Privacy Policy

The widget

The CarCaptcha widget renders entirely in the visitor's browser on a canvas. It sets no cookies, uses no fingerprinting, and does not track visitors across sites. Puzzle interaction data stays in the page and is never uploaded.

What we store

When a site owner uses the hosted verification endpoint, we store the verification token, which puzzle was solved, the requesting origin and a timestamp. This is used to let the site owner confirm a solve and to show recent activity in their dashboard.

For dashboard accounts we store your email address (through our authentication provider), the domains you register, their DNS verification token, and your site and secret keys.

What we do not do

No advertising, no selling of data, no behavioural profiles, no third-party analytics inside the widget.

Self-hosting

CarCaptcha is MIT licensed. If you self-host the script and run your own verification endpoint, no data reaches us at all.

Your requests

You can delete a domain and its keys from the dashboard at any time, which removes the associated verification log entries. For account deletion or data questions, contact the maintainer listed in the repository.