Acceptable use policy

VoidCaptcha solves CAPTCHA challenges on behalf of automated software. It exists because a great deal of ordinary, lawful engineering work is blocked by challenges that were designed to stop something else. Typical permitted use includes:

• Automated testing of your own websites and applications, including regression and load testing in CI.
• Uptime, availability and price monitoring of properties you own or are contracted to monitor.
• Accessibility testing and remediation work, including for users who cannot complete visual or audio challenges unaided.
• Data collection you are permitted to perform — because you own the source, have written permission, are exercising a right of access, or are working within what the source expressly allows.
• Security research and penetration testing that is authorised in writing by the owner of the target.
• Academic and journalistic research conducted lawfully and in the public interest.

You may not use VoidCaptcha, directly or through anyone acting for you, for any of the following. This list is illustrative, not exhaustive.

• Unauthorised access. Credential stuffing, password spraying, brute-forcing login or one-time-code flows, session hijacking, or any attempt to reach an account you do not own and are not authorised to use.
• Fraud. Payment fraud, carding, testing stolen card or account data, laundering, or defeating a control whose purpose is to prevent any of those.
• Bulk fake identity. Creating accounts, registrations, reviews, votes, signatures or engagement at scale under identities that are not genuine.
• Spam and unsolicited messaging. Including automated posting, comment and form spam, and evading anti-abuse controls in order to deliver it.
• Interference with a service. Denial of service, resource exhaustion, or automation at a volume or rate intended to degrade a target for its other users.
• Circumventing a refusal. Continuing to automate against a target after its operator has told you to stop, or after you have been blocked in a way that makes their position obvious.
• Unlawful acquisition. Buying inventory in breach of law — including ticketing, where automated purchasing is a criminal offence in several jurisdictions — or evading a purchase limit imposed to make a sale fair.
• Harm to people. Harassment, stalking, doxxing, gathering material for any of those, or anything touching child sexual abuse material.
• Sanctions and export breaches. Use by, for, or on behalf of a person or entity subject to applicable sanctions, or in a jurisdiction to which we are prohibited from supplying the service.
• Reselling as a bypass service. Repackaging the API in a product whose stated purpose is any of the above.

We cannot see, from a task object, whether you are entitled to automate against the target in it. A URL and a site key look identical whether the operator has granted you access or has spent a year trying to keep you out.

So the obligation sits with you. By sending a request you represent that you have the right to interact with that target in that way, and that doing so breaks no law, no contract you are bound by, and no instruction the operator has given you. If you cannot say that honestly about a particular target, do not send it.

We do not read your task payloads looking for wrongdoing, and we retain only the host of a target rather than the full URL. But we do act on what reaches us — abuse reports, notices from target operators, payment-network complaints, and legal process.

Where we conclude this policy has been breached, we may, without prior notice:

• Disable specific challenge types on the account.
• Suspend the account, which signs it out everywhere and stops all solves immediately.
• Terminate the account permanently.
• Preserve and disclose information where we are legally required to.

If you believe we have got it wrong, write to [email protected] and we will look again. We would rather reinstate a good account than keep a bad decision.

If traffic from VoidCaptcha is hitting a property you operate and you believe it should not be, contact [email protected]. Include the target host, approximate times and anything that identifies the pattern. We read that address and we act on it.

This policy forms part of the terms of service, and breaching it breaches those.