. Who else touches your data

We use a small number of service providers, each bound to use the data only to provide their service to us:

We also disclose information where the law requires it, to respond to a valid legal request, to protect someone's safety, or to enforce our terms. If Throttle, or part of it, is sold, merged, reorganised or otherwise transferred to a new owner that takes control of it — including in a bankruptcy, a rebrand, or a lender enforcing its security — Personal Information may transfer to the Successor as part of the business. In a financing that does not transfer control, investors and lenders may review information only under confidentiality terms, and Personal Information is not transferred to them. The Successor is bound by the promises in this policy for the information it receives, including that it will not sell your Personal Information, until you accept a new version.

If you send us a legal notice (section 3.6), we may share the notice, including your name and contact details, with the dealer whose website it concerns — as is usual with a copyright notice, so they can answer it — with our lawyers, and with a court or authority where the law requires it. If a dealer disputes a copyright notice, we send the sender of that notice the dealer's name, address, phone and statement, so they can decide whether to take it further. Documents you upload are seen only by our administrators and, if a claim needs them, our lawyers.

No ad networks. No analytics vendors. No data brokers. The service providers above are the whole list.

11. How long we keep it

A legal dispute or a legal hold can pause the deletion of a legal notice's record and documents until it ends. Deleting your account does not delete a legal notice you sent us: its record and documents follow the schedule above, because we may need them to answer or defend a claim about the notice.

We keep Personal Information only as long as the purpose it serves in section 7 needs it, as the table sets out, and then delete it or turn it into De-identified Data. De-identified Data is kept indefinitely: it is ours, it is not Personal Information, and it cannot be linked back to you.

12. Your rights

12.1 Everyone

Whatever jurisdiction you are in, email [email protected] and we will correct your Personal Information or delete your account. We answer within 30 days and usually within a day. If the law where you live gives you a right to a copy of your Personal Information, request it by email at the same address and we will provide it within the time the law allows. We may need to confirm you control the account email before acting. Exercising a right never costs you anything and never degrades your service.

Consent never waives these rights. Nothing in the Terms of service — including the licence in section 6 and the data clause in section 13 — limits them, and accepting a new version of either document does not either.

12.2 California (CCPA/CPRA)

• Know what we collect, why, where it came from and who we disclose it to — sections 3 to 10 are that disclosure, and you may request the specific pieces we hold about you.
• Delete — see section 13 for exactly what that reaches.
• Correct inaccurate Personal Information.
• Opt out of sale or sharing — there is nothing to opt out of, because we do neither. There is no “Do Not Sell or Share My Personal Information” link for the same reason, and a GPC signal is honoured regardless.
• Limit the use of sensitive Personal Information — we do not collect any.
• Non-discrimination — we do not charge you more or give you less for exercising a right.
• You may use an authorised agent; we will verify their authority and your identity.

12.3 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the other states with comprehensive privacy laws have similar rights: to access, correct and delete their data, to get a portable copy, and to opt out of sale, targeted advertising, and profiling that has legal or similarly significant effects. We do none of those last three things. We provide access and a portable copy to the residents of those states, on request by email and within the time their laws allow, and we honour correction and deletion for everyone, wherever you live.

12.4 EU / UK (GDPR), where it applies

Access, rectification, erasure, restriction, portability, and objection to processing carried out on the basis of legitimate interests — including profiling. Where we rely on legitimate interests, we have weighed them against your rights and will share that reasoning if you ask. You may also lodge a complaint with your supervisory authority, though we would rather you told us first.

12.5 Appeals

If we refuse a request, we tell you why, and you may appeal by replying to that email. An appeal is read by a person who did not make the original decision.

13. What deletion actually reaches

Deleting your account removes:

• your account record, email address, name, handle and profile;
• your avatar, including the image file itself — it is unlinked from our disk, not merely detached from the account, so the URL it was served at stops resolving;
• your saved listings, saved searches, alert settings and notification history;
• your feed preferences, your likes, passes and thumbs, and what we learned from them;
• your discovery settings, follows, hides and feedback, your activity counts, and the records of what your signed-in home showed you and which listings we alerted you about;
• your sessions;
• the link between you and anything you posted — your posts, replies and stories lose their author and are shown without a name. They stay published, because other people replied to them and that conversation is not ours to erase on one participant's behalf. Delete them individually first if you want them removed from public view;
• the link between your user id and the rows in the behaviour log — the user id is erased from every one of those rows, which is the reason we store it. The de-identified rows themselves remain until their partition is dropped, unlinkable to you or to anyone, including us.

If you ask us to delete your data rather than only close your account, we also delete your rows from the behaviour log itself, not just the user id on them. Ask before you close the account: once the id is erased, nobody, including us, can find those rows again.

Three things it cannot reach, stated plainly rather than buried:

1. Records we must keep — payment and tax records, the record of any legal notice or opt-out you sent us (kept on the schedule in section 11), and anything under a legal hold.
2. Other people's copies — a quote in someone's reply, a screenshot, a search engine's cache.
3. Aggregates and models already derived from a de-identified corpus. A published median, an indexed demand series or a set of trained model weights does not contain a row with your name in it to remove — the statistic is not reducible back to you, which is the same property that makes it de-identified. Your identifiable records go, your content stops being used identifiably, and nothing of yours enters a future export.

14. Security

• HTTPS everywhere, with a strict content-security policy.
• No passwords to steal — sign-in is a magic link or Google.
• Addresses kept for audit trails and terms acceptances are stored hashed, never in the clear; rate limiting never writes one down.
• The events salt lives only in the server environment and is excluded from source control, logs and exports.
• Documents sent with a legal notice are stored privately on our own server, never at a public address, and are opened only by an administrator through a link that works for that administrator for five minutes.
• Encrypted, tested backups, with a documented restore procedure.
• Access to production data is limited to the people who operate the service.

No system is perfect. If you find a vulnerability, email [email protected] — we will acknowledge it, fix it, and credit you if you want. If a breach ever affects your Personal Information, we will tell you and the relevant regulators as the law requires, and we will say what actually happened.

15. Where your data is

Throttle is a US company. Our servers are hosted by Hetzner in the European Union, and some of our providers (Stripe, Resend, Cloudflare, Google) operate globally. That means your information may be processed in the United States, the European Union and elsewhere. Where a transfer out of the EEA or UK needs a safeguard, we rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism through the provider concerned.

16. Children

Throttle is not intended for anyone under 16, and we do not knowingly collect their Personal Information or sell or share it — we do not sell or share anyone's. If we learn that we have collected Personal Information from a child under 13, we delete it — the account, the profile, anything they posted, and their rows in the behaviour log — as the Children's Online Privacy Protection Act requires. If you believe a child has created an account, email us.

17. Changes

When we change this policy, we publish a new version, with a new version number and effective date, shown at the top, and a summary of what changed. If you have an account, we ask you to read and accept the new version the first time you sign in on or after its effective date, and you cannot keep using Throttle with your account until you do. You can always request a copy of your Personal Information where the law gives you that right, cancel a subscription and delete your account without accepting. If you decline, section 23.1 of the Terms of service applies, including its refunds.

Personal Information we collected under an earlier version is used only as that version allowed, unless you have accepted a later one. De-identified Data is not Personal Information, and which version you accepted does not affect it.

If you use Throttle without an account, the version on this page when you visit applies to what we collect during that visit.

We keep every version we publish.

18. Contact

Privacy questions and rights requests: [email protected]

Related: Trust & data · Terms of service · Data Licence · Community Guidelines · ThrottleBot