Privacy Policy

The short version

We use Google Analytics to count visits, see which pages people find useful, and measure what gets bought. It sets a cookie and we cannot identify you from it. We also use Microsoft Clarity, which records how people move around a page so we can see where the site is confusing. it is switched off entirely on your account and order pages. We run no advertising pixels and no remarketing. We collect personal information when you place an order, when you create an account, and when you call us. We never see your card number, and if you decode a VIN to add a truck to your garage, we do not keep the VIN.

When you browse

Our web server and our content delivery network keep standard request logs (IP address, time, the page requested, browser user-agent). The ordinary record any web server keeps to serve pages and defend against abuse. We do not build profiles from them and we do not sell them.

When you sign in

You can create an account with Google, or with a link emailed to you. Either way we store your email address, your name if we are given one, and which method you used. Signing in with Google tells us your email address, your name and your Google account identifier. It does not give us your Google password, and it does not give us access to anything else in your Google account.

An account has a garage: the trucks you have saved, so the site can filter parts down to what actually fits. A saved truck is a year, make, model and trim chosen from our own catalogue, plus a nickname if you give it one. That describes a kind of vehicle rather than identifying a particular one: it records “a 2019 Silverado 1500”, not which 2019 Silverado 1500.

Adding a truck by VIN

Rather than picking year, make and model yourself, you can type your VIN and let us fill them in. To do that we send the VIN to vPIC, the vehicle decoder run by the US National Highway Traffic Safety Administration (NHTSA), which returns the year, make and model. It is a free public government service and this is what it is for, but it is still your VIN going to somebody who is not us, so it belongs on this page rather than in a code comment.

We do not keep the VIN. There is no column for it in our database and nothing writes one. It is decoded, matched to a vehicle in our catalogue, and dropped: the page clears it the moment it resolves, our logs never record it, and when it fails the message tells you what went wrong instead of repeating what you typed. A VIN identifies one specific vehicle and, through state records, the person who owns it. The garage only ever needs the vehicle it matched to, so keeping the number would be a risk to you and no use to us.

Using it is entirely optional. The year/make/model picker is the normal way in and nothing about the site works less well if you never type a VIN.

When you buy

Checkout is hosted by Stripe. You enter your payment details on Stripe’s page, not ours, and card numbers never reach our servers. Stripe collects your name, email address, shipping address and phone number to process the payment and passes the order details back to us so we can fulfil it. Stripe processes that information under its own privacy policy.

We keep the order record (what you bought, where it went, and how to reach you about it) because we need it to ship your order, handle returns and warranty claims, and meet our tax and accounting obligations.

Who we share it with

Most parts ship directly from the manufacturer or distributor, so your name, shipping address and phone number are passed to whoever ships your order. That is how the part reaches you. We also share information with our payment processor (Stripe) and, where required, with carriers, and with authorities where the law requires it.

We keep our customer records in GoHighLevel, the CRM and phone system we run the business on. When you create an account or sign in, your name and email address are sent to it so that an order question, an email and a phone call all reach the same record instead of three disconnected ones. It holds no card details. It is our processor: it handles that information on our instructions and not for its own purposes.

We do not sell your personal information, and we do not share it with advertisers.

When you call us

Our phone line is answered by an automated assistant that can look up a part, check on an order, and put you through to a person. The call runs on the same CRM and telephone provider as our customer records, so your phone number and what you tell the assistant are processed there. If you ask for a person, you get one.

The assistant can email you a link to a part you discussed. When it does, we record the address it went to, the link, and the time. That short ledger exists for one reason: a feature that emails an arbitrary address on request is a feature that gets abused to send mail to strangers, and the record is what lets us cap it and see if anyone tries.

Analytics and cookies

We use Google Analytics 4 (measurement ID G-H8KZTSEG06) to understand how many people visit and which pages they use. It sets first-party cookies named _ga and _ga_H8KZTSEG06, which last up to two years and hold a randomly generated identifier. That identifier is not tied to your name, your email or your order, and we cannot look you up with it.

Google receives this data as our processor and also uses your IP address to work out an approximate location, typically the city or region, not an address. We have not enabled Google’s advertising features, audience remarketing or user-ID tracking, so this data is not used to build an advertising profile of you and we do not sell it.

Session recording

We use Microsoft Clarity (project ID y6gycfyks7). This is different from the analytics above and we would rather say so plainly than bury it: Clarity records the page. It captures where you move the pointer, what you click, how far you scroll and the content displayed on screen, and it replays that back to us as video. We use it to find the places where the site is confusing: a filter nobody can see, a button people click twice because nothing happened.

It is switched off on the pages that show your own information.Anywhere under /account/ (your orders, your saved addresses, your garage) on the order confirmation page, and on the sign-in page, recording is stopped rather than merely masked. That is enforced in the site’s code on every page change, not by a setting we could forget. Checkout itself is hosted by Stripe and never runs on our pages at all, so your card details are never in scope for it under any circumstances.

Clarity sets its own cookies (_clck and _clsk) holding a randomly generated identifier, and Microsoft receives the recording as our processor. As with the analytics above, the identifier is not tied to your name, your email or your order. You can opt out of Clarity across every site that uses it at privacy.microsoft.com.

What we measure about shopping

Alongside page visits we record four things about the shopping process: viewing a product, adding one to the basket, starting checkout, and completing an order. Each carries the part, the quantity and the price, the same details already on the page in front of you.

The completed-order event is sent by our server rather than your browser, when Stripe tells us the payment succeeded. It carries the order number, the total, the shipping charged and the parts bought. It does not carry your name, your email, your address or anything about your card. We do this on the server because a browser cannot reliably report an order that finished on Stripe’s payment page, and we would rather count honestly than conveniently.

One consequence worth stating: because that event comes from our server, it is not joined to your browsing session. Google can see that an order happened and what was in it; it cannot see which of our pages you read on the way there.

You can opt out by blocking cookies for this site in your browser, by using your browser’s Do Not Track or tracking-protection setting, or by installing Google’s official opt-out add-on. Nothing on this site stops working if you do. Analytics is measurement, not function.

Apart from those cookies and the ones our checkout needs to keep your basket and your sign-in working, the site sets none of its own.

Your choices

You can ask us what order information we hold about you, ask for it to be corrected, or ask us to delete it where we are not required to keep it for tax or accounting reasons. You can remove a saved truck from your garage yourself at any time. For anything else, call (386) 357-3111 and we’ll sort it out.

Children

This is a store for vehicle parts and is not directed at children under 13. We do not knowingly collect their information.

Contact

Trail Fortress, St. Augustine, Florida. (386) 357-3111. See the contact page.