Privacy policy

Last updated 2026-08-24

The short version

DownTo1 Cars has no accounts, no database and no back end. Every answer you give stays in your own browser and is never transmitted to us. The only thing that can leave your device is measurement data for Google Ads, and only if you have explicitly allowed it — which is off by default and can be withdrawn at any time. If you choose to follow one of our links to a car marketplace, that click goes straight to the marketplace: no affiliate network sits in that path today, and the section below explains what would change if one ever did.

Who is responsible

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Michał Zajączkowski
Poland (sole operator, no business premises)
info@downto1.com

What stays in your browser

The following is written to your device's local or session storage. It is not sent to us or to anyone else, it is not a cookie, and clearing your browser data removes it permanently.

Local storage used by DownTo1 Cars
Key	Purpose	Lifetime
`cc.session.v1`	Your answers and which question is open, so a reload does not lose your work.	Until you clear it
`cc.theme`	Whether you chose the light or dark theme.	Until you clear it
`cc.locale.v1`	Your language and market choice, so we do not guess again on every visit.	Until you clear it
`cc.locale.auto.v1`	A one-shot marker that we guessed your language rather than you choosing it, so the notice about that survives the redirect.	Until the next page loads, at most until the tab closes
`cc.consent.v1`	Your answer to the measurement banner, so we stop asking.	6 months
`cc.ads.fired.v1`	Which measurement events already fired, so one visit is not counted twice.	Until the tab closes
`cc.ads.sid.v1`	A random per-tab id used only to de-duplicate those events.	Until the tab closes

None of it identifies you. The answers describe a car you might want, not a person — and we never see them in any case.

What our hosting provider sees

The site is served as static files from a content delivery network. Like any web server, it processes your IP address, the time of the request, the page requested, and your browser's user-agent string, in order to deliver the page and to defend against abuse.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a functioning and secure website.
Retention: access logs are kept for no longer than 30 days and are then deleted or aggregated beyond recovery.
Processor: our hosting provider acts on our instructions under a data processing agreement (Art. 28 GDPR).

Measurement and advertising

If you press Allow on the consent banner, we load Google's tag (gtag.js) so that we can count how many people reach an answer and judge whether the advertising that brought you here was worth running. If you decline, or simply ignore the banner, the script is never requested at all — not loaded and blocked, but never fetched.

Separately from Google's tag, we count visits with Umami, an open-source analytics tool that we host ourselves on our own domain. It sets no cookies, stores no identifiers on your device and collects no personal data — only aggregate figures such as which pages were viewed and from which country. Because nothing is shared with third parties and no individual is tracked, it runs without asking for consent, on the basis of our legitimate interest in knowing whether the site is used (Art. 6(1)(f) GDPR).

What this involves

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as an independent controller for its own purposes. Data may be transferred to Google LLC in the United States.
Transfers: such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where it does not apply, on Standard Contractual Clauses.
Cookies: Google sets identifiers such as _gcl_au (typically 90 days) to link an ad click to a later action on this site. The exact set is determined by Google, not by us.
What we report: that a decision was started, that a result page was reached, and that a summary was copied — plus the indicative price of the recommended car as a conversion value. We do not send your answers, and we do not build a profile of you.
Legal basis: Art. 6(1)(a) GDPR, and the corresponding national implementation of Art. 5(3) of the ePrivacy Directive for storing information on your device — that is, your consent, and nothing else.

Before you choose, Google Consent Mode v2 is initialised with every storage signal set to denied. Google's own handling of this data is described in its privacy policy.

Changing your mind

Withdrawing consent is as easy as giving it and takes effect immediately for the future. Use the control below, or clear this site's data in your browser settings. Your stored choice expires on its own after six months, at which point we ask again.

Measurement is not configured on this deployment, so nothing is loaded regardless.

Outbound marketplace links

Pages that recommend a car may link to car marketplaces where you can see real listings for it. No affiliate network is enabled on this site at present: these links point directly at the marketplace, and nothing is placed between you and it.

That may change. If we join an affiliate network, an outbound link would be routed through that network's redirect, which forwards you to the marketplace and may credit us with a commission if you buy something there — at no cost to you, and with no effect whatsoever on how the cars are ranked. We will name the network here, with its address and a link to its own privacy policy, before any click is routed through it.

Either way, nothing is stored on your device by us or by such a network while you are on this site — no cookies, no identifiers, and no affiliate network's script is loaded here. A network would learn of you only at the moment you chose to leave through one of these links, at which point it would process the technical data of that redirect (such as your IP address, the destination and the page the link was on).

Recipient: none today. Any affiliate network we later use would act as an independent controller for the processing it performs during the redirect and on the merchant side, and would be named in this section.
Legal basis for our part — building the link — is Art. 6(1)(f) GDPR: our legitimate interest in funding a site that is free and has no ads on it.
The marketplace itself is responsible for what it does with your visit once you arrive, under its own privacy policy — that is true today and would remain true with a network in the path.

What we do not do

We do not ask for, or store, your name, email address or any account credentials.
We do not sell or share personal data with data brokers.
We do not carry out automated decision-making producing legal effects concerning you within the meaning of Art. 22 GDPR. The ranking scores cars against criteria you chose; it does not evaluate you.
The site is not directed at children and we do not knowingly process their data.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15);
have inaccurate data corrected (Art. 16);
have data erased (Art. 17);
restrict processing (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw consent at any time, without affecting processing already carried out (Art. 7(3)).

In practice we hold almost nothing that could identify you: your answers never reach us, so there is usually nothing for us to return or erase beyond server logs. Write to info@downto1.com and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority — for us, that is the President of the Personal Data Protection Office (Prezes UODO), Poland, or the authority where you live or work.

Changes to this policy

If we change how this site handles data we will update this page and the date above. Material changes to consent-based processing will be accompanied by a fresh request for consent.