Privacy policy

PlateVista is a community gallery of vehicle photos taken on public roads, searchable by state and plate. It is built to show vehicles, not to follow people: this page says exactly what we collect, what becomes public, and how to remove it.

Last updated October 28, 2026 Terms of use

The short version

A published photo shows the vehicle, its state and plate, the details its contributor gave, and the date it was published. Details: How we use it
Never public: who submitted it, when or where it was taken, anything from the original file, and photos that are not published. Details: How we use it
The original upload, with any location and camera data, is deleted once it is processed, and in any case within 7 days. Details: What we collect
No analytics, advertising or tracking. Four cookies, all needed to sign up or sign in. Details: Cookies and storage
Delete any photo you submitted, or your whole account, at any time from your account page. Details: Your choices

What we collect

Your account

With an email account: your email address and your password. When you create the account, PlateVista passes the password to Amazon Cognito, the sign-in service we use, and neither stores nor logs it; Cognito keeps it. You sign in on Cognito’s own page. A code is emailed to you to confirm the address, and to reset a forgotten password. If you finish setting up an account from another device, we keep a record of that under the account’s identifier (never the email) for security, and block sign-ins to it for a few minutes.
With Google: Google tells our sign-in service your email address and a Google account identifier. We do not ask Google for your contacts, your photos or anything else.
Your account’s identifier, whether you are a moderator, and the sign-in service’s own records of when you signed in.

Photos you submit

The photo, the state and plate you file it under, the make, model, year, color and caption if you give them, when you submitted it, the version of the Terms of Use you accepted, and its review status: the moderator’s decision, when it was made, and the reason if it was rejected.
The original file may contain the place and time it was taken (GPS) and details of your camera or phone. It is kept in private storage only until it is processed, normally within seconds, and then deleted. A file that is never processed is deleted automatically within 7 days. What we keep and show is a re-encoded copy with no location, camera or other embedded data at all.

Comments and your display name

The display name you choose, when you chose it, and the version of the Terms of Use it was chosen under.
Your comments: the text, the photo, when you posted it, and whether it waits for a moderator and why.
Comments you report: which comment, the reason you chose, when, and your account’s identifier, so that one account counts once per comment.
For moderation: how many of your reports moderators did not uphold, whether a moderator stopped your account from commenting, and a fingerprint of your last comment’s text, to refuse a repeat. How many comments and reports you sent in the last 10 minutes and the last day, kept as two running counts that start again each period.

Likes

The photos you like and when you liked them, with your account’s identifier, so that one account counts once per photo. How many likes you changed in the last 10 minutes, kept as a running count that starts again each period.

When you visit

Our server logs each request’s method, path (never the search terms after the ?, which can contain plates), status and timing, with a random request identifier. We do not log your IP address or browser.
We count how many times each photo page is viewed. The count is a number only: we never store your IP address, a cookie or any other identifier to do it, so it counts page views, not people.
On pages with a protected action (creating an account, submitting, deleting, commenting, reporting a comment, choosing a display name, moderating), Cloudflare Turnstile checks that you are not a bot, using information about your browser and device. See “Who else handles it”.
There are no analytics, advertising or tracking tools on PlateVista.

How we use it

To sign you in and keep you signed in.
To process and review the photos you submit, and to show you their status.
To publish the photos a moderator approves. A published photo shows the vehicle, its state and plate, the details and caption you gave, and the date it was published. It never shows who submitted it, or when or where it was taken. Photos that are not published are never shown.
To show your comments under your display name, and each photo’s likes and views as numbers. Nobody sees who liked a photo.
To let moderators review submissions and comments. They see an account identifier, never your email address. Administrators can look up account records in the sign-in service when that is needed to run it.
To keep the service secure and working, and to stop abuse.

We do not sell personal data, use it for advertising, or build profiles of visitors.

Cookies and storage

PlateVista sets four cookies, all needed to sign up or sign in, none for tracking:

a sign-up cookie that lasts up to 7 days while you confirm a new account, so that only the browser that created it can confirm it here;
a sign-in cookie that lasts 10 minutes while you sign in;
a session cookie that keeps you signed in for up to an hour at a time;
a renewal cookie that renews that session for up to 5 days, sent only to PlateVista’s sign-in endpoints.

Scripts on the page cannot read them. The sign-in pages run by Amazon Cognito set cookies of their own, on Cognito’s domain, to remember your sign-in there; signing out of PlateVista ends that sign-in too.

Your browser also keeps a few notes for the site itself, none of them used to track you:

in the tab's session storage, cleared when the tab closes: the pages you have visited in that tab and what they showed, so Back and Forward return to them as you left them (for a plate search, its state and plate and the results already loaded); which photos have already counted a view in that tab; for 10 minutes, a like you started before signing in; for a minute after you post or delete a comment, its time, which is sent with the next request for that photo's comments so that you see the change at once; and, while you confirm a new account, its email address, never its password;
in local storage, until you clear it: that you closed the privacy notice, once you press “Got it”.

How long we keep it

Your account: until you delete it.
A photo you submitted: until you delete it, your account is deleted, or a moderator takes it down. A rejected photo’s files are deleted when it is rejected; its record (the details you entered and the reason) stays in your list until you delete it.
Original files: deleted after processing, and in any case within 7 days.
Comments: until you delete them, a moderator removes them, the photo is deleted, or your account is deleted. Reports go with the comment, or with your account.
Your display name: until your account is deleted. Then nobody else can choose it for 30 days, so that nobody can pose as you.
Server logs: 14 days.
Backups: deleted records can be restored for up to 35 days, and deleted photo files are kept for 35 days so a mistaken deletion can be undone. After that they are gone.
Caches: a deleted published photo can stay in CloudFront’s caches, or your browser’s, for up to an hour; we ask CloudFront to drop it straight away.
Link previews: when someone shares a photo’s address in an app such as WhatsApp, Telegram or Messages, the app shows a preview with the photo and the vehicle (its text never names the plate), and may keep its own copy of that preview. PlateVista cannot remove a preview an app has already stored.
Search engines: published photo pages and Explore are open to search engines such as Google and Bing, which may show them and their photos in results. Titles, descriptions, link previews and the sitemap never name the plate, and the plate on a page is marked to stay out of result snippets. Searches by plate are marked not to be indexed. A deleted photo’s page answers “not found” within a minute; a search engine drops it when it next checks, which can take days or weeks.

Your choices

Delete any photo you submitted, at any time, from your account, including a published one.
Delete your account from the same page. Everything you submitted is deleted, published photos included, then your comments and the reports you made, and then your account in the sign-in service.
Delete any of your comments, at any time, from the photo’s page.
If you signed in with Google, you can also remove PlateVista’s access in your Google account’s settings.
See what PlateVista holds about you on your account page: your email address, your display name and every photo you submitted, with its details and status. Your comments are on the photos you commented on.

Security

Every connection uses HTTPS. Storage is private and encrypted, uploads go only to a private area through short-lived, single-use permissions, and each part of PlateVista can reach only the data it needs. No system is perfectly secure.

Changes

When this policy changes, this page changes with it, with a new date.