A captcha you can defend to your DPO.

A captcha sits on your login, your checkout and your contact form - the most sensitive pages you own. That makes it the last place you want a third party building a profile of the person filling them in.

Get started free Read the docs

How it works

Your visitors' IP addresses are never stored

An address exists as a local variable for the length of one request and is then gone. What we keep is an HMAC of it under a salt that is random, lives only in Redis and rotates every day - so yesterday's hashes cannot be linked to today's, and no hash can be walked back to an address even by us. The counters under it expire after 24 hours.

No cookies, no fingerprint, no ad-tech

We set no tracking cookies, build no device fingerprint and sell nothing to anyone. Scoring uses what the request itself reveals - headers, and that client's own recent failures. There is no cross-site identifier because there is nothing to correlate.

Nothing loads from an ad network

No Google domain is contacted, and the fonts on this site are self-hosted rather than fetched from Google Fonts. Your visitors' browsers talk to us and to nobody else, which is the part that makes the paragraph in your privacy policy short.

What that means concretely

Each of these is a statement about how the product behaves, not a description of how we feel about it.

No raw IP address is written to Postgres, Redis or any log.

The IP-hashing salt is random, Redis-only, and rotates every 24 hours.

Failure and solve counters expire 24 hours after they are written.

Zero personal data points sold. There is no data-sharing relationship to disclose.

Deleting a user deletes their sites, enforced by the schema, not by a cleanup job.

Other features

Risk scoring Proof-of-work Accessible challenge Drop-in migration No Google dependency Per-site dashboard

Privacy and GDPR in PrivCaptcha: common questions

What privacy and gdpr actually does, and where it stops.

A truncated HMAC of the IP address under a salt that rotates daily, plus solve and failure counters that expire after 24 hours. No raw address, no cookie, no cross-site identifier, nothing that outlives the day it was written.

No. The salt that produced yesterday's hashes is gone, so there is nothing left to match an address against. That is a property of the design rather than a policy we promise to keep.

The widget sets no cookie and loads nothing from a third-party domain, so there is no consent-gated storage to disclose. Your own legal review still governs how you describe processors - we are one, and the data we process is the list above.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

Change two lines. Keep the rest.

10,000 verifications a month are free, and the integration is the one you already have.

Get started free See the migration guide