NoneCap extension privacy policy

This policy covers the NoneCap Chrome extension. The extension detects hCaptcha challenges on pages you visit and solves them for you. It takes and sends no screenshot and no page content. Release builds are published on GitHub. For the website and the API itself, see the main privacy policy.

What the extension sends

When the extension solves a captcha, six things leave your browser:

What the challenge needs. When a captcha opens, the extension sends the NoneCap API only what it needs to solve that challenge. It takes and sends no screenshot and no page content. Each request carries a short server-issued session id that groups the requests of one solve.
Details of the captcha and your browser. The captcha's site key and version, the kind of captcha widget, your browser's language and time zone, your browser and operating system as your browser reports them, and the extension's version.
The host domain of the page. We receive the domain only (for example example.com), never the path or query string.
An anonymous install key. A key issued automatically on first run that identifies the install, not you. More on this below.
Your NoneCap API key, if you connected one. Sent only to authenticate your solves against your account.
Solve-outcome pings. Whether a solve succeeded or failed, how many rounds it took, and, when it fails, the reason and a short error message. With an install key they are anonymous; with an API key connected they are tied to your account.

What never leaves your browser

The extension does not collect page content, full URLs, cookies, browsing history, form data, or personal information. On pages without an hCaptcha challenge the extension sends nothing and stays idle.

The anonymous install key

When the extension first runs, the NoneCap server issues it a free-tier key and records the IP address it registered from. The key is not tied to an email address or account, but the server does record the IP addresses it is used from to enforce daily limits and prevent abuse. Resetting or uninstalling the extension discards the key from your browser, and a fresh install gets a fresh key. If you want a discarded key disabled on our side as well, email us and we will revoke it.

Data retention

Solve sessions (the details listed above, the IP used, and request timestamps) are retained for abuse prevention and aggregate statistics. What the extension sends to solve a challenge is used only for that solve; copies kept to debug a solve are deleted automatically. We do not sell this data or share it for advertising.

Your NoneCap API key

Connecting an API key is optional. If you connect one, the extension stores it locally in extension storage and sends it only to the NoneCap API to authenticate your solves. Usage then appears on your account like any other API request, covered by the main privacy policy. Disconnecting the key removes it from the extension.

Contact

Questions about the extension or this policy? Email [email protected].