Privacy policy

1. Scope and responsibility

This policy covers the easycaptcha.to website, dashboard, browser extension, customer API, free plan, and affiliate and developer programs. easycaptcha.to is responsible for the processing described here. References to "we", "us" and "our" mean easycaptcha.to.

You can read public pricing and documentation without an account. Using an account or submitting a task involves additional information described below. Registration requires an email address and password.

If you use the API to submit someone else's information, you are responsible for having a lawful basis and providing any notices required for your own use. A separate data-processing agreement may govern a business customer's submissions where applicable; it does not replace this policy for information we handle for our own account, billing and security purposes.

2. Information we process

Website and connection information

When your browser or application connects, the service receives the IP address and information needed to handle the request. Depending on the request, this includes its time, requested route, browser or client information, response status and diagnostic identifiers. This information supports delivery, troubleshooting, rate limits and protection against abuse.

The public website stores a color-theme preference in your browser. It loads Plausible Analytics to measure page views and selected actions on the public site and dashboard. Plausible receives the page URL, referrer, browser and device information, and event names with limited properties. Payment events may include the USD amount and currency; registration, login, API-key, support-ticket and affiliate events do not include account identifiers, email addresses, credentials, payment IDs, wallet addresses, task contents or support messages. We do not load advertising pixels or remotely hosted fonts. Images and fonts are served as part of the website.

Accounts and credentials

Account information includes an account identifier, registration date, status, permissions, email address and records needed to manage access. We store salted password hashes to verify account credentials, along with API-key records and key usage metadata. Account support tickets use your account email for ticket notifications.

Account activity may be associated with tasks, payments and security events. A display label you choose for an API key can also contain personal information, so use labels that do not reveal unrelated sensitive details.

Email verification, password recovery and email changes use verification records and time-limited tokens. Account emails are delivered through Resend, which receives the destination address and notification content. If you enable two-factor authentication, we store an encrypted authenticator secret, recovery-code verifiers, and registered security-key credential identifiers, public keys and verification metadata. We process authentication challenges and verification responses to secure sign-in and account changes. Device biometrics used to unlock a security key are handled by your device; we do not receive your fingerprint or face scan.

Free-plan information

The free extension plan can be used without an account. We keep a plan identifier, credential verifiers, issuance records, an IP-address digest used to enforce issuance limits, and usage and allowance records. A digest is not necessarily anonymous information. Free tasks still involve the task and connection information described in this policy.

Referral and developer attribution

Following a referral link stores a referral code in a cookie for up to 30 days. Registration may retain that code with your account. We record referral relationships, developer tags on paid requests, earned bonuses, commissions and daily balance credits to operate the affiliate programs. These records link the referring or developing account to eligible deposits or task charges so we can calculate earnings and reversals. Program dashboards show referral counts and aggregate earned, credited and pending amounts; they do not expose referred customers' emails, credentials, task payloads or solutions. Payout approval requests are handled through support tickets, including information you provide for eligibility, fraud-prevention or legally required checks.

Tasks and results

The extension or your API integration sends the information needed to process a challenge. Depending on the task type, that may include a challenge object, challenge images or references, the target page URL, a site key and related challenge parameters. We process the returned answers or token, task status, timing and any outcome feedback you submit.

Only submit information needed for the challenge. A URL can itself contain personal information, such as an account reference or query parameter. Avoid sending unrelated page content, passwords or private documents.

Payments and usage

Payment records include the requested USD amount, receiving address, quote and expiry, observed transaction references, confirmations, credited amounts and invoice information. We also keep charges, credit adjustments, balances and usage totals linked to the account and relevant key records.

Messages you send us

If you contact sales, support or the abuse channel, we receive the contact details and message you provide. This may include attachments, screenshots, task or request identifiers and correspondence about the issue. Remove unrelated information before sending a report. Do not send a password or complete API key.

Contact requests are stored as tickets with their category, messages, contact address, and status. Account tickets are linked to your account. Anonymous tickets have a private link; anyone with that link can read and reply to the conversation, so keep it safe. Email updates are required for ticket replies and status changes. Resend receives the destination address and notification content when we send these updates. We do not verify ticket email addresses before sending updates.

3. Purposes and legal bases

We use information to deliver requested tasks, operate accounts, maintain balances and invoices, attribute referrals and developer requests, calculate bonuses and earnings, review payout requests, respond to messages, investigate problems, prevent abuse and meet applicable legal obligations. We may use aggregated usage and feedback statistics to assess service quality. Aggregating data does not make it anonymous if a person can still reasonably be identified.

Where the General Data Protection Regulation or a comparable law requires a legal basis, the bases depend on the purpose:

• Contractual necessity for providing the service you request, maintaining your account, processing service payments and administering programs you activate or referral bonuses you request.
• Legitimate interests for securing the service, preventing fraud and misuse, diagnosing failures and handling service-related correspondence, subject to your rights and the required balancing of interests.
• Legal obligations for records, disclosures or responses that applicable law requires, including accounting and valid regulatory requests.
• Consent where a particular optional activity requires it. You may withdraw that consent without affecting processing that was lawful before withdrawal.

We do not treat acceptance of the Terms as blanket consent to every use of personal information. If information is required to fulfill a task or operate an account and you do not provide it, we may be unable to provide that part of the service.

4. Cookies and browser storage

The public website uses local browser storage to remember your appearance preference. The dashboard uses browser storage and essential cookies to maintain account access. The extension stores its configured API key, free-plan credentials and preferences so it can operate on the sites you enable.

Referral links use the easycaptcha_referral cookie to remember a referral code for up to 30 days. The first stored code is retained rather than replaced by later links. Registration may save the code with your account, and payment creation may use it to assign a referrer. An explicit code entered for a payment takes precedence before a referrer is attached. You can enter a referral code without relying on this cookie.

Appearance and sign-in storage support your preferences and account access. Referral storage is used for program attribution and is not required to browse the website or use the service. We do not use these storage functions to build advertising profiles.

You can clear site storage using browser settings. Doing so can reset your appearance preference, remove a saved referral code or sign you out of the dashboard. Removing a referral cookie does not remove a code already saved at registration or an established referral relationship. Blocking essential storage may prevent account features from working. Clearing browser data does not by itself delete server-side account, task or payment records.

5. Sharing and disclosures

We do not sell personal information or share it for targeted advertising. Information may be available to the following recipients where necessary for the purposes described in this policy:

• Authorized personnel and service providers supporting hosting, storage, communications, service operations and troubleshooting, with access limited to what their work requires.
• Payment and accounting recipients where necessary to process a payment, prepare an invoice or comply with a financial obligation.
• Authorities or other parties when a valid legal requirement compels disclosure, or when disclosure is necessary and lawful to protect rights, investigate fraud or address a serious security threat.
• A prospective or actual successor in a merger, acquisition or business transfer, subject to appropriate confidentiality measures and applicable notice obligations.
• A recipient you ask us to share information with, where the request is lawful and we can verify your authority.

Providers processing information on our behalf must use it for the agreed purpose and comply with applicable confidentiality and data-protection requirements. Contact us if you need further information about recipient categories or arrangements relevant to your account.

Submitting a token or answer to a target website may disclose it to that website through your browser or application. The target website's use of that information is governed by its own privacy practices.

6. Public payment records

Cryptocurrency transactions are recorded on public blockchains. Addresses, transferred amounts, transaction identifiers and timing may be visible to anyone and can sometimes be linked to other activity. Do not assume that a payment is private simply because a wallet address does not contain your name.

We cannot edit or erase an independently maintained public blockchain. Deleting information from our systems does not remove public transaction records or copies held by independent third parties.

7. Retention and deletion

Different records have different retention needs:

• Task payloads and results are normally scheduled for deletion five minutes after the task reaches a completed or failed state. Retrieve results before the availability window ends.
• Task history keeps summaries of your latest 50 tasks for at most seven days from submission. These summaries include the task identifier, type, outcome, original charge and timing, without payloads or solutions.
• Account and credential records are retained while needed to provide and protect the account. Revoked key identifiers and labels may remain associated with usage history after the secret no longer grants access.
• Payment, invoice, charge and credit-adjustment records are retained for accounting, resolving disputes and applicable legal obligations. Their retention is separate from task-result expiry.
• Referral relationships, developer attribution, bonuses, earnings, settlements and payout-review records are retained while needed to administer the programs, correct reversals, resolve disputes and meet applicable accounting or legal obligations. Cookie expiry and task deletion do not erase these records.
• Free-plan issuance, credential and allowance records are retained while needed to operate the plan and enforce usage and abuse-prevention limits.
• Connection, security and diagnostic records are retained for as long as reasonably necessary to troubleshoot problems, investigate abuse and protect the service.
• Support and abuse correspondence is retained for handling the report, related follow-up and any legitimate dispute or recordkeeping need.

For records without a fixed period stated here, the criteria include the record's purpose, whether the account remains active, applicable recordkeeping requirements, unresolved disputes and the need to investigate a security event. We do not retain personal information indefinitely merely because storage is available.

Deletion from active systems may not immediately remove a copy from a backup. Backup copies remain protected and are removed or overwritten through the applicable backup lifecycle. If a backup is restored, deletion requirements still apply. We may preserve necessary records longer where law or a specific legal claim requires it.

Contact us for information about the retention criteria applicable to your records or to request deletion. Closing an account does not require us to erase information that we must lawfully retain.

8. Security

We use measures intended to protect information against unauthorized access, loss and misuse, including encrypted website connections, credential verification and access restrictions. Complete passwords and API keys should not be included in routine diagnostics or support correspondence.

No service, device or transmission method can guarantee absolute security. Protect your account password, use separate API keys for installations, revoke a key if it is exposed and keep your browser and extension current. If we become aware of a personal-data breach, we will take appropriate steps and provide notices where applicable law requires them.

9. International processing

Your location and the locations of service providers may differ. Where personal information is transferred across borders, we will apply the safeguards required by the laws that govern the transfer. For information subject to European data-protection law, these may include an applicable adequacy decision or approved contractual safeguards.

Contact us to ask about processing locations and safeguards relevant to your information, or to request a copy of applicable transfer safeguards where you are entitled to one. We may redact information necessary to protect confidential terms or another person's rights.

10. Your rights and choices

You can disable the extension globally or for the current site, remove its saved key, revoke keys in the dashboard and stop submitting new tasks. A task already submitted may continue to completion. These controls do not delete all server-side records.

Depending on your location and the applicable law, you may have rights to:

• Ask whether we process your personal information and obtain access to it.
• Correct inaccurate information or complete information that is incomplete.
• Request erasure of information where the legal conditions are met.
• Restrict processing in applicable circumstances.
• Object to processing based on legitimate interests.
• Receive eligible information in a portable format and, where applicable, request its transfer.
• Withdraw consent for processing that relies on consent.
• Challenge a qualifying decision based solely on automated processing and request the safeguards required by applicable law.
• Complain to the relevant data-protection authority.

Use our Privacy contact form to make a request. Describe what you need and provide a non-secret account, payment or request reference if available. Do not send your password or API-key secret. We may ask you to verify control of the account or otherwise confirm your identity before disclosing or changing information.

We respond within the time required by applicable law. Where GDPR applies, that is normally within one month, subject to permitted extensions and the required notice. Rights are not absolute; a request may be limited by legal retention duties or another person's rights. We will explain an applicable refusal or limitation. We do not require you to contact us before complaining to an authority.

11. Automated processing

The service automatically processes challenges, tracks task status, calculates charges and applies account limits. Automated checks may reject a request because credentials are invalid, available credit is insufficient or a request limit has been reached.

If you believe an account restriction or charge is incorrect, contact us with the relevant identifiers so it can be reviewed. Where an automated decision has a legally significant or similarly significant effect and applicable law gives you additional rights, you may request the required explanation, human involvement and opportunity to contest it.

12. Children and sensitive information

Users must meet the eligibility conditions in the Terms of service. We do not seek to collect children's personal information in violation of applicable law. If you believe a child has provided information without legally required permission, contact us so we can review and take appropriate action.

Do not submit medical records, government identifiers or other sensitive information that is unrelated to a challenge. If you choose to disclose sensitive information in correspondence, include only what is necessary for the request.

13. Other websites

This policy does not govern independent websites, browser stores, wallet providers or captcha providers. Links and integrations do not give us control over their information practices. Review their policies when you use those services.

14. Changes to this policy

We may update this policy as the service or our information practices change. The date at the top identifies the latest revision. We will give notice of material changes where required and will obtain consent before a new use where applicable law requires consent.

15. Contact

For privacy questions or rights requests, use the Privacy contact form. For abuse reports, use the abuse reporting page. Include enough information to locate the relevant records without sharing secret credentials.