Privacy policy
Two different things are covered here: this website, and the plugin you install. They collect different data, so they are described separately.
Last updated 29 July 2026.
This website
These pages are static files. There is no analytics script, no tracking pixel, no advertising network, no embedded video, and no web font loaded from anyone else’s server. Nothing on this site sets a cookie.
Our web host records ordinary server access logs — IP address, time, page requested, browser user agent — as every web server does. They are used to keep the site running and to investigate abuse, and they are not combined with anything else or shared.
If you email us, we keep the email so we can answer it and refer back to it if you write again. If you buy a licence, our payment processor handles the transaction and receives your billing details; we see your email address, your licence, and enough of the payment record to issue a refund. We never see or store full card numbers.
The plugin, on your site
CaptchaFlow is privacy-first by design. It is your site’s data, held on your own server, and we cannot see it.
What it records
For each protected submission the plugin writes one log row: the time, which form it came from, whether it was allowed or blocked, the reason code for that decision, and — if you have not turned it off — a shortened IP address. IPv4 addresses are cut to their network (the last part is removed) and IPv6 addresses are cut harder still, before anything is written. Turn on full anonymisation and no IP data is stored at all.
Email addresses are never stored in the log in readable form. Where an address is needed to link a submission back to a person — for the WordPress export and erase tools — it is stored as a one-way hash that is unique to your site and cannot be reversed into an address.
Logs are pruned automatically on a schedule you control, and you can empty them at any time.
What leaves your site
If you choose a managed challenge — Cloudflare Turnstile, Google reCAPTCHA or hCaptcha — the visitor’s browser talks to that provider, and your server sends the resulting token to that provider to be verified. That is a contact with a third party, and it is governed by that provider’s own privacy policy. The plugin generates suggested privacy-policy wording naming the provider you actually chose, ready to paste into your own policy.
Choose the self-hosted Math or Question challenge and nothing leaves your site at all. No third party is contacted, and no data is sent anywhere.
Beyond that, the free plugin phones home for nothing. There is no usage tracking, no telemetry, and no “anonymous statistics” prompt.
Pro licences and updates
A Pro site contacts our licence server to activate its licence and to check for updates. That request carries the licence key, the site address, and the installed version — enough to confirm the licence is valid and to offer the right update, and nothing more. It does not carry your logs, your settings, your visitors, or your content.
Pro features that send data anywhere are opt-in and clearly labelled as such in the plugin. If you do not switch them on, they never run.
Your rights
For data on your own site, the plugin plugs into the WordPress privacy tools: Tools → Export Personal Data and Tools → Erase Personal Data will include CaptchaFlow’s records automatically. Erasing removes the personal parts of a row and keeps the anonymous counter, so your statistics do not silently change.
For data we hold — your email, your licence, your purchase record — write to [email protected] and ask for a copy or for deletion. Deleting a purchase record ends the licence it belongs to, so we will confirm before doing it.
Changes
If this policy changes materially, the date at the top changes with it and the change is noted in the changelog.
CaptchaFlow is made by TemplateSell. Questions about this policy: [email protected].