Privacy Policy

This policy explains how XTO Pty Ltd (ACN 702 801 410) ("RecallRide", "we") handles information on recallride.com. We are based in Australia and comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our site is written for drivers in the United States, and we also respect the privacy rights that US state laws give their residents.

The vehicle data we show

Most of what you see on RecallRide is public data published by the U.S. National Highway Traffic Safety Administration (NHTSA): owner complaints and safety recalls. We copy it from NHTSA's public files and update it daily. NHTSA removes owners' names and contact details before it publishes complaints, and shows only the first 11 characters of each VIN, which identify the model but not a particular vehicle. We do not add any personal information to that data.

The rest is owner reports: experiences that people post on this site, described below.

What we collect

Owner reports you post: the vehicle (year, make and model), the problem area, your star rating, a title and your story, and, if you choose to give them, the mileage, the repair cost, a nickname and your US state. Everything in a report except the visitor code below is published on the site.
A one-way visitor code: a keyed hash (HMAC) of your IP address, stored with reports, votes and flags so we can stop floods, duplicates and double votes. It can't be turned back into your IP address. The IP address itself is never stored.
Votes and flags: when you mark a report as helpful or flag it, we record the vote or flag with the visitor code, not with your identity.
VIN checks: a VIN you enter is used to decode the vehicle and open its page. A VIN identifies a vehicle, not a person, and we don't link it to you.
Contact messages: what you send through the contact form, including your email address if you give it.
Server logs kept by our hosting provider for security and troubleshooting, for a limited time.

What we never collect

No accounts, passwords, real names, payment details or precise location. You don't need to tell us who you are to read the site or post a report.

How reports are moderated

Nobody reads a report before it goes live. Instead, our software checks each one automatically: it gives it a spam score, limits how many reports can come from one visitor code in a short time, and masks email addresses, phone numbers and links in the text. Reports that look like spam are held back and not shown. Readers can flag a report that breaks the rules, and enough flags hide it automatically. We can also remove reports ourselves.

Personal information inside reports

Reports are about vehicles, not people. Please don't include your own or anyone else's full name, address, phone number, email address, license plate or full VIN, or the names of individual dealership staff. If a report contains personal information about you, ask us to remove it and tell us which report you mean.

Browser storage and cookies

RecallRide itself sets no tracking cookies. It uses your browser's local storage to remember two things on your device only: your light or dark theme choice, and which reports you have voted on, so you can't accidentally vote twice. You can clear these at any time in your browser settings. A sign-in cookie is used only by the site operator for the administration area; ordinary visitors never receive it.

Analytics and advertising

If analytics is enabled, we use Google Analytics 4 to understand how many people visit and which pages are useful. If advertising is enabled, Google AdSense shows ads and may use cookies to measure and personalize them. In either case Google may set cookies and process information such as your device and browsing activity; see how Google uses information from sites that use its services. You can control ad personalization at adssettings.google.com, and you can block cookies in your browser.

How long we keep things

Published reports: until they are removed, by you through a request or by us.
Reports held back by the spam filter: deleted after a short period, normally about 30 days.
Votes and flags: as long as the report they belong to.
Contact messages: as long as needed to deal with them.
NHTSA data: kept up to date with NHTSA's own public files.

Disclosure

We don't sell personal information. If advertising is enabled, Google may use cookies to personalize ads as described above, and you can turn that off at any time. Published reports are public by design and anyone can read or quote them. We use service providers, such as our hosting provider and, if enabled, Google, to run the site. We may disclose information if the law requires it.

Overseas

We are in Australia, and our service providers may process information in other countries, including the United States. By using the site you understand that information may be handled outside the country you live in.

Your privacy rights

Wherever you live, you can ask us to:

tell you what information we hold that relates to you;
correct it if it is wrong;
delete it, including a report you posted.

Residents of US states with consumer privacy laws, such as California, may have specific rights to know, correct and delete personal information and to opt out of its sale or sharing. We honor these requests whether or not the law in your state requires it. Australians have rights under the Australian Privacy Principles, including access and correction.

To make a request, use the contact form. Because we hold so little, we usually can't link a report to you, so tell us which report you mean and, if you can, roughly when you posted it. We won't treat you differently for making a request. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the US, to your state attorney general.

Children

RecallRide is a general information site for drivers and is not directed at children under 13. We don't knowingly collect personal information from children.

Changes

We may update this policy as the site changes. The version on this page is the current one.