Privacy
This page describes what the current EphCaptcha code actually collects and stores.
Challenge and token data
When a visitor completes a challenge, EphCaptcha stores a randomly generated token record containing the selected tier, site key when present, the page origin and hostname, interaction timestamps, creation time, 10-minute expiration time, and whether the token has been used. After successful verification, the record also stores when it was used.
The token stops being valid after 10 minutes, but the current storage implementation does not automatically delete expired or used token records. They remain in Netlify Blobs until manually removed.
IP addresses and rate limiting
The token-issuance, token-verification, and funnel-count endpoints read the request IP address to enforce rate limits. EphCaptcha hashes the IP address with SHA-256 before using it as a Netlify Blobs key. The stored rate-limit data contains the hash, a request count, and a window start time; raw IP addresses are not intentionally written to the application’s Blob records.
The current implementation does not set automatic deletion times for rate-limit records. Token and verification rate-limit records are overwritten when that hashed IP starts a later window. Hour-specific funnel rate-limit records remain until manually removed. Netlify may retain infrastructure request logs under its own platform practices.
Browser storage, cookies, and fingerprinting
EphCaptcha does not perform device or browser fingerprinting. The embed widget does not set cookies or use local storage. The EphCaptcha marketing and configuration page uses browser local storage for demo state and once-per-device visitor, free-activation, and funnel-count guards. Those values remain until the visitor clears browser storage.
EphCaptcha’s own code does not set cookies. Stripe may set its own cookies when a customer visits Stripe Checkout.
Service providers
Netlify hosts the site, runs the backend functions, and stores application records in Netlify Blobs. Stripe receives checkout and payment information for paid plans. The current site does not send data to advertising networks, analytics providers, or other third parties.
Contact
Questions about this notice can be sent to ephcaptcha@gmail.com.