Humans see it, agents don’t

The characters are a motion-defined form. A field of dots drifts across the canvas in two opposed directions, and a dot is drawn only where its population belongs — one direction inside the glyph, the other outside. Nothing in any single frame marks the boundary: not brightness, not contrast, not density. Measured across twelve challenges, dot density inside the glyph divided by density outside it is 1.0136, where 1.000 means no cue at all. A screenshot is worthless, and so is averaging every frame together.

Recovering it means reading the motion field, which your visual system does for free. Each challenge picks its heading at random, so the axis cannot be assumed. The answer itself is generated on our server and never sent to the browser — it is compared there exactly once, so there is nothing in the page to read.

They will, and we've built for it. The product isn't one clever challenge, it's a generator that produces families of them plus the eval harness that tells us when a family is dying. We retire families on the way up, not after they break. If a family ever clears chance on a frontier release, you'll read it on this page before you read it anywhere else.

Worth saying plainly: a solver written specifically against this mechanism beats it today. We publish the measurement rather than leaving you to find it — see what it stops and what it doesn't.

They can, and that's the point — we're pricing that path, not pretending it doesn't exist. A challenge expires two minutes after it is issued, the resulting token five minutes after that, and redeeming it destroys it. That bounds the relay window; it does not close it. What's gone is the cheap automated tier, so every attack has to run through human labor at human throughput.

A challenge is about 133KB, plus a 12KB widget. That is in the same range as an image CAPTCHA — reCAPTCHA's image grids run 150–250KB — and well under a third of what shipping the equivalent as video would cost.

No video is transmitted. The server sends a short loop of dot positions and the browser draws them, so there is no decoder involved and the loop plays at 60fps without touching the network again. Nothing animates while the widget is off screen.

About the person solving the challenge, nothing. No cookie, no localStorage, no device fingerprint, no behavioral signals, no cross-site identifier, and no retained IP address. Rate limiting needs to tell callers apart, so the address is hashed under a salt that lives in memory, is never written down, and is destroyed when the process restarts.

We hold your account — a label, a domain list, an optional email and a daily counter. That is the whole of it. Full detail in the privacy policy.

The short version is that there is very little to comply about. We set no cookies and read nothing from the device, so there is no storage or access for ePrivacy to bite on and nothing for a consent banner to gate — the challenge runs before anyone clicks accept.

An IP address reaches us at the transport layer, as it does for any HTTP request, and it is personal data. We use it transiently to rate-limit and never retain it. The lawful basis is legitimate interest under Article 6(1)(f) — network and information security, which Recital 49 names explicitly — and the balancing test is close to trivial when nothing is kept.

There is no third-country transfer question of the kind that has repeatedly put Google reCAPTCHA in front of European regulators, because nothing about your visitors is sent anywhere. The DPA applies automatically on Article 28 terms, the subprocessor list is published, and the GDPR page has the Article 30 entry ready to paste. Have your DPO read those rather than this box.