Privacy, plainly

Nothing here runs ad tech: no ad pixels, no ad profiles, no fingerprinting, no sale of data — ever. Standard traffic measurement (Google Analytics 4) is configured with ad personalization off, Google signals off, and no user IDs — it counts visits and events, never people. You can search without agreeing to anything beyond this page.

Analytics at CarVS are anonymous event counters used to keep the board honest and affordable. The complete event set: search_performed, board_state, compare_select, share_copied, exit_click (booking exits), and bridge_click (links over to our sister site).

The same facts are mirrored into a standard Google Analytics 4 property strictly for traffic totals: no ad personalization, no Google signals, no cross-site advertising profiles, no user IDs, and GA4 stores no IP addresses. The events it sees carry operational facts only — page, event name, freshness state, coarse counts — the identical list below, never identifiers.

The fields those events carry, exhaustively: the event name, which page family fired it, the freshness chip state at the time, a coarse price-direction band, and sometimes a row position. That is the whole list. No names, no emails, no IPs, no precise locations, no device graphs — zero PII fields exist anywhere in the pipeline. Events are keyed by a rotating device token that cannot be tied back to an identity, and counters roll up into aggregates for retention.

A search sends just your query terms to our proxy — a location id, dates, times, filter choices. Nothing identifying rides along:

{
  "pickup_location": "16078",   // Kayak location id (LAX) — no address of yours
  "pickup_date":    "2026-09-12",
  "dropoff_date":   "2026-09-19",
  "pickup_hour":    10,
  "dropoff_hour":   10,
  "countryCode":    "US",
  "currencyCode":   "USD"
}

Our proxy forwards it upstream from our server IP, so the data provider sees us, not you. Your connection details are not part of the search and not recorded with it. Personal searches are retained nowhere: query terms are not stored against you or anyone else.

• A signed metering cookie — enforces the session fair-use cap (three searches per session, per How it works). It contains an authenticated count only: no identifier usable for tracking, readable by nobody but our proxy.
• A localStorage run-count — remembers how many boards you’ve opened so we can watch aggregate adoption honestly. Stays in your browser; never uploaded.

Analytics survive only as aggregated counters; raw events age out quickly and exist pseudonymously while they do. Cache and shared-board artifacts expire on fixed clocks aligned with the caching law — roughly 30 minutes fresh-window, up to 6 hours off-peak, 90 days maximum for shared links. There is no long-term profile of you anywhere behind this site, because there was never enough data to build one.

Clicking an exit takes you off CarVS entirely. From that moment the partner site’s own policies govern — their cookies, their analytics, their checkout. We receive a commission note in some cases and none of your booking details in any case.

Offer data comes via RapidAPI (Kayak rental-car API). If the vendor’s terms require an attribution line, it will be published verbatim on Disclosure and in the footer once confirmed with the provider — we won’t print placeholder legalese before then.