Your photo stays with you.

This site is operated by the Ventlings project team. This notice covers Car Charm Studio, the campaign site and the separate founder reservation form.

Car Charm Studio photos and downloads

The free homepage Studio reads a JPG, PNG or WebP file only after you choose it from your device. Your photo and crop settings stay in the current page's memory. The Studio does not upload the file, send it to an image service, save it in browser storage, or add it to a reservation record. Leaving or reloading the page clears the Studio session. A PNG you explicitly download is saved by your browser on your device; Ventlings does not retain a copy. A shared Studio link opens the tool and does not contain your photo or crop.

Studio analytics use only fixed mode, shape, background palette and share-method identifiers to measure tool activity. They do not contain photos, image contents, filenames, file metadata or crop settings. Site-wide page measurement and campaign attribution operate separately as described below. If you explicitly share a downloaded image outside the Studio, the service you choose applies its own privacy terms. Ventlings cannot see the receiving app, and an accepted share request does not prove delivery or publication.

What is collected

The reservation form collects your optional first name, email address, chosen kit quantity, acceptance of reservation terms, optional marketing choice, and basic technical records needed to secure and operate the site. If present, campaign parameters, a pseudonymous or public creator referral code, landing path, and referring host are stored with the reservation so we can understand which outreach brought people to Ventlings.

Why it is used

We use reservation data to measure unique founder interest, update a selection when the same browser supplies the matching private management key, operate the campaign, prevent abuse, and contact you about reservation-critical information. Optional marketing is used only when separately selected.

Storage and service providers

Reservation events are stored in private Vercel Blob storage and the site is hosted by Vercel. Raw email addresses are not placed in public file paths or returned by the campaign counter. To limit automated inflation, a one-way keyed version of the requesting network address is stored with rate-limit timestamps; the raw address is not written into that reservation-rate path. Vercel Web Analytics measures aggregate page and campaign activity without using the reservation form’s name or email as analytics properties. If email confirmation is enabled, Resend processes the submitted address to deliver a one-time confirmation link; the public link contains a random token rather than the address. Stripe will process card details only if the separately gated card-setup flow opens. These providers process information to deliver their services; we do not sell or share reservation data for cross-context advertising.

Retention

Reservation records are kept through the validation campaign and for up to 24 months afterward, unless you request deletion or a longer period is reasonably required for security, dispute, or legal obligations. Records converted into paid orders will follow the final order policy. An active Community Pick and its private abuse-prevention records are kept through the applicable concept campaign and for up to 24 months afterward unless the pick is removed earlier or a longer period is reasonably required for security or legal obligations. Browser-local values remain until this browser removes the active pick or its site data is cleared; a successful removal clears the active candidate locally but retains the random management key so the browser can make and manage a later pick.

Your choices

You may decline marketing without affecting your reservation. The browser that creates a reservation stores a random private management key for up to 24 months, indexed locally by a one-way email digest. From that browser you can turn off optional marketing or permanently delete the stored reservation events. You can also withdraw a founder reservation, which removes its latest quantity from the public demand count. Email-confirmed recovery for a lost key must be available before optional marketing is sent or paid checkout opens.

Cookies, local storage, tracking, and signals

This version does not use advertising trackers or behavioral profiling. It uses privacy-minded first-party page measurement, campaign parameters, referral host data, and pseudonymous or public creator referral codes to understand site traffic and reservation conversion. First-touch campaign attribution may be kept in your browser's local storage for up to 30 days. A random share code may also be stored locally so links you choose to share can be attributed without placing your email address in the URL. A random reservation management key, indexed locally by a one-way email digest, may be stored for up to 24 months so this browser can authenticate later changes and privacy requests. The Community Pick separately stores a random 32-byte management key and, after a successful save, one controlled active-candidate slug in first-party local storage. Essential hosting and security logs may also be created. Names, email addresses, full referral codes, free-form campaign parameters, and Community Pick management keys or server hashes are not sent as analytics event properties. Because no cross-site advertising tracking is used, browser Do Not Track and Global Privacy Control signals do not change site behavior.

Creator kit and organic launch desk

The creator kit and noindex launch desk use only fixed public assets, reviewed copy, and controlled campaign destinations. The launch-desk URL remains public—noindex reduces search discovery but is not access control. These pages ask for no account credential, email, identity, free text, posting schedule, or published URL and make no application API request or browser-storage write. Clipboard content is written only after you select a copy control. A Pinterest handoff requests Pinterest's external creation flow after you select it; Ventlings does not sign in, select an account or board, press Publish, or receive Pinterest's publication result. Aggregate launch-desk analytics may record only one of two controlled campaign IDs and one controlled action—handoff, title copy, description copy, destination copy, alt-text copy, or asset-download click. The event contains no copy, URL, account, board, handle, credential, published post, error text, or identity. A handoff, clipboard resolution, or download click does not prove publication, transfer, impressions, visits, reservations, orders, or demand. Your browser and Pinterest apply their own privacy terms.

Founder offer bridges and pulse

Outside the Series 01 offer section, a controlled closed-state link or compact bridge only links to the full launch-format comparison and optional pricing question. If you select one, aggregate analytics may record exactly the controlled entry placement and active public offer ID. Only the Founder Trio section on Series 01 presents the four controlled responses—the research-only First Ride Swap Set, the fixed Founder Trio, interested but not at these prices, or not for me—and keeps the selected response in the current page render only. The Swap Set proposes the same three public animal shells with one dock and three scent cores; it is not in the reservation, checkout, paid-order, allocation, or production-release systems. A qualified canonical question view records the fixed Series-roster placement and controlled study ID co_pilots_v1_swap_compare_v1; a valid peer-shared landing uses a separate fixed placement. A selection records the fixed combined study-and-placement context plus the response category. The entry link, bridge, and question request no name, email, payment detail, or free text; create no reservation, order, founder slot, price lock, obligation, or public-count entry; and add no cookie, local-storage entry, or session-storage entry. The response control makes no application API or database request. No Founder offer event contains the nearby animal, name, crew, Halloween result, browser key, server hash, tally, save outcome, answer, or attribution value, and the entry links, bridge, and pulse cannot read or alter any tool result or Community Pick. An entry click, view, or response can repeat after a reload and the events are not joined to identify one visitor, so they are page interactions—not people, price acceptance, orders, product demand, progress toward 1,000 paid trios, or manufacturing authority.

After either positive price-qualified response, a compact relay can pass only the public two-plan caption and a canonical Series 01 link to a device share service, clipboard, email client, or Pinterest. The relay receives no response value, free text, sender identity, tool result, or reservation data. Its generated link contains exactly shared=1 and fixed source, medium, campaign, and Founder Trio creative-content tags; it contains no response, referral code, sender identifier, or private value. The relay itself makes no fetch or application API request and writes no cookie, local-storage entry, or session-storage entry. The site-wide first-touch attribution described above may separately retain those fixed campaign tags when a recipient visits. Aggregate relay analytics may record the controlled study ID with one controlled share channel or request stage, and a valid peer-shared pulse view may record that study ID; none includes the caption, URL, receiving service, browser support state, error detail, response, or identity. A native-share or clipboard action is recorded as a share only after its request resolves; email and Pinterest record the outbound click. These signals do not prove publication, delivery, a recipient visit, price acceptance, reservation, order, or demand. The device, email, or Pinterest service selected by the visitor applies its own privacy terms.

Vent Fit Checker

The Vent Fit Checker keeps its three controlled selections in page memory and does not place them in a URL, cookie, local storage, session storage, reservation record, or photo upload. Aggregate checker events may record a controlled vent-style label, result code, guide destination, share channel, request stage, or reference-card format; they do not include the complete answer set, vehicle identity, caption, URL, filename, receiving app, error detail, or identity. When native file sharing is available, the controlled public vent-type JPEG may be fetched from this same site without cookies or a referrer and held in page memory only; it is not uploaded back to Ventlings. Only after you press a share control does your device pass that public card, caption, and attributed checker link to the operating-system share service or receiving app you choose. Ventlings cannot see which receiving app you choose, and a resolved share request or download click does not prove that anything was posted, delivered, or downloaded. The receiving service applies its own privacy terms.

Character quiz

The just-for-fun Series 01 quiz keeps individual answer selections in page memory only long enough to calculate a result. Individual answers are not placed in a URL, cookie, local storage, session storage, reservation record, or analytics event. Aggregate quiz actions may record a controlled step number, public result slug, share channel, request stage, format, destination, or placement. The Homepage animal prediction challenge lets a visitor select one public animal slug from Capybara, Raccoon, or Tree frog in page memory and share that public result as a playful prediction. Its link contains only that allowlisted slug and controlled campaign tags; it contains no sender identifier, quiz answers, claimed relationship, vehicle, referral code, or private data. Aggregate challenge analytics may record only a view, the controlled result slug, and a controlled share channel. A shared-card challenge may place one of six public animal slugs in the URL so two character cards can be compared; it does not identify who opened either card, prove a relationship, or retain the answers that produced a result. When native file sharing is available, the controlled public result JPEG may be fetched from this same site without cookies or a referrer and held in page memory only; it is not uploaded back to Ventlings. Only after you press a share control does your device pass that public card, caption, and attributed public-result link to the operating-system share service or receiving app you choose. Ventlings cannot see which receiving app you choose, and a resolved share request or download click does not prove that anything was posted, delivered, or downloaded. Quiz-share analytics do not include an answer, comparison animal, caption, URL, filename, browser support state, receiving app, error detail, or identity. The receiving service applies its own privacy terms.

Road-trip compatibility quiz

The two-person road-trip quiz reuses the four controlled character questions. Each participant's choices stay in the current page's memory only long enough to calculate one of six public animal results; the choices are not placed in a URL, cookie, local-storage entry, session-storage entry, reservation, order, API request, or analytics event. The controlled relay link contains one allowlisted comparison animal slug, the literal shared=1 flag, and four fixed campaign tags. It contains no name, answer, sender identifier, referral code, relationship label, vehicle, caption, or free text. The pair result uses only the two public animal slugs and gives either a same-lane message or the two animals' fixed road roles. It provides no percentage, rank, diagnosis, relationship advice, or compatibility verdict.

Aggregate match events may record a controlled root-or-shared entry, result slug, compared-to slug, share channel, request stage, card format, or internal placement. They never include an answer, name, sender, recipient, relationship, caption, URL, filename, receiving app, error detail, or identity. A share API resolution, clipboard write, outbound click, shared landing, comparison completion, crew-builder click, or Founder-offer bridge click is a repeatable page interaction—not proof of publication, delivery, a distinct person, a relationship, product preference, reservation, order, paid demand, or production authority. The separate Founder-offer bridge is withheld from the match result and may appear only after a visitor confirms a three-animal crew.

Road-trip This or That deck

The question deck shows one of 60 fixed public prompts in page memory. It asks for no name, account, email, vehicle, location, answer, score, relationship, or free text. Visitors answer aloud; the page provides no A-or-B input and does not save, submit, interpret, or place an answer in a URL, cookie, local-storage entry, session-storage entry, reservation, order, product configuration, or API request. Aggregate analytics may record only a controlled category when the deck starts or advances, plus the fixed deck placement when its quiz link is selected. These repeatable interactions are not people, answers, matches, relationships, product preferences, reservations, orders, or demand.

Series preview Community Pick

The Next Ventling Community Pick lets one retained private browser key hold one active choice from Sea otter, Highland cow, or Luna moth. Before the first save, the browser creates a random 32-byte management key, stores it in first-party local storage, reads it back, and sends it only to this site in the body of a same-origin HTTPS JSON request; it is never placed in a URL, analytics event, public tally, caption, filename, or public API response. The browser also stores the last server-accepted candidate locally. On the server, the management key is replaced with a domain-separated one-way SHA-256 digest. The private pick state contains only that digest as the lookup key, the controlled candidate slug, server timestamp and revision, plus version, campaign, and aggregate state metadata. It does not contain a name, email, payment detail, vehicle, free text, campaign parameter, referrer, user agent, raw network address, or reservation or order identifier. Site-wide first-touch attribution may still operate separately as described above.

A separate private abuse-prevention record uses a one-way keyed version of the requesting network address with a rate-window path and server timestamp; the raw address is not written into that Community Pick rate record. A retained browser key can create one active pick, replace it without adding a second active pick, or remove it. A successful removal deletes that key's active server entry and reduces the aggregate; it also clears the active candidate from local storage while keeping the management key available for a later pick. If site data is cleared, private browsing ends, or a different browser or device is used before removal, Ventlings cannot reconnect that browser to the old key. The old active entry may remain until the retention period or other authorized cleanup, and the new browser can create another key and another active pick. The system therefore does not verify or deduplicate people.

The public result reports the exact aggregate of active accepted browser-key entries and controlled per-candidate counts as of its stated update time. It never exposes a browser key, server hash, network record, identity, or individual history. This aggregate is not a poll of verified people or customers, a vote, preference by a unique person, reservation, order, paid trio, product demand, winner, production instruction, or progress toward the 1,000-paid-trio release review. Analytics separately records only controlled interaction properties such as candidate, page entry, create/change action, controlled result outcome, results context, share channel or stage, card format, and internal destination; it never receives the management key, server hash, raw or keyed network address, state revision, timestamp, caption, URL, filename, receiving app, free text, or error detail. Only a server-accepted active pick can unlock the picker's share controls. A native share request may pass a public disclosure-labeled JPEG, caption, and attributed public link to the operating-system share service or receiving app selected by the visitor; Ventlings cannot see that app, and a resolved request or download click does not prove publication, delivery, download completion, or a recipient visit. Shared links reveal one public candidate slug and controlled campaign tags but no sender identity or management key. The receiving service applies its own privacy terms.

Road-Trip Crew builder

The crew builder keeps up to three controlled public animal slugs in page memory and resets them when the page is left or reloaded. It does not add an account, cookie, local-storage entry, session-storage entry, ballot, wishlist, reservation, order, product configuration, or API record. A shared crew URL contains exactly three unique allowlisted animal slugs plus controlled campaign tags; it includes no sender identity, name, email, vehicle, caption, free text, or previous crew. Aggregate events may record one of 20 canonical crew keys with a controlled entry, character, channel, request stage, or card format. Repeated interactions are not deduplicated and are not people, votes, orders, reservations, or demand. When native file sharing is available, the selected public disclosure-labeled JPEG may be fetched from this same site without cookies or a referrer, checked for type and size, and held in page memory only. Only after you press a share control does your device pass that card, caption, and attributed public link to the operating-system share service or receiving app you choose. Ventlings cannot see which receiving app you choose, and a resolved share request or download click does not prove publication, delivery, download completion, or a recipient visit. The receiving service applies its own privacy terms.

Car Name Generator

The car-name generator accepts one choice from each of three controlled lists: color family, road-trip vibe, and naming style. It does not ask for or store a make, model, year, plate, VIN, location, photo, owner name, email, or free-text name. Choices, three suggestions, and the active result stay in React page memory only and reset when the page is left or reloaded; the tool does not write those answers to an account, cookie, local-storage entry, session-storage entry, reservation record, order, product configuration, or API. The first deterministic suggestion appears automatically as a share-ready lead result; this display is not a choice, favorite, name approval, or product preference. Aggregate analytics may record its allowlisted public result slug and controlled entry only after the result section becomes at least 35% visible. An explicit switch to one of the other two suggestions may record the newly displayed controlled result and entry. On each of the ten public car-name-by-color guides, the broad guide family appears in the canonical page path and begins selected in page memory; aggregate page-path analytics may therefore report that public guide path. Generator events from those pages use only the controlled `color_guide` entry and do not copy the color slug or any later answer into an event. Separately, the site-wide first-touch attribution described above may retain controlled campaign tags, a public creator code when present, the generator, color-guide, or shared-result landing path, and referring host in local storage for up to 30 days; it never retains the three choices or their sequence. Aggregate events may record a controlled entry value, one of 36 curated public result slugs, a controlled action, share channel, request stage, download format, comparison result, or internal destination, but never the three choices or their sequence. A shared result URL reveals one allowlisted versioned name-and-animal result plus controlled campaign tags; it contains no choices, sender identity, car information, caption, free text, or previous result. When native file sharing is available, the selected public disclosure-labeled JPEG may be fetched from this same site without cookies or a referrer, checked for type and size, and held in page memory only. Only after you press a share control does your device pass that card, caption, and attributed public link to the operating-system share service or receiving app you choose. Ventlings cannot see which receiving app you choose, and a resolved request or download click does not prove publication, delivery, download completion, or a recipient visit. Suggestions are entertainment only, not trademark, business-name, domain, handle, plate, registration, or commercial-use clearance. The receiving service applies its own privacy terms.

Halloween Car Costume Matcher

The Halloween matcher accepts one choice from each of three controlled lists: parked-display setting, generic Halloween mood, and animal energy. The three choices stay in page memory and reset when the page is left or reloaded. They are not written to an account, cookie, local-storage entry, session-storage entry, reservation record, order, product configuration, API, or analytics event. A shared URL reveals one of six controlled result slugs plus controlled campaign tags; it does not reveal the three choices, sender, vehicle, plate, photo, face, home, event, location, or identity. Aggregate events may record only a controlled entry, result slug, share channel, request stage, card format, or internal placement—never the complete profile, caption, URL, filename, receiving app, browser support state, error detail, or identity. When native file sharing is available, the selected disclosure-labeled public JPEG may be fetched from this same site without cookies or a referrer, checked for type and size, and held in page memory only. Only after you press a share control does your device pass that card, caption, and attributed link to the operating-system share service or receiving app you choose. A resolved native share request means only that the device accepted the request; it does not prove publication, delivery, a selected app, download completion, or a recipient visit. The receiving service applies its own privacy terms. The page requests no photo; if you independently photograph a display, review plates, faces, house numbers, location clues, and location metadata before sharing.

Spooky car-name guide

The spooky car-name guide is a public editorial list of 24 controlled suggestions. It asks for no name, vehicle, photo, account, email, answer, or free text and stores no guide choice. Aggregate analytics may record a resolved native-share or clipboard request, an email or Pinterest click, a disclosure-labeled Pinterest-card download click, or a landing with the exact controlled `shared=1` flag. Events use only the controlled channel or format and never contain a displayed or chosen name, group, color, car, caption, URL, filename, account, recipient, identity, or free text. A browser resolution, click, download request, or shared flag does not prove publication, delivery, a completed transfer, a recipient, a distinct person, a name choice, product preference, reservation, order, or demand. The guide may open the existing generator or Halloween matcher using only the controlled `spooky_car_names` source. Your browser, email app, and Pinterest apply their own privacy terms when you use those services.

Children

This campaign is not directed to children under 13, and we do not knowingly collect their personal information. A parent or guardian using the browser that submitted a reservation can use the self-service deletion control. A verified recovery channel for requests from another browser must be available before optional marketing or paid checkout opens.

Security and changes

We use access controls and private storage intended to limit unauthorized access, but no online system is risk-free. Material changes will be posted here with a new effective date before they apply.

Paid launch gate: The verified legal seller, staffed privacy contact, lost-key recovery channel, and any jurisdiction-specific disclosures must be published before paid checkout opens.

Contact

For support or privacy questions, email kirkwarren@gmail.com.