Privacy, and what happens to your ID

What is collected

An email address, because an account is a magic link sent to one. A display name you type yourself, which other signed-in members see; visitors who are not signed in never see it. A phone number, when one is given, because one account per phone is a fraud control. The metro area an account belongs to.

For a seller: the car, its VIN, its mileage, its price, its ZIP code, the photographs uploaded of it, the text written about it, and the dates it went live and was renewed. For a buyer: saved searches and the alerts asked for. For anyone who reports a listing: the reason, the detail written, and an email address if one is left.

The name other people see is one you type yourself, once, before your first message, and can change at any time on your account page. It is never taken from your ID check and never from your email address. It is shown in messages, on reviews and on your public page. Names that pretend to be KowskiCars or its staff, and offensive names, are refused.

For anyone who uses messages or reviews: the messages written, and the reviews and replies left after a sale. The section on messages and reviews below says exactly what happens to them.

For anyone who buys something from us: Stripe handles the payment and we keep the record of what was bought and whether it was paid. Card numbers never reach KowskiCars.

What is never collected

There is no column and no storage bucket in this product that can hold an ID image, a selfie, a document number or a biometric template. There is no IP address column in any table. There is no advertising pixel, no third party analytics script and no tracking cookie on this site.

A car sale here is cash between two people. KowskiCars is not an escrow agent, a broker, a lender or a dealer, holds no funds, and so collects no bank details of any kind.

What we count

Our own server counts five things, in our own database: a visit to one of two landing pages, a saved search being created, an ID check passing, a listing going live, and a purchase from us. A visit records which page, the campaign tags in its address, and whether an ad click id was present, but not the id itself. None of the five records an email address, a phone number, an IP address or a browser fingerprint. An ID check, a listing, and a purchase made while signed in are tied to that account.

Nothing here is sent to an advertising network or an analytics company, and no cookie is set on a visitor to do it. The only cookie involved is one KowskiCars staff set on their own browsers, so that their testing is left out of the counts.

Where the site thinks you are

Every page arrives over a network connection, and that connection carries an approximate location that our host, Vercel, works out from the public IP address the request came from. We read the city, the state and a rough pair of coordinates from it, use them to fill in the ZIP box for you and to say whether KowskiCars covers your area yet, and then let them go at the end of the request. None of it is written to the database.

This is not precise location. On a good day it is right to a city. On a bad day a VPN, an office network or a phone carrier routing through another state produces a confident answer that has nothing to do with where you are standing. That is the whole reason it only ever fills in a field you can type over. A ZIP you enter yourself, or one already in the address bar, wins every time and is never replaced by a guess on a later page.

The IP address itself is not stored, not logged by us, and not attached to a saved search, a listing or an account.

KowskiCars only asks your browser for your location when you press the “Use my location” button on the public meeting places page, and nowhere else. No page asks when it loads. If you press it, your browser shows its own permission prompt first, and declining it changes nothing: the ZIP box on that page works the same.

If you allow it, the position is rounded to about a kilometre and used inside your browser to sort the list of nearby places. It is not sent to KowskiCars, not put in the address bar, not stored in a cookie or on your device, and not attached to anything. Nothing is read from GPS, wifi or the device at any other moment.

The meeting places list and the VSD 703 form

A ZIP code typed into the meeting places page goes into the address bar of that page and is used to work out the list, and is not stored. Each place has a Map link; following it opens Google Maps with that place's published address, never your ZIP or your location.

The Seller's Report of Sale (Illinois form VSD 703) is filled in inside your browser. The names, addresses, date and car details typed into it are not sent to KowskiCars and are not stored, and the finished PDF exists only on your device. When the page is opened from a listing, the car's year, make and VIN are copied from that public listing.

Messages and reviews

Messages between a buyer and a seller are text only. They are stored by KowskiCars in our database so that both people can read the conversation, and so that a review can be tied to a real sale. No photo, file or attachment can be sent, and your email address and phone number are not shown to the other person.

Every message is scanned automatically before it is delivered, by our own software on our own servers, for patterns common in car-sale scams: requests for gift cards, a deposit to hold a car, a shipping or escrow agent, an overpayment, a verification code, payment apps, and a phone number or email in the first few messages. No outside company reads your messages for this. A match either shows the other person a short note next to the message, or holds the message until a person at KowskiCars has read it. The scan and the note are the same for everyone and are never a paid feature.

Who can read a conversation: the two people in it. KowskiCars staff read a conversation only when it has been reported, when a message has been held by the scan, or when the law requires it.

How long it is kept: message text is deleted 12 months after a conversation goes quiet. A conversation that was reported, or that led to a sale both people confirmed, is kept longer, because it is the record behind a moderation decision or a public review. Deleting your account deletes your messages with it.

New-message email: when a message arrives we may send an email saying you have a new message about a named car, with a link. It never contains the message itself. It is sent through Resend, which receives your email address, the name of the car and the link, and nothing else.

Reviews can only be written after a sale that both people confirmed, following a conversation here. They are public, to anyone, under the name you chose, on your page and on your listings. A review text that contains contact details or an accusation of a crime is read by a person before it goes up. A review is removed only under a published rule, never for being negative, and every removal is recorded with the rule it broke.

Screenshots uploaded to the listing importer

A seller listing a car can upload a screenshot of their own existing listing on another site, and we read the text out of it so the listing form arrives mostly filled in. The reading is done by Google Cloud Vision, a Google LLC service, which means the image bytes of that screenshot leave our servers and reach Google.

It happens only when a seller deliberately picks a file and uploads it on that one screen. No other page on this site sends anything to Google, the photographs of the car itself are not sent there, and nothing goes automatically or in the background.

What Google publishes about the image is the only thing we can honestly report, so here it is. Google states that it does not use the content you send to train or improve its Cloud Vision features, that the stored image is "typically deleted right after the processing is done, with a failsafe Time to live (TTL) of a few hours", and that it "temporarily logs some metadata about your Vision API requests (such as the time the request was received and the size of the request)". Google does not publish how long that metadata is kept, so we do not know and do not claim to. Their statement is at cloud.google.com/vision/docs/data-usage.

Nothing biometric happens here. Vision is asked to read text and nothing else, the screenshot is never matched against a face or a person, and this has no connection to the identity check described next. Different vendor, different purpose, and neither one ever sees the other's data.

Listing reminders, sponsored cars and seller tools

A listing is asked about after 30 days: we email the seller to ask whether the car is still for sale, with a link to renew it. A listing nobody renews comes down at 45 days and can be put back up for a while after that. We keep a record that a reminder went out (which listing, which kind of reminder, and when), not a copy of the email. These emails are sent through Resend, an email delivery service, which receives the seller's email address and the text of the reminder.

A seller can pay for a car to be shown as Sponsoredin up to three marked places at the top of search results, above whichever order the buyer picked. Which car appears is worked out from how closely it matches the search, never from who is searching. To show the seller that they got what they paid for, we count each time a sponsored car is shown or tapped: the car, the place it appeared in, how closely it matched, up to three short reasons, and a scrambled fingerprint of the search filters. We do not record who searched: no account, no IP address, no device or browser identifier, no cookie and no ZIP. The browser type is looked at during a tap only to leave out robots, and is not stored. The individual counts are deleted after 90 days, and only daily totals are kept. A seller sees totals for their own car and nothing about any buyer.

When a seller types a VIN, it is sent to the free public decoder run by the National Highway Traffic Safety Administration (NHTSA), a US government agency, to fill in the year, make, model and other factory details. Only the VIN is sent, nothing about the seller, and the decoded result is kept against that VIN so the same car is not looked up twice.

A seller who asks KowskiCars to set a listing up for them sends us the car's details and photos, and our staff prepare a draft. The draft is never public and holds no name, email address or phone number. It becomes a listing only when the seller claims it into their own ID-checked account and publishes it themselves.

Sellers whose first car went live early, on or before 2026-12-31 or before Chicago reached 150 live listings, carry a public founding seller badge on their listings. It is worked out from listing dates and nothing else. The cross-post helper copies text to your own clipboard and opens the other site's listing form in a new tab: KowskiCars posts nothing there and sends it nothing.

A seller who buys a Seller Kit gets a code for a CarBluff Seller Pass, shown on the page and emailed through Resend. The listing itself is not sent to CarBluff; the seller enters their car on carbluff.com if they choose to use the code.

A person at KowskiCars looks at a listing before it goes live when the same seller has put up several cars in a year, when its VIN is already on another person's live listing, or when several accounts list from the same ZIP code. This keeps the site to private sellers. The seller sees the outcome on their listing, and every decision is recorded.

The ID check, in full

Listing a car or sending a message takes a one-time photo ID and selfie check. Browsing and searching never need it.

The check is performed by Didit, our identity verification provider, on Didit's own hosted pages. You are sent there, you photograph your government ID, you take a live selfie, and you come back. Didit creates a scan of your face geometry from the selfie and from the photograph on the ID and compares them. A scan of face geometry is a biometric identifier under the Illinois Biometric Information Privacy Act, 740 ILCS 14.

Those images and that scan never touch a KowskiCars server. We do not embed Didit's capture in our pages, we do not proxy the upload, and we do not log the vendor's response body. What comes back to us is four facts: whether you passed, a reference number for the check, the ISO country code of whoever issued the document, and your year of birth. None of those four is shown to the person on the other side of a sale.

Before any of it happens you are shown a written notice naming Didit, the purpose, and the length of term, and you tick a box that is not pre-ticked. That tick is your written release under 740 ILCS 14/15(b), and the exact words you were shown, their version, and the date and time are recorded. You can see them again on your account at any time by starting the flow, and nothing is sent to Didit until the box is ticked.

Retention and destruction schedule

This is the written schedule 740 ILCS 14/15(a) requires, published here so that it is available to the public without an account.

Your ID images and your selfie

Held by Didit, never by KowskiCars. Destroyed one month after the check. KowskiCars does not receive a copy and has no way to retain one.

The scan of your face geometry

Created by Didit from those two images, used once to compare them, and destroyed on the same one monthschedule. Keeping a biometric template past a session is an opt-in setting on Didit's side. KowskiCars has never enabled it and will not.

The four facts we keep

Pass or fail, the reference number, the issuing country and your year of birth. None of these is a biometric identifier or biometric information. They are kept while your account exists and are destroyed with it.

Your consent record

The exact words you signed, a hash of those words, the version string and the timestamp. It carries no image, no template, no IP address and no browser fingerprint. It is kept while your account exists and is destroyed with it.

The outer limit, whatever else is true

No biometric identifier and no biometric information is retained past the earlier of the point the purpose for collecting it is satisfied or 3 years after your last interaction with KowskiCars.

Destruction on the KowskiCars side is executed by deleting the account, which removes every row above by cascade. Destruction on the Didit side is executed by Didit under the retention period configured for this application. A request to destroy either, or to ask which is currently held, goes to help@kowskicars.com.

Selling, disclosure and profit

KowskiCars does not sell, lease, trade or otherwise profit from a biometric identifier or biometric information, and neither does any paid product on this site depend on one.

Biometric data is not disclosed, redisclosed or disseminated by KowskiCars, which is straightforward given that we never hold any. If that ever changed, the only route open to us would be your consent: the financial transaction exception in 740 ILCS 14/15(d)(2) is one this product structurally cannot use, because we never touch money in a car sale.

Who else touches your data

Six companies and one government agency, and no others. Didit performs the identity check. Supabase hosts the database and the photo storage. Vercel hosts and serves the site, and works out the approximate city described above. Stripe processes payments for the things we sell, which are never a car. Google reads the text out of a screenshot a seller chooses to upload, and is reached at no other moment. Resend sends the listing reminder, Seller Kit and new-message emails, and never receives the text of a message. NHTSA decodes a VIN a seller types, and receives only that VIN.

Each of them acts on our instructions for the purposes described on this page. There is no data broker, no advertising network and no analytics vendor in that list. Sponsored cars are sold by KowskiCars directly to sellers, and no advertising company is involved.

Your choices

The ID check is not compulsory. Browsing and searching every car here works without an account at all. Declining the check closes listing and messaging and closes nothing else.

A request to see what is held about you, to correct it, or to delete your account and everything attached to it goes to help@kowskicars.com. Deleting the account removes the listings, the photos, the saved searches, the messages, the verification result and the consent record.

Changes to this policy

A changed policy gets a new version number and a new effective date at the top of this page. A change to the words of the biometric consent gets a new version string of its own, and the record of what each person signed keeps pointing at the words that person actually saw.

Contacting us about this

Everything on this page reaches a person at help@kowskicars.com. Illinois law governs this policy. There is more on the contact page and in the terms.