It works wherever your visitors are.

Nothing on the widget path touches a Google domain, so the challenge behaves the same on privacy browsers, hardened networks and in regions where those services are unreachable.

Get started free Read the docs

How it works

No third-party request to fail

A captcha that depends on a blocked domain does not degrade - it stops the form working at all. Ours has nothing external to block.

Privacy browsers are ordinary visitors

Hardened browsers are not penalised for being hardened. They are scored on the same signals as everyone else.

No country-level gating

We do not block regions or carriers. A mobile NAT can sit in front of thousands of real subscribers, so difficulty is sized per request instead.

What that means concretely

Each of these is a statement about how the product behaves, not a description of how we feel about it.

No request to any Google domain on the widget path.

Fonts are self-hosted, not fetched from Google Fonts.

No region or carrier is blocked outright.

Other features

Privacy and GDPR Risk scoring Proof-of-work Accessible challenge Drop-in migration Per-site dashboard

No Google dependency in PrivCaptcha: common questions

What no google dependency actually does, and where it stops.

No. The widget, its assets and its fonts are all served from our own domain. Even the web fonts are localized rather than pulled from Google Fonts, which is the detail most privacy reviews catch.

No. Blocking trackers, refusing cookies or hiding behind a VPN is not treated as evidence of a bot. There is no ad profile to be missing from in the first place.

The widget loads normally, because nothing it needs lives there. Networks that break reCAPTCHA do not break this.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

Change two lines. Keep the rest.

10,000 verifications a month are free, and the integration is the one you already have.

Get started free See the migration guide