This policy covers the whatbreaks website (whatbreaks.uk), its public REST API (/api) and its remote MCP server (/api/mcp). It is written to be read in two minutes. Last updated 2026-10-03.
The short version: there are no accounts, we store nothing that identifies you, we sell nothing, and the only third parties involved are Google Analytics and Vercel (hosting).
whatbreaks has no sign-up, login, newsletter or payment. You cannot give us your name or email address through the site, and we do not ask for them. The car risk analysis on /query runs entirely in your browser; the make, model, age and mileage you enter are not sent to our servers.
The website uses Google Analytics 4 (GA4), Google's standard, cookie-based analytics product. It tells us how many people visit, which pages they read and roughly where they come from, in aggregate. Google sets cookies in your browser for this and processes the data under its own privacy policy (policies.google.com/privacy). We do not pass GA4 any identifier of our own, and we do not link analytics data to any individual. You can block GA4 with a content blocker or Google's opt-out browser add-on; the site works identically without it.
When an AI agent or developer calls the REST API or an MCP tool (mot_reliability, mot_vehicle_search), our code sends one event to GA4 via the Measurement Protocol so that we can see how much the API is used. That event contains exactly two things:
1. the event name (which endpoint or tool was called), and
2. a random client id generated fresh for that single event.
The client id is not derived from you or your request and cannot be used to join one call to another. We do not store IP addresses, user agents, API keys (there are none) or any part of the request body: the make, model, year, mileage or search text you send is used to compute the answer and then discarded. Nothing is written to a database or log by our code.
Vercel, which hosts the serverless functions, keeps short-lived request logs for operating the platform under its own privacy policy (vercel.com/legal/privacy-policy). We do not export or analyse those logs for anything beyond debugging an outage.
Every figure on this site and in the API is aggregated from the Anonymised MOT tests and results published by the UK Department for Transport on data.gov.uk (DfT anonymised MOT test results, 2023 bulk release). That dataset is anonymised at source by the Department for Transport: it contains no registration numbers, VINs, owner details or test-centre identifiers. We publish only per-model, per-mileage-band statistics derived from it. Nothing on whatbreaks contains data about any individual vehicle or person.
We do not sell, rent or share personal data with anyone, because we hold none. We do not run advertising, retargeting or third-party tracking pixels. We do not profile users. The only third parties that process anything are Google (GA4) and Vercel (hosting), as described above.
Because we hold no personal data, there is nothing for us to access, correct or delete on request; rights over GA4 data are exercised against Google. If you believe this page is wrong, or have any question about it, open an issue on GitHub at github.com/physics-star-cat. Changes to this policy are published here with a new "last updated" date.