Privacy

Showgone at www.showgone.io is a parts-record tool for vehicle owners and shops, built around California smog checks and CARB Executive Order (EO) numbers. It is not a licensed smog station. Showgone doesn't decide whether a part is allowed. CARB and your smog tech do.

Creating an account sends your email address and password to the Showgone API. Signing in sends your email and password to the API.

You can change your password while signed in. You can delete a vehicle from your garage. You can delete your account in your account settings. After you confirm with your password, Showgone deletes your account, your vehicles, their photos and their parts records from its live database and storage, clears the copy of the parts record in the browser you're using, and signs you out. A copy in another browser stays there until you clear it.

A signed-in vehicle profile can include year, make, model, and engine. If you add them, it can also include license plate, VIN, engine family number, registration renewal date, and photos.

Those values are sent to the Showgone API and stored with your account. The page shows the image URL the API returns.

You type the parts record yourself: brand, part, CARB EO number, and optional notes. It is saved to your account for that vehicle, and a copy is kept in this browser.

Each part’s brand, part name, EO number, notes and part type are sent to the Showgone API and stored with your account, so the record is there on any device where you sign in. A few details you add, such as EO model years, engines and the reason a part needs no EO, stay in this browser only.

A parts record link puts year, make, model, engine, and your part lines in the address after the #. It never includes your plate or VIN. Browsers do not send that fragment to our server with the page request.

Anyone who opens the link or scans the QR can read what is in that address. The shared page does not display a license plate, VIN, or part notes. A link created earlier can still contain those values in the address itself.

The parts catalog loads from the Showgone API. Search and filters run in your browser.

The parts catalog comes from that API and lists parts only. It doesn't give you EO numbers, so check each one at CARB yourself. Photos appear only when the API sends an image URL. We don't scrape retailer sites for photos.

Sample vehicle photos come from Wikimedia Commons and are stored on our own site. Loading a page doesn't send your visit to Wikimedia. Credits are on the photo credits page.

Ask answers only from a product and FAQ knowledge base included with this website. Matching runs in your browser. Your question is not sent to an external language model.

If you are signed in and ask what is in your garage, Ask reads your vehicles from our API and shows year, make, and model. The question text is not sent with that request.

Showgone sets four cookies: locale, access_token, refresh_token and signup_next. The locale cookie remembers English or Spanish for about one year. It is not required to use the site. The signup_next cookie remembers the page you were headed to while you confirm your email. It lasts up to 48 hours and is cleared when you sign in or sign out.

After you sign in, the site stores access_token and refresh_token in httpOnly cookies. In production those cookies are Secure and SameSite=Lax. Sign-in cookies keep you signed in until you sign out, or until you go 29 days without using Showgone. Signing out clears them on that device. Your language cookie stays.

This frontend does not set advertising or analytics cookies.

Showgone is free and doesn't take payments. We don't ask for or store a card number.

This frontend does not sell garage profiles. It does not send Ask questions or parts record link fragments to the API.

It doesn't decide whether a vehicle or part is allowed in California. CARB and your smog tech do.

If you join a waitlist, we store your email address, the feature you picked, your site language if it's sent, the version of the consent wording you agreed to, the time you signed up, and where you signed up (for now, always our website). We keep this in Showgone's database, which Supabase hosts. We don't save your IP address, browser details or name with your signup. Your signup isn't public. We don't sell it, and we don't add it to analytics. We keep it until it's deleted, and nothing deletes it automatically. To have it deleted, email us at the address under "Who runs Showgone." We don't send emails to the waitlist yet.

Your email and password (stored as a hash), your vehicles and the details you add, photos you upload, and waitlist emails.

Like most websites, our hosting provider, Vercel, keeps request logs for every visit and API call, which may include your IP address. The logs we can access are kept for up to 30 days, and Vercel's own handling is covered by its privacy policy. We use them only to run and secure Showgone.

We use reasonable security measures, including encrypted connections. No system is perfectly secure.

We use these companies to run Showgone: Vercel (hosting), Supabase (database and file storage) and Resend (account emails, when they're turned on). They handle your data only to provide their service to us.

NHTSA vPIC (U.S. National Highway Traffic Safety Administration). When you use VIN lookup, we send only the VIN to NHTSA's public vehicle database to get the vehicle's year, make, model, trim and engine details. We don't send your name, email or account details. NHTSA's own privacy policy applies to its systems.

We don't sell or share your personal information, and we don't use ad or tracking pixels.

Showgone doesn't track you across other sites, so it treats every visit the same whether or not your browser sends a Do Not Track signal. We don't let other companies track you on Showgone.

Showgone is operated by Open Source Cowboy Consulting.

To contact Showgone, email oscowboyc@gmail.com.

Showgone doesn't track you across other websites, and it doesn't let other companies do that through Showgone. Because there's no cross-site tracking, the site works the same whether or not your browser sends a Do Not Track signal.

Showgone uses these companies to run the service: Supabase stores account and garage data and photos, Vercel hosts the website and API, and Resend sends account emails when they're turned on. They handle data only to provide those services to Showgone.

Showgone also keeps a copy of some database tables on a cloud computer the Showgone team uses.

While signed in, you can review and edit your vehicles, change your password, and delete a vehicle, a photo or your whole account. Your parts record is saved to your account. Some vehicle answers and extra part details are stored only in your browser, so clearing this site's data removes those.

We keep your account, vehicles and photos until you delete them. You can delete a vehicle, a photo or your whole account in the app. If you delete your account, we keep any data reports you sent, without linking them to you. Your language choice is saved in a cookie for one year. Sign-in cookies keep you signed in until you sign out, or until you go 29 days without using Showgone. Waitlist signups stay in our database until they're deleted. Nothing deletes them automatically. To have yours deleted, email us at the address under "Who runs Showgone."

Our database plan doesn't include automatic backups. When you delete something, it's removed from Showgone's live database. When you delete a photo or vehicle, we also remove its files from storage. If that removal fails, a copy can stay in storage. Showgone also keeps a separate copy of some database tables, including account and vehicle information, made in October 2026 on a computer the Showgone team uses. Information that existed then, including anything you delete later, may stay in that copy until the copy is deleted. The services listed above may keep their own logs for a limited time.

When this notice changes, we update the date at the top of this page. If a change is significant, we also show a notice on the site.