About DealScore

The service is operated as DealScore at cardealscore.com. The same product is also called Deal Score. Questions about data go to privacy@cardealscore.com and questions about the terms go to legal@cardealscore.com.

DealScore gives AI agents a price check for used cars. An agent calls the MCP tool score_deal or the REST endpoint POST /api/score with a car (a VIN, or year, make, and model), the asking price, and the mileage. It gets back a grade from Great to Overpriced, a 0 to 100 score, and the expected price band from current dealer listings.

The grade is information about price only. It does not vouch for a car's condition, title, or history. Setup for Claude, ChatGPT, Cursor, and other clients is on the agents page.

• It does not buy, sell, or broker vehicles, and it does not act for you in a purchase.
• It does not sell vehicle history reports or any other report. The only things for sale are the scoring plans on the pricing page.
• It does not sell personal data or share it for other companies' advertising.
• It does not take card details on cardealscore.com. Paid plans check out on Stripe's checkout page.

Deal Score (cardealscore.com) is not DealerScore or CarEdge. It has no connection to dealerscore.app or caredge.com.

This list matches the database tables and cookies the site uses today.

• Account: Created only when you sign in. Your email address, when you joined, your plan, and whether the account is one of our own test accounts.
• Sign-in links: A hash of each emailed sign-in link, not the link itself. Links expire after 15 minutes.
• API keys: A SHA-256 hash and a short prefix of each key, plus its name and when it was created, last used, or revoked. The full key is shown once and not stored.
• OAuth: Codes and tokens are stored as hashes. Codes last 10 minutes, access tokens 1 hour, and refresh tokens 30 days. For each AI client that registers we keep its name, redirect addresses, user agent, and country, plus a log of sign-in steps.
• Scoring: The car details you send are used to compute the grade. We keep a count of scored calls per account per UTC month, and one record per scored call with the account, the time, the channel (MCP, REST, or /try), and the key or client that made it. We do not keep a library of the listings you scored.
• Signed-out free score: One score on /try works without an account. For that we set a cookie and store your IP address with a daily count.
• Billing: Your Stripe customer id, subscription id, and plan. Card details are entered on Stripe's checkout page.
• Sign-up source: Campaign tags (utm) and the referring site's hostname, saved to your account when you sign up.
• Site events: Views and clicks on sign-up and pricing buttons, the start of a free score, checkout started and finished, and use of the sign-in form. These carry a random visitor id, the page test arm, and the AI assistant that referred you, if any. No IP address.
• AI crawler counts: Daily counts of pages fetched by known AI crawlers, by crawler name. No IP address.
• Analytics: Vercel Web Analytics records basic page views.

Cookies:

• ds_session: keeps you signed in. 30 days.
• ds_anon_look: marks that the signed-out free score was used. 400 days.
• ds_attr: holds campaign tags and the referring site until you sign up. 400 days.
• ds_ab: the page test arm and a random visitor id. 90 days. Known search and AI crawlers do not get it.
• ds_landing: which part of the site you first landed on: home, guides, or other. 90 days.
• ds_internal: set only by our own test links so test visits stay out of the counts. 1 year.
• ds_oauth_return: holds your place during an OAuth sign-in. 10 minutes.

The /try form keeps a draft of what you enter in your browser's local storage for up to 1 hour.

When a signed-out score on /try stops at the sign-in prompt, the request and its score result are kept in your browser's local storage for up to 30 minutes, so the result can show again after you sign in.

Retention: cookies expire on the schedule above. Database records have no automatic deletion schedule today. To ask about your data, email privacy@cardealscore.com. The services that process this data are listed in the privacy notice.

Free is 5 scored calls a month with no card. Builder is $19/mo (founding price) for 1,000 scored calls a month. Details are on the pricing page.

• Privacy and data: privacy@cardealscore.com
• Terms and legal: legal@cardealscore.com

Read the privacy notice and the terms.

Is DealScore at cardealscore.com legit?

Yes. DealScore is a used-car price check for AI agents. An agent sends a car, an asking price, and the mileage over MCP or the REST API and gets back a grade, a 0 to 100 score, and an expected price band from current dealer listings. It does not sell cars, and card details for paid plans are entered on Stripe's checkout page, not on cardealscore.com. Sign-in emails are links you request yourself, and each one expires after 15 minutes.

Who runs DealScore?

The service is operated as DealScore at cardealscore.com and is also called Deal Score. You can reach it at privacy@cardealscore.com for data questions and legal@cardealscore.com for questions about the terms.

Is Deal Score the same as CarEdge's deal score or DealerScore?

No. Deal Score (cardealscore.com) is a separate product with no connection to CarEdge (caredge.com) or DealerScore (dealerscore.app). Deal Score (cardealscore.com) is a used-car price check for AI agents that grades an asking price against current dealer listings.

Does DealScore sell vehicle reports or my data?

No. It does not sell vehicle history reports. The only things for sale are scoring plans. It does not sell personal data or share it for other companies' advertising.

What data does DealScore keep?

Your email address if you sign in, hashes of your sign-in links, API keys, and OAuth tokens, a count of your scored calls, and your Stripe ids if you pay. The car details you send are used to compute the grade, and we do not keep a library of the listings you scored. The full list, with cookies and how long each lasts, is in the data section of this page and on the privacy page at /privacy.