Privacy Policy

What we collect

• Account data: your email address, and a hash of your password — never the password itself. If you sign in with Google or GitHub we take only the verified email address they assert.
• API keys: stored as a hash, which is what a request is checked against, and kept in full so you can view and copy a key from your dashboard.
• API usage: for each solve, the time, the sitekey, the URL host, the challenge type, how long it took, whether it succeeded and what it cost. This is what the dashboard reads, and what we use to run, debug, meter, and protect the service.
• Challenge captures: pictures of the captcha widgets a worker sees — the tiles hCaptcha shows — used to train and evaluate the vision model. These are pictures of captcha widgets, not of you or your site.
• Billing data: we use a third-party payment processor for top-ups where card payments are connected. Card details are handled by that processor, not stored by us; we keep a record of your purchases and credit balance.
• Support: the tickets you open and the messages in them.
• Site data: basic server logs (IP address, user agent, pages requested) for security. The marketing pages also send the path you opened to our own API so we can count views; that count has no cookie and no visitor id. Google Analytics counts visitors, sessions and pages. We do not use advertising trackers.

How we use it

We use the data above to provide and improve the service, mint and deliver solve tokens, bill for usage, prevent abuse and fraud, respond to support requests, train the vision model, and understand which public pages people open. We do not sell your personal data.

Who we share it with

Solve data is not sold, shared, or handed to advertisers. We share data only with service providers that help us operate VanishCaptcha, each under terms that limit their use of it, and when the law requires it or to protect the service.

The parties involved in running it today: hCaptcha, which issues the tokens; Cloudflare Turnstile on the sign-up form, if it is enabled, which sees your IP address for that one request; Google Analytics, which receives the pages you open and sets its own cookies; a payment processor for top-ups, if card payments are connected; and an email provider used to send verification and password-reset messages. The sitekey and URL you submit are used by our solving infrastructure to produce a token and are not shared for advertising.

Cookies

Your signed-in session is a token held in your browser's local storage, sent only to this API. Signing out removes it. Google Analytics sets its own cookies so it can tell a return visit from a new one. The page-view count we keep for the ops screen does not use a cookie. We do not use advertising trackers.

How long we keep it

We keep account, billing, and solve records for as long as your account is active. Page-view counts are kept for 90 days and then deleted. Challenge captures are deleted automatically after a short retention window, and a small sample may be kept longer as training data. Nothing about a capture identifies you beyond the sitekey and host you sent.

Security

The site and API are served over HTTPS, API keys authenticate every solve request, and passwords and keys are stored as hashes. No system is perfectly secure, so we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. Deleting your account from Settings erases the account, its API keys, its ledger and its support tickets. Challenge captures already in the training set are not tied to your account and are aged out on their own schedule. To ask about anything else, open a ticket from Support.

Changes

We may update this policy. When we do, we will change the date below. See also the Terms of Service.

Contact

Questions about privacy? Email Contact@vanishcaptcha.com, or open a ticket from Support once you have an account.