Privacy & Cookie Policy
This policy describes what TorqueAndTally collects, why, and what you can turn off. It is written to match what the software actually does.
The short version
Looking up a vehicle needs no account and no cookies beyond the one that remembers your privacy choice. If you decline the optional categories, no Google analytics or advertising code is loaded at all — it is not loaded-but-disabled, it is never fetched. We do keep a server-side log of the searches themselves, described below, because it is how we understand what the service is used for.
Cookies and similar storage
Three categories, one of which you cannot turn off:
You can change any of this at any time through “Privacy choices” in the footer. Withdrawing consent removes the Google scripts, deletes the Google cookies we are able to reach from our own domain, and reloads the page — because a script that has already run cannot be unloaded, and starting over is the only honest way to reach “nothing is running”.
What we record when you allow analytics
Two things, deliberately kept apart so that “what did this person search for” is not answerable even with access to our database:
- Usage events — the type of action, a coarse country if our host can determine one, and your IP address with the final segment replaced by zero (so 203.0.113.47 is stored as 203.0.113.0). This row contains no search text.
- Search term counts — the words you searched, normalised and counted. This table has no IP address, no identifier, and no timestamp linking it to you; it is a tally of how often each vehicle is looked up.
Masking is truncation, not hashing. We say so because a hash of an IP address is reversible by trying the possibilities, and describing it as anonymisation would be a claim we could not support.
The search log, which is not optional
Separately from the above, our server records each search: the text of the query, the approximate city, region and country it came from, the time, and — for 30 days — the full IP address. After 30 days an automated job removes the IP address from those records and leaves the rest intact, so the geographic history remains and the identifier does not.
We are being explicit because this is the one place where a query is joined to something identifying. A question about a particular car suggests what you may drive or be about to buy. That makes these records personal data under the GDPR and the CCPA even though they contain no name, and we would rather say so than describe it as anonymous.
This is not covered by the cookie choices above, because it is not storage on your device — it is processing on our server, and we rely on our legitimate interest in understanding and operating the service. You can object to it using the contact details below.
Location
Approximate location is worked out on our own server, either from a header our network adds or from a local geographic database file. We do not call a third-party geolocation service, because that would mean handing your IP address to another company in order to answer a question about our own traffic.
Where the vehicle data comes from
Fuel economy figures come from the EPA and the Department of Energy; owner complaints come from the National Highway Traffic Safety Administration. We request those from our own server, so those agencies never receive your IP address or see that you specifically looked something up.
Complaints are unverified reports filed by members of the public. They are not findings against a manufacturer, they are not a safety rating, and TorqueAndTally does not tell you whether a vehicle is safe to drive.
Advertising
If you allow advertising, Google AdSense and its partners may set cookies and use them to select and measure ads. We never send your query text to Google or to any advertising or analytics provider. Where information does go to Google, its use is governed by Google’s own policies, and you can review and adjust that at Google My Ad Center.
California residents: we do not sell your personal information for money, and never have. But allowing advertising lets Google use cookies to personalise ads across other sites, and the CCPA as amended by the CPRA treats that as sharing for cross-context behavioural advertising. Turning the advertising category off — from the banner, or from the Do Not Sell or Share My Personal Information link in the footer of any page — stops it. That control is the opt-out itself, not a request form: nothing is loaded while it is off.
What we never do
- We do not sell personal information for money.
- We do not ask you to create an account, and we do not want your name.
- We do not send your search text to Google, to an advertiser, or to any analytics provider.
- We do not attempt to identify individual visitors, and we do not build profiles.
Your rights
Depending on where you live, you may have the right to see what we hold about you, ask us to delete it, object to processing, or complain to a regulator. Everyone gets the same controls here regardless of where they are.
In practice the honest position is this: outside the 30-day window of the search log, we hold nothing that can be traced back to you, so there is usually nothing to retrieve or delete. Within that window, contact us with the approximate time of your visit and we will locate and remove the records.
Contact
Not yet published. A contact address must be set inconfig.yamlunder site.contact_email before this site goes live — the rights described above need a route to exercise them.