Privacy policy
What the service collects and why.
Draft for review by your own counsel before launch.
What the widget collects. Facts about the browser (user agent, languages, screen size, timezone, graphics renderer, automation flags), counts of pointer and key events (never what was typed or where), and how puzzles were solved (pointer paths inside the puzzle). It sets no cookies and uses no local storage.
What we keep. Per-check events for analytics: the site, outcome, country, network (AS number), detected agent and the reasons for the score. IP addresses are never stored; rate limits use a hash of the IP salted with a secret that changes daily. Raw signals are discarded once the check is scored. Analytics events are kept for up to 90 days by our analytics provider and shown in the dashboard for 30.
Why. Only to tell people from bots on the sites that use the service. Nothing is sold, used for advertising, or combined across sites to follow people.
Processors. Cloudflare, Inc. hosts the service. Resend sends account emails.
Account data. Dashboard accounts store name, email, a password hash (if you use one) and organization membership, until you delete the account.