Privacy
The calculator needs no account or contact details. Optional saves, report requests and sign-in are separate choices. If you ask for a buying report, the contact details and plan needed to create and send it are handled separately and are never sent to a dealer, lender or insurer without a new request from you.
Last reviewed 20 September 2026.
The short version
- Your complete verdict is available without giving us contact details.
- If you request a report, we use your email and buying-plan answers to create, store and send that report. Contact information comes last.
- Saving on this device needs no account. Private sign-in, when available, is optional.
- Optional analytics starts only if you allow it. It uses random browser identifiers to connect campaign visits and actions; declining does not affect the calculator. Private sign-in uses essential security and session cookies.
- We keep an anonymous count of the ranges people ask about, for example that somebody earning between $70,000 and $80,000 looked at cars between $20,000 and $25,000. Never the figures you typed.
- A report request is not permission to market to you or to share your information with a dealer, lender or insurer.
Plans and tools on your device
Your saved cost snapshot, car shortlist and vehicle ownership checklist are stored in this browser. They are not sent to CarVerdict by saving them on this device. The snapshot excludes income, debt and contact details. The checklist stores the selected vehicle, odometer, service-history choice and checked items. Other people using this browser may see them.
You can remove a saved snapshot or shortlist entry using its remove control. Clearing this site's browser data removes all device saves. A printed or downloaded copy is under your control.
Quote screenshots are read on your device. The reading software and English language data are downloaded from CarVerdict when you select an image; the image and recognized text are not uploaded for recognition. Only numbers you review and apply enter the calculator scenario.
The optional household check keeps its detailed income and spending inputs only while that screen is open. Closing it clears those inputs. Choosing its monthly target carries forward the target alone.
Optional private plans across devices
When this service is enabled, you can request a sign-in link and explicitly save a private plan. Your email is used to send that link; saving is not permission for marketing or a partner introduction. Unlike a public car-only link, a private plan retains the full calculator scenario you chose to save, which may include income, debt and quoted costs.
Plan contents are encrypted before storage in our Canadian database. A keyed email code identifies your private library without storing the email address in the plan tables. Sign-in links expire after 15 minutes, work once, and must be opened in the browser that requested them. Request a new link on each device you want to use.
A signed-in session lasts up to seven days. You can sign out or remove any saved plan from the library. Plans expire after 180 days. Expired links, sessions and plans become inaccessible immediately and are removed at the next daily cleanup; abuse counters expire after two days and are removed at the next daily cleanup. Inactive account codes are removed after 180 days once no plans or sessions remain.
The saved snapshot keeps its original date and assumptions. Opening it in the calculator recalculates using the current assumptions. The original snapshot remains available until removed or expired.
The buying report you request
After you have seen the full verdict, you can ask CarVerdict to email a detailed buying report. The form reuses the car, year, price, city, term and other answers already in your scenario. It asks only for missing buying preferences, your first name and your email address. A mobile number is optional.
We use those details for the one-time report you requested. The shareable report itself leaves out your name, email, phone number, exact income, debt and self-reported credit answer, so it is safer to print or take to a dealership. Its private link expires after six months.
In a local approval build without report delivery configured, the form creates only a clearly labelled preview link: no email is sent and no lead is stored. The page never reports an email as sent unless the mail service has accepted it.
When delivery is enabled, we also create a non-reversible code from the request's IP address. The raw address is discarded immediately; only the keyed code is kept with the encrypted request so we can limit automated report and email abuse. It is used for no other purpose and is deleted with the report record after 180 days.
What we do not do with a report request
We do not ask for a date of birth, Social Insurance Number, bank account, driver's licence or credit-bureau login. We run no credit check and talk to no credit bureau. Your credit answer remains your own estimate.
We do not send the request or report to a dealer, lender, insurer or data broker. If CarVerdict later offers an introduction, that requires a separate choice naming the business and the contact method. Asking for your own report is not that choice.
What we do record
When the calculator produces a result, we record one row that looks like this, and this is the whole row:
- the time, and which page you were on;
- what happened: the page was viewed, a result was rendered, an input was changed, one of the buttons under the verdict was tapped, or a buying report was requested;
- if you tapped one of those buttons, which one it was, described only as “financing”, “insurance”, “credit score”, “report” or “embed”. That row carries which button and the verdict you were reading, and nothing else: no income, no price, no city and no car;
- the province, which today is always Ontario, and the city you picked;
- your income as a $10,000 band, so $74,500 is recorded as “70-80k”;
- the price you were looking at as a $5,000 band, so $23,140 is recorded as “20-25k”;
- the credit range you chose, the verdict the calculator gave, the loan term in months, whether you were buying from a dealer or privately, and whether the car was electric;
- if you picked a car from the calculator's Canadian vehicle catalogue, its make and model, for example “Toyota” and “Corolla”;
- a per-day code that lets two of these rows be recognised as the same visit, described in the next section.
That is the entire anonymous analytics table. There is no column for an exact dollar amount, email address, phone number, note or comment. If you separately request a report, that request is kept in a different, encrypted record for the report service described above.
Why record even that? Because nobody publishes what Ontario drivers can actually afford, and the honest version of that number can only come from people using a calculator. The bands are wide enough to answer that question and far too wide to say anything about you.
How we tell one visit from another
If you load the calculator and then change the loan term a minute later, we would like to count that as one person rather than two. The usual ways to do that are a cookie or a stored device identifier, and both mean carrying something around that identifies you.
Instead, when a row is written our server takes three things: a secret that changes at midnight, your IP address, and your browser’s user agent string. It runs them through a one-way function and keeps only the 64-character result. The address and the user agent are dropped in the same instant. They are never stored, never logged and never sent anywhere.
Because the analytics secret changes every day, the same person tomorrow produces a completely different analytics code. Nothing in the anonymous calculator table links one day to the next. That means we genuinely cannot tell whether you came back through those rows, in this separate aggregate dataset. Optional analytics, described below, can recognize a consenting browser for up to 30 days. The separate report-abuse code is described above and exists only when you request an email.
Optional campaign and journey analytics
With optional analytics permission, we also measure public-page loading time, interaction response time and layout movement, and count broad error categories. These records contain numeric measurements, a random page and session identifier, a page category, screen-size category and release identifier. We do not collect error messages, stack traces, page addresses, form contents or financial answers. Diagnostics stay in our Canadian database and are scheduled for deletion after 90 days. Private pages are excluded.
If you choose to answer the optional usefulness question after a buying plan, we collect only your selected category with the analytics visit. We do not collect financial answers or free-text feedback. The question is available only with optional analytics permission.
When this service is enabled, we ask whether you want to help us understand which campaigns bring visitors and where people stop in the calculator. Choosing "Allow optional analytics" lets us connect approved actions such as starting, viewing costs, comparing cars, opening a plan and tapping an available referral action. We do not collect the financial answers, vehicle choices, verdicts, contact details, raw page addresses, referrers, or page text in this event stream.
Only after you allow it, this browser stores a random visitor identifier with a fixed 30-day expiry and a session identifier that changes after 30 minutes without a measured action or after 24 hours. A separate random journey identifier groups the steps within that session; repeated milestone actions count once. Registered campaign codes can identify the first known, most recent known and current-session campaign for up to 30 days. We do not recognize you across devices or identify you using your contact details. These linked records are pseudonymous, not anonymous.
Our own database schedules these events for deletion after 90 days through a daily cleanup. The approved event fields are also processed by PostHog in the United States, which can keep these events beyond our 90-day period. Its paid plan currently provides a seven-year event history; automatic expiry is being rolled out by PostHog. See PostHog's event-retention details. Analytics data is processed outside Canada and may be subject to those countries' laws. PostHog does not receive your calculator answers, referral contact information or per-lead payment records. We use explicit events rather than automatically collecting form contents.
The preference itself lasts 30 days. You can choose "Analytics preferences" in the footer at any time and withdraw. This stops new optional events and removes the analytics identifiers and campaign history from this browser; it does not erase historical events already collected. Clearing browser storage also clears your preference. Contact our Privacy Officer below about access or deletion of existing information.
Private reports, saved-plan pages, contact forms, owner tools and embedded calculators do not send this optional event stream. If you request an introduction after allowing analytics, an available campaign attribution snapshot may be stored with that request in our private operational records. Partner-sharing permission and marketing permission remain separate choices.
Declining optional analytics leaves the calculator and referral services available. Existing cookieless page counts and the daily aggregate calculator statistics described above remain separate; this choice controls the new linked campaign and journey analytics only. Missing measurements can reflect a declined choice or interrupted connection, not a decision to abandon a task.
One thing worth knowing about the link
Your answers live in the page address. That is what makes a result shareable and what lets the page work with JavaScript switched off, and it has a consequence worth stating plainly: if you copy the link and send it to somebody, the income and the numbers you entered are in the link.
Your browser also keeps that address in its history like any other page. We set a referrer policy that stops the full address travelling to other sites when you click a link away from here, but the link itself is yours to be careful with.
Where the information is kept
The banded rows are stored in a Postgres database hosted by Supabase in the Montréal region, and the site itself runs on Vercel’s Montréal region. Both are in Canada, which was a deliberate choice rather than a default.
Vercel, as the host, processes every request in order to serve it, and its own operational logs can contain an IP address for a short period. We do not add anything to those logs, we do not copy anything out of them, and nothing in them is joined to the banded rows.
When report delivery is enabled, encrypted report requests are stored in the same Canadian database region and transactional email is sent through Amazon Simple Email Service in Canada Central. Exact contact and scenario details are encrypted before storage. Secrets used to send mail or open encrypted data never reach the browser.
How long we keep it
Banded rows are deleted after 24 months. The reason for that number is simple: a market figure two model years old has stopped telling you anything about this year’s market, so keeping it longer would be hoarding rather than research.
A requested buying report and its report-only contact details expire after 180 days, matching the longest buying window the form offers. Consent and suppression evidence may be retained for the period the law requires. Optional update consent lasts until you withdraw it.
Withdrawing consent
Consent is not a one-way door. Anything you have agreed to here can be taken back, and the route is the same in every case: email the Privacy Officer.
CarVerdict's Privacy Officer is Mike Hamata, at hamata.mike@gmail.com. Write "withdraw consent" in the subject line. If you are withdrawing an introduction, include the request number from the confirmation screen, because that is how we find the right record without asking you for anything else.
- Optional updates. The separate, unticked CarVerdict-updates choice on the report form. Withdraw it and we stop using it. It has never been dealer-sharing consent.
- An introduction to a named partner. If you asked us to introduce you to a business, tell us and we stop, and we pass the withdrawal on to that business as well so their own contact stops too. We keep the record of the consent itself, because the point of it is to be able to show what was agreed and when; what stops is the use of it.
- Being contacted. Every text carries STOP and every email carries an unsubscribe link, and either works on its own. The Privacy Officer route exists so you never have to wait for a message to arrive in order to stop the next one.
Withdrawal is free and there is no form to fill in. A request is acted on as soon as it is read, and the CASL requirement to process an unsubscribe within ten business days is a ceiling rather than a schedule.
Your rights, and how to ask
Canada’s federal privacy law, PIPEDA, gives you the right to ask an organisation what personal information it holds about you, to have it corrected, and to withdraw your consent to its use.
If you requested a report, you can ask what personal information we hold, have it corrected, withdraw optional update consent, or ask for deletion where the law permits. Include the email address used for the report so we can locate the right record. Calculator-only banded data cannot be traced back to you.
Ask us anything about this page at hamata.mike@gmail.com. If you are not satisfied with an answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
When this page changes
If what we collect changes, this page changes at the same time as the code, and the date at the top moves. We will not quietly start collecting something and update the policy later.