Privacy policy

Account. Your email address, a bcrypt hash of your password, your role, balance, thread limit and which challenge types are enabled. We never hold your password itself.

Sessions. A hash of each session token, plus the user agent and IP address the session was created from, so you can tell your own sessions apart from one you do not recognise. The token itself only ever exists in your cookie.

API keys. A SHA-256 hash used for authentication, and a separately encrypted copy so the dashboard can show you your own key. The encryption secret is held apart from the database.

Solve records. For each request: the challenge type, the literal task type string, whether it succeeded, what it cost, how long it took, any error code, and the host of the target.

Billing. A ledger of credits, debits, refunds and adjustments with a running balance, so your account history reconciles without us having to replay it.

We also do not retain the solution. The token or cookie we return is passed through in the response and not written to the solve record — we keep that a request succeeded, not what it produced.

We do not hold your proxy credentials beyond the life of the request that used them, they are never written to a log line, and they are stripped from error messages before those reach you.

We do not use third-party analytics, advertising or tracking scripts on this site. There is no advertising identifier and nothing to opt out of.

All three are strictly necessary or purely functional. None are used for tracking.

• vc_session — your session. HttpOnly, so no script can read it. Expires after 30 days.
• vc_signed_in — a flag saying somebody is signed in, so the cached marketing pages can offer a dashboard link instead of a sign-in link. Carries no identity and grants nothing.
• vc-theme — light or dark, stored in your browser only.

• Email delivery. Verification codes, welcome messages and password resets are sent through a transactional email provider, which necessarily sees your address and the contents of those messages.
• Payments. Top-ups are handled by a cryptocurrency payment processor. They see the transaction; we see a confirmation and credit your balance. We never receive card details.
• Hosting and database. Our infrastructure provider stores the data described above on our behalf.

We do not sell your data, and we do not share it for anyone else’s marketing. We disclose it only where we are legally compelled to, or where it is necessary to investigate abuse reported to us.

• Account and billing records: for as long as the account exists, and afterwards only as long as tax and accounting obligations require.
• Solve records: retained so you can audit your own usage and so we can investigate abuse.
• Sessions: until they expire or you sign out. A password reset deletes every session on the account immediately.
• Verification codes and reset links: minutes to an hour. Only a hash is stored, and it is destroyed on use.

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to processing, or to complain to a supervisory authority. Write to [email protected] and we will act on it.

Deleting an account removes it, its keys, its sessions and its solve history. Ledger entries may be retained where we are required to keep financial records, and abuse records may be retained where deleting them would let the same abuse resume.

Passwords are hashed with bcrypt. Session tokens, API keys, verification codes and reset links are stored only as SHA-256 hashes, so a database leak cannot be replayed into an account takeover. API keys carry a second AES-256-GCM encrypted copy so you can read your own key back; that requires both the database and a separately held secret.

Email addresses are confirmed by code before an account becomes usable, and a password reset invalidates every existing session. No system is perfect — if you find a weakness, please tell us at [email protected] before telling anyone else.

Material changes to this policy will be announced in the dashboard and the date at the top of this page will change. For anything not covered here, write to [email protected]. See also the terms of service and the acceptable use policy.