Privacy

The service is operated as DealScore at https://cardealscore.com. The same product is referred to as Deal Score.

An agent grades an asking price with the MCP tool score_deal or REST (POST /api/score). You can test the same call in the /try playground. A signed-in Free account can score 5 deals per UTC month. The offered paid plan is Builder ($19/month, 1000 scored deals). Existing Shopper Pass purchases ($7 once, 30 scored deals over 30 days, no auto-renew) and Starter subscriptions ($15/month) stay active and are not offered to new buyers. MCP, REST, and /try share one counter. Only coverage: scored counts.

• Email for magic-link sign-in. The login token is stored as a hash. Each sign-in link also stores the page to send you back to after sign-in, and a flag that marks our own test traffic and known bots. The address is the account id for keys, OAuth consent, and billing. The account also records whether it is one of our own test accounts.
• API keys are shown once, then stored as a SHA-256 hash plus a short prefix. We do not keep the full secret.
• OAuth tokens (access and refresh) are stored as hashes, tied to your user id, the client, and the requested scope. When an AI client registers for OAuth, we store its name, its redirect addresses, the user agent it registered with, and the two-letter country Vercel reports for that request.
• Score requests include the vehicle attributes you send (year, make, model, trim, VIN, asking price, mileage, and an optional ZIP, or a listing URL or listing text if one is sent). Those fields are used to compute the grade and to decide whether the request counts on the meter. The stored meter is a count for the UTC month, plus one event per scored call with its kind, user id, and time, the channel it came through (MCP, REST, or /try), and the API key or OAuth client that made it. We do not keep a library of the listings you scored.
• Stripe ids (customer id and subscription id) and your plan name, so paid access can be turned on and off.
• Sign-up source. Campaign tags from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, or ref) and the referring site's hostname. They are held in the ds_attr cookie and saved to your account when you sign up. When you ask for a sign-in link, we store the same tags and hostname with that link, plus your page test arm (A or B) from the ds_ab cookie. A new account keeps that arm.
• Usage and analytics. A signed-out first score on /try sets the ds_anon_look cookie and stores the request IP address as received (not hashed), the UTC date, and a count of signed-out scores from that address on that date, so that one look is not repeated. Vercel Web Analytics records basic page views.

The site sets these cookies, with how long each one lasts:

• ds_session: keeps you signed in. 30 days.
• ds_anon_look: marks that the signed-out free score was used. 400 days.
• ds_attr: holds campaign tags and the referring site until you sign up. 400 days.
• ds_ab: the page test arm and a random visitor id. 90 days. Known search and AI crawlers do not get it.
• ds_landing: which part of the site you first landed on: home, guides, or other. 90 days.
• ds_internal: set only by our own test links so test visits stay out of the counts. 1 year.
• ds_oauth_return: holds your place during an OAuth sign-in. 10 minutes.

The /try form keeps a draft of what you enter in your browser's local storage for up to 1 hour.

When a signed-out score on /try stops at the sign-in prompt, the request and its score result are kept in your browser's local storage for up to 30 minutes, so the result can show again after you sign in.

• MarketCheck receives vehicle attributes so we can fetch live comps, taxonomy, and VIN decode when that provider is configured.
• NHTSA vPIC may receive a VIN or year/make/model when MarketCheck is not used for decode or taxonomy.
• Browserbase may fetch a dealer listing page when a listing URL is sent to the listing intake endpoint.
• Stripe processes paid subscriptions. We store the customer and subscription ids Stripe returns.
• Resend sends the magic-link email.
• Neon hosts the Postgres database for accounts, hashed credentials, meter counts, and Stripe ids.
• Vercel hosts the site and provides Web Analytics.

We do not sell personal data. We do not share it for other companies' advertising.

Privacy contact address on https://cardealscore.com: privacy@cardealscore.com.

Service rules are on the terms page.