Terms of service

1. What this is

RecallDB is a free API that returns recall information from government agencies (NHTSA, CPSC, FDA and USDA FSIS in the United States, plus Health Canada, Transport Canada, CFIA, the UK Food Standards Agency and Product Safety Australia (ACCC)) in a form programs can read. It is run by the CheckRecalls project, which also runs checkrecalls.org. We are independent. We are not part of, and are not endorsed by, NHTSA, CPSC, FDA, USDA or any manufacturer or store.

By asking for or using an API key you agree to these terms. If you do not agree, do not use the API. Questions: support@recalldb.app.

2. Verify with official sources

Recall information can be late, incomplete or wrong, and we make no promise that it is current. Our data is copied from agency records and may differ from what an agency or a manufacturer says today.

The API tells you what a recall notice says. It does not tell you whether a particular car, product or food package is or is not affected. Often only certain dates, lots, serial numbers or VINs are covered. Finding no recall in our data never means a product is free of problems, and a VIN lookup only identifies the model.

Always confirm with the manufacturer or the agency (for example nhtsa.gov/recalls, cpsc.gov or fda.gov) before telling anyone that something is or is not recalled. Do not use the API as your only source for safety decisions. If you show recall data to other people, say that it should be confirmed with the manufacturer or the agency.

3. Free tier (beta)

Each free key may make up to 1,000 requests per month (the count resets on the 1st, UTC) and up to 10 requests per minute. A free key can have 1 watchlist of up to 10 values and 1 webhook; its webhook deliveries are sent together once an hour. The /v1/new feed is served to free keys from a copy that is up to one hour old. Bulk downloads are not part of the free tier.

The free tier is for non-commercial use only. Commercial use means using the API, or data from it, in or for anything that makes money or is run by a business: a product or service you sell or charge for, an app or site that shows ads or takes payments, work you do for a client or employer, or internal tools of a company. Personal projects, study, research, journalism, and non-profit or public-interest projects that charge nothing are non-commercial. If you are unsure, ask us at support@recalldb.app. Commercial use will need a paid plan, which is planned but not available yet (see https://recalldb.app/pricing).

Beta limits may change with 30 days' notice, given on https://recalldb.app/changelog and in a notice field in API responses. Keys created before 2026-11-15 keep the earlier limits (60 requests a minute, watchlists of up to 50 values, webhooks within minutes, /v1/new without delay, bulk downloads, and commercial use) until 2026-12-15.

There is one free key per verified email address. Your key is yours alone: do not share it, publish it, or put it in code that other people can read (for example in a web page or a public repository). Anyone who has your key can use up your limit. Tell us if it leaks and we will replace it.

There is no bulk export. The API returns single records, and you may not use it, with one key or several, to copy the database record by record. Free keys do not come with a promise of uptime or support, and there are no paid plans yet.

4. Attribution is required

Wherever you show data from the API, show the words "Data from RecallDB" with a link to https://recalldb.app. Every response repeats this in its attribution field. Keep the agency name and official link that each response gives, so people can check the source.

Do not present RecallDB data as your own, or as coming from an agency, and do not use agency names, seals or logos to suggest that you or we are an official source.

5. What you may not do

Do not try to get around the limits, for example by making several accounts or keys, or by rotating addresses. Do not collect the data in bulk, probe record numbers in order, or send requests at machine speed beyond the limits. Do not attack, overload or probe the service for weaknesses (if you find a security problem, please write to support@recalldb.app). Do not use the API to break the law, to harass anyone, or to send spam. Do not sell or give away your key.

6. How we watch for misuse

We check usage automatically. Patterns that look like bulk copying (record numbers requested in order, sustained bursts at machine speed (fast batches alone are fine), a very large number of different records in a day, or several keys with similar use from the same network) lead to steps: first a warning in the responses, then a slower limit (3 requests per minute), then suspension. Each step is recorded with its reason. We may also revoke a key at any time, for example for breaking these terms.

A suspended key gets an error that names support@recalldb.app. Write to us with your key id (it is the 8 characters after "rdb_" in your key) and we will look at it.

7. What we store

To give you a key we keep a one-way hash of your email address, not the address itself. We keep a hash of your key, never the key. For limits and abuse checks we keep counts of requests, and hashes of the IP address and network a request came from, which are deleted after 30 days. We do not store VINs you send to the VIN endpoint, and we do not sell or share this information. Your email address is used to send the confirmation link and nothing else.

8. No warranty

The API and its data are provided "as is" and "as available", without any promise of accuracy, completeness, timeliness, availability or fitness for any purpose, whether stated or implied.

9. Limit of responsibility

To the fullest extent the law allows, the CheckRecalls project and the people who run it are not responsible for any loss or harm that comes from using, or being unable to use, the API or its data, including decisions made from it. You use it at your own risk and are responsible for how you use it and what you tell others. Nothing here limits a responsibility that the law says cannot be limited.

10. Ending and changes

You can stop using the API at any time. We can suspend or end access, or end the service, at any time. We may change these terms; the date at the top shows the latest version, and using the API after a change means you accept it.