Privacy Policy
Last updated 23 August 2026
The short version: we collect nothing at all about the people who solve our challenges. No cookies, no local storage, no device fingerprint, no retained IP address. The only personal data we hold belongs to the site owners who buy the product.
What a visitor to your site gives us
Nothing that identifies them. Loading a challenge sends us an HTTP request, which necessarily carries an IP address and an Origin header at the network layer. We use the address only to run a rate limiter, and we never write it down — see Rate limiting below. We set no cookie. We write nothing to localStorage or sessionStorage. We do not compute a device or browser fingerprint. We do not run any analytics, advertising, or tracking code, and we embed no third-party script.
This is not a policy choice we could quietly reverse. The product does not need the data, so the code never asks for it.
Who we are
[Legal entity name], [registered address] (“BlockAgents”, “we”) operates blockagents.ai. For questions about this policy, write to privacy@blockagents.ai.
Where this policy uses controller and processor, it means what the UK GDPR and EU GDPR mean by them. We are the controller of our customers’ account data. For challenge traffic we are, at most, a processor — and in practice there is nothing to process. The DPA covers that relationship in full.
What we collect, and why
1. Site owner account data
When you create a site key we store the label you chose, the domains you allowlisted, and — if you give us one — an email address. We use the email only to send you the secret and to reach you about the service. Lawful basis: performance of a contract, and our legitimate interest in operating the service.
2. Verification counts
We count how many challenges each site key issues per day, so you can see your usage and so we can bill the paid tier. The counter is a number. It carries nothing about who solved anything.
3. Rate limiting
To stop one caller flooding the service we need to tell callers apart. We do that without learning who they are: the IP address is hashed with HMAC-SHA-256 under a salt generated when the server process starts. That salt exists only in memory and is never written to disk, logged, or shared. The hash keys a counter in memory that expires within the hour.
Two consequences worth stating plainly. The stored value cannot be reversed to an IP address by us or by anyone who obtains a memory dump, because the salt would have to be captured at the same moment. And restarting the process destroys the salt, which makes every previously stored hash permanently meaningless.
4. Server logs
Our infrastructure records the ordinary things a web server records: timestamp, path, status code, response time. [Confirm whether the chosen host writes client IPs to access logs, and set the retention window] Logs are retained for [N] days and then deleted.
5. Billing
Paid plans are processed by [payment processor], who acts as an independent controller for the payment data. We never see or store full card numbers.
What we do not collect
- No cookies of any kind, first- or third-party. The widget sets none, and the product works with cookies disabled entirely.
- No
localStorage,sessionStorage, IndexedDB, or cache-based storage on the visitor’s device. - No canvas, font, audio, WebGL, or any other device fingerprint.
- No mouse paths, keystroke timings, scroll behavior, or other behavioral biometrics. Some CAPTCHA vendors treat these as the actual product. We do not collect them.
- No cross-site identifiers, and no profile of a person across the sites that use us.
- No advertising integration. We do not sell, rent, or share data, and there is nothing here that could be sold.
Who we share it with
Our subprocessors, and nobody else. The current list is published at /subprocessors. We will disclose data if a valid legal order compels us; where the law allows it we will tell you first. Note that we could not comply with an order for information about who solved a challenge, because we do not have it.
Where it lives
[Primary hosting region]. Where personal data leaves the UK or EEA, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. See our GDPR page.
How long we keep it
| Data | Retention |
|---|---|
| Open challenge (answer, expiry) | 2 minutes, then deleted. Deleted immediately on a correct answer. |
| Verification token | 5 minutes, or until redeemed — whichever comes first. Redemption deletes it. |
| Rate-limit counter | Under 1 hour, in memory only. Destroyed on restart. |
| Daily usage counts | 13 months, for billing and your usage graph. |
| Account data | Until you delete the site key, then 30 days. |
| Server logs | [N] days. |
Your rights
If you are in the UK or EEA you have the right to access, correct, delete, restrict, and port your personal data, to object to processing, and to complain to a supervisory authority — in the UK, the ICO. Write to privacy@blockagents.ai and we will respond within one month.
If you solved a challenge on somebody else’s site and want to know what we hold about you, the answer is nothing, and we have no identifier we could look you up by even if you asked us to.
Children
The service is sold to businesses and is not directed at children. We knowingly collect nothing from anyone, of any age.
Changes
We will post any change here and update the date above. If a change is material we will email account holders at least 30 days before it takes effect.