Privacy Policy

This policy explains what data Willifit collects, how it's used, and your choices.

Short version

• We do not sell your personal data
• Most of what Willifit "knows" about you (last city, vehicle height, pending reports) lives in your own browser's localStorage — not our servers
• If you submit a clearance report with contact info, we store it so we can reply
• We run two analytics tools: Cloudflare Web Analytics, which sets no cookies at all, and Google Analytics 4, which does set cookies and sends data to Google
• Visitors in the EU, UK, EEA and Switzerland are asked before Google Analytics runs. Everyone else can turn it off at any time from the Cookie preferences control in the footer, and we honor Global Privacy Control automatically
• Map tiles, Street View, and geocoding are served by third parties who have their own policies

What we store locally in your browser

These keys are written to localStorage on your device. We never read them off your device — nothing here is transmitted to us unless you explicitly submit a report:

• willifit_last_city — slug of the last city you viewed (for convenience on return visits)
• willifit_last_center — the map's last center point and zoom, so the map opens where you left off instead of redrawing from the default view
• willifit_map_layer — whether you picked the street or satellite base layer on the map (so we open in your preferred view on return visits)
• willifit_saved_spots — the locations you starred as favorites
• willifit_vehicle_height_in — your entered vehicle height, in inches, if you set one
• willifit_zip_cache — ZIP codes you've looked up and the coordinates they resolved to, cached so repeat lookups are instant
• willifit_report_queue — clearance reports you've submitted (queued locally so nothing is lost if the network fails)
• willifit_issue_queue — the same local queue for "Report an issue" submissions
• willifit_new_location_queue — the same local queue for new locations you've submitted
• willifit_ad_impression / willifit_ad_click — anonymous counters for which sponsored cards you've seen/clicked, capped at the most recent 500 of each (used to rotate ads fairly)
• willifit_cookie_consent — your analytics choice and when you made it, so we don't ask again

One more key, willifit_admin_pw, is written to sessionStorage — but only on /admin.html, which is a password-gated page for the site operator. Ordinary visitors never touch it, and it is erased when the browser tab closes.

You can clear all of it anytime by clearing your browser's site data for Willifit. For how this device storage differs from cookies, and why most of it doesn't need your consent, see the Cookie Policy.

Geolocation

If you allow it, your browser hands your approximate location to the Willifit page so it can open the nearest covered city. That comparison happens entirely in your browser, against the city list already downloaded to your device: your coordinates are never sent to our servers or to anyone else. We use them once to pick a city and do not store them. You can deny the permission and manually pick a city instead — no difference in functionality.

Forms you submit

Willifit has four forms. Three are in the app — Report clearance, Report an issue, and Add a location — and one is the advertiser inquiry form on the advertise page. All four are handled by Netlify Forms, the form service built into our host.

• The three app forms send the location the report is about (its ID, name, address, coordinates, and city), what you're correcting, your notes, your optional email, a submission timestamp, and your browser's user-agent string
• The advertiser inquiry form sends the name, company, email, optional phone, and message you type into it
• Your email (if provided) is used only to reply with follow-up questions or to notify you if we update the data based on your report
• We never sell or share your email with third parties
• The timestamp and user-agent string are captured for anti-abuse purposes
• Submissions land in Netlify Forms and are read back by the site operator through a password-protected admin page. Netlify processes them on our behalf under its own privacy policy
• Submissions may be retained indefinitely as part of our data-quality audit trail

Until a submission reaches the network it also sits in a queue on your own device, so a dropped connection never loses your report. Those queues are listed above.

Analytics

We run two analytics tools, and they are not the same kind of thing. Here is exactly what each one does.

Cloudflare Web Analytics — no cookies

Cloudflare Web Analytics counts page views and basic performance timings. It sets no cookies, uses no device fingerprinting, and does not follow you to other sites. Individual visitors are not identified. It runs on every public page of the site, including this one, and it is not affected by your cookie choice because it does not use cookies or device storage at all.

Google Analytics 4 — this one sets cookies

Since August 2026 the site has also run Google Analytics 4, measurement ID G-SH191K5NGS, loaded from googletagmanager.com. Being straight with you about it: this is not a cookieless tool.

• It sets two cookies in your browser under the willifit.ai domain: _ga, which holds a randomly generated ID that distinguishes your browser from other browsers, and _ga_SH191K5NGS, which keeps track of your current visit. Both expire 2 years after they are last set.
• What it measures: which pages you view, how you arrived (search, a link, direct), roughly where you are (country and city level, derived from your IP address), your device type, browser, and screen size, and how long you stay.
• Where the data goes: to Google, which processes it on our behalf and may store and process it on servers in the United States and elsewhere. Google's handling of it is governed by its own privacy policy and its business data terms. We do not upload your email, your report submissions, or anything you type into a form to Google Analytics.
• Cross-site capability: Google Analytics is a Google product and the underlying technology is capable of being used for cross-site measurement and advertising. We do not enable Google Signals, Google Ads linking, or advertising features on this property. We are describing the tool honestly rather than claiming it is something it isn't.
• We don't sell it. We do not sell the data, and we do not use it for targeted advertising. Some state privacy laws define "sale" and "sharing" broadly enough that sending data to an analytics provider can count, which is why the opt-out below exists for every visitor regardless of where you live.

Your consent

If you are visiting from the EU, the UK, the EEA, or Switzerland, Google Analytics does not run until you say yes. You get a banner on your first visit with an equally prominent Accept and Reject; nothing analytics-related is set until you choose, and choosing Reject means the _ga cookies are never written.

Everywhere else — including the United States, where most of our visitors are — Google Analytics runs by default and you can turn it off at any time using the Cookie preferences control in the footer of every page. If your browser or extension sends a Global Privacy Control signal, we treat that as an opt-out automatically and you don't have to do anything.

The full cookie-by-cookie breakdown is on the Cookie Policy page.

Third parties

Loading a page from any of these means your browser connects to them directly, so they can see your IP address, your user-agent string, and which of our pages sent you. Our site-wide referrer policy is strict-origin-when-cross-origin, so what they get as a referrer is https://willifit.ai and not the full URL of the page you were on.

• CARTO — the street-layer map tiles are rendered by CARTO from OpenStreetMap data and served from basemaps.cartocdn.com. Requests for those tiles go to CARTO, under their privacy policy. The underlying map data is © OpenStreetMap contributors (OSM privacy policy)
• Esri World Imagery — satellite-layer map tiles when you toggle to satellite view (their privacy policy)
• Nominatim (OpenStreetMap) — when you look up a ZIP code or type an address into the city picker, that text is sent to OpenStreetMap's Nominatim geocoding service to turn it into coordinates. The answer is cached on your device so we don't ask twice
• Google Maps Platform — see the section below
• Google Analytics — see the Analytics section above
• Cloudflare — Web Analytics, described above, and the CDN that serves the site
• Netlify — our host, and the processor for every form on the site
• Google Maps / Apple Maps / Waze — if you click a "Directions" link, we hand you off to them for turn-by-turn navigation. What you do there is governed by their policies
• Sponsors — if you click a sponsored card, you leave Willifit and enter the sponsor's site, which has its own policy

Google Maps Platform

An earlier version of this policy said the Google Maps JavaScript API was used "only if the site operator has enabled it." That is out of date. Here is the current arrangement:

• The main map is Leaflet with the tile layers listed above. It is not a Google map
• The Street View panel on a location's detail page is Google. When you open a location, we ask Google's Street View metadata service whether imagery exists at that location's coordinates, and if it does we load the Google Maps JavaScript API to show you the panorama of the entrance
• If Street View has no imagery there, we fall back to a Google Static Maps aerial image of the same spot
• What Google receives in that exchange is your IP address, your user agent, our origin as the referrer, and the coordinates of the location you are looking at — a garage or bridge in our database, not your own position. Our API key is restricted to the willifit.ai domains
• Google's use of that data is governed by its privacy policy. Nothing about you personally — no vehicle height, no favorites, no report content — is sent with these requests

Children

Willifit is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted a report, contact us and we will delete it.

Your choices

Four ways to control what happens, from easiest to most thorough. Any one of them works on its own.

1. The Cookie preferences control

Every page has a Cookie preferences button in the footer. Open it and pick Accept or Reject for analytics. Rejecting stops Google Analytics from setting or reading its cookies. Your choice is remembered on that device in willifit_cookie_consent, and you can change it as often as you like. Clearing your site data resets it.

2. Global Privacy Control

Global Privacy Control is a signal your browser or a privacy extension can send on your behalf, so you don't have to click an opt-out on every site you visit. Firefox has it built in; Brave, DuckDuckGo, and several extensions send it too. If we see it, we treat it as an opt-out from analytics and you don't have to do anything else.

3. Google's own opt-out

Google publishes a Google Analytics Opt-out Browser Add-on that blocks Google Analytics on every site, not just this one. You can also review and limit what Google keeps about you at My Ad Center and My Activity.

4. Your browser

Every major browser lets you block or delete cookies, block third-party cookies, or browse in a private window that discards them on close. Clearing site data for willifit.ai also wipes every localStorage key listed above — your saved city, vehicle height, favorites, and any queued reports, so export anything pending first. Blocking storage entirely won't break the site; it just forgets you between visits.

Your privacy rights by state and region

Several U.S. states — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and a growing list of others — give residents a set of rights over personal data. The details differ, but they generally cover the same five things. We extend all of them to everyone who asks, wherever you live, because sorting requests by state is more work than just honoring them.

• Know and access. Ask us what personal data we hold about you and get a copy of it. In practice, for most visitors, the honest answer is "nothing" — unless you submitted a form or an advertiser inquiry, we hold no record tied to you
• Correct. Ask us to fix personal data about you that is wrong
• Delete. Ask us to delete personal data about you. We will, except where we have to keep something to comply with a legal obligation. Note that the clearance measurements in a report become part of the safety dataset; we can strip your email and any identifying details from the record without deleting the correction that keeps other drivers safe
• Opt out of sale, sharing, and targeted advertising. We do not sell personal data and do not use it for targeted advertising or profiling. Some state laws define "sale" and "sharing" broadly enough to reach ordinary analytics, so the opt-out is available to you regardless: use the Cookie preferences control in the footer or send Global Privacy Control. Both work as an opt-out request
• No retaliation. Exercising any of these rights costs you nothing and changes nothing about the site you get. There is no paid tier, no degraded version, and no feature we withhold from people who opt out

If you are in the EU, UK, EEA, or Switzerland, you additionally have the right to object to processing, to restrict it, to data portability, to withdraw consent at any time (the Cookie preferences control does exactly that), and to lodge a complaint with your national supervisory authority.

How to make a request

Email privacy@willifit.ai and say what you want. Include the email address you used when you submitted a report, if you did — without it we usually have no way to find a record that belongs to you, and we will not ask you for extra identity documents just to go looking. We aim to respond within 45 days, which is the deadline most of these laws set. If we can't verify a request we'll tell you why rather than quietly ignoring it.

You can also authorize someone to make a request for you; we may need written proof of that authorization before we act on it.

Changes

Material changes to this policy will be indicated by an updated "Last updated" date. Please check periodically.

Contact

Privacy questions: privacy@willifit.ai