Privacy policy

Information we handle

• Sign-in identity. Your chosen provider (GitHub, Google, X, or Telegram), its stable account identifier, display name, and username if provided. For Google sign-in, we also request and save the verified email address for public outcome lookup. When your provider supplies a supported profile picture, we save a small copy and display it with your account and result cards. Missing or unavailable pictures use an initial instead. We do not save the original provider picture URL.
• Game records. A run identifier, a snapshot of your sign-in identity, start and finish times, challenge progress, mistake count, run status, and challenge version. Answers are processed to check progress; the application database does not retain the submitted answer text or slider/rotation values.
• Authentication records. Temporary login state, a PKCE verifier and nonce, and a hash of the session token used to keep you signed in.
• Voice challenge. This is an honor-system acknowledgement. The game receives your button confirmation, without microphone access, audio recording, upload, or speech analysis.
• Support correspondence. If you email us, we receive your email address, message, and anything you choose to include.
• Technical information. Our hosting provider processes connection information, such as IP address, browser information, and requests, to deliver and protect the site. The game's account and run tables do not store your IP address.
• Traffic metrics. Server code records request categories, HTTP status codes, response timings, and sign-in provider outcomes in Cloudflare Analytics Engine to monitor traffic and service health. These metrics do not include IP addresses, cookies, account identifiers, names, usernames, result identifiers, full URLs, query strings, answers, or recordings. No analytics script or additional tracking cookie is added to your browser.

We do not ask for your provider password. The game requests and stores your verified Google email address for outcome lookup. Other sign-in providers are not asked for email addresses. We do not request or store phone numbers, repositories, or private messages through social sign-in. Email addresses you voluntarily send to support are handled as support correspondence.

How we use information

We use sign-in information to identify the account playing, maintain your session, associate game progress and results with that identity, show the result to people with its link, and provide the latest completed outcome through a public lookup by username or verified Google email. We use support correspondence to respond to requests, and technical information to operate, troubleshoot, and protect the service.

Google sign-in requests basic identity, profile information, and your email address. Telegram sign-in requests basic identity and profile information. X sign-in requests the provider's required user and post read permissions for its profile endpoint; our implementation uses them to fetch your account profile, not to read posts. GitHub sign-in requests your public profile without repository or email permissions. Provider access and refresh tokens are not saved in our application database or used for ongoing access after sign-in.

We do not sell personal information, use it for targeted advertising, or use sign-in information to train AI models. The site currently includes no advertising or third-party analytics scripts.

Game outcomes and entry declarations are satire. We do not use them to determine your nationality, citizenship, ethnicity, or political views.

Public results and sharing

Anyone with a completed result's URL can view it without signing in, copy or download its card, and share the link again. The result exposes its provider, display name and username if available, profile picture when available, game outcome, timing, progress, and mistake count through the result page or its public data endpoint. Saved profile pictures are also readable without signing in by anyone who has their unlisted image URL.

The public outcome API at /:platform/:identifier/outcome lets anyone look up the latest completed outcome by provider and username, or by the full verified email address for Google, without signing in or knowing a result URL. Anyone who knows your Google email address can query this outcome. The API response contains only the outcome and completion time; your email address is not added to result cards or returned in public result data. It returns NA, pass, or fail, plus the time that run finished (completedAt), or no timestamp for NA. Outcomes do not automatically expire. Starting an unfinished replay does not replace the last completed outcome. Google email addresses are captured at sign-in; players who signed in before email collection began must sign in again to enable email lookup. Other accounts without a provider-supplied username cannot be found through this lookup. Stored usernames and Google email addresses refresh when you sign in, so the lookup can be out of date after a profile change. Email matching ignores case but does not combine aliases or remove dots or plus tags.

Result URLs are unlisted and excluded from search indexing by site instructions. They are not private or password protected. Do not complete a run with an identity you do not want associated with its result.

Results keep an identity snapshot from the run, including its saved profile picture when available. Changing your provider name or picture later does not update an existing result. Older results without a saved picture continue to use initials. Signing out or revoking provider access does not remove a result or its saved picture.

Copying or downloading a card happens in your browser when you select that action. We do not automatically post it to a social account or send it to your contacts. Copies other people save or publish are outside our control.

Cookies and browser storage

We use essential cookies for login state and your session. Login state is valid for ten minutes; a session is valid for seven days unless you sign out sooner. On the live HTTPS site, these cookies are Secure, HttpOnly, and SameSite=Lax. The database stores a hash of the session token rather than the token itself.

Your browser also uses tab-local session storage to remember the last entry declaration shown and avoid repeating it. Declaration text and checkbox choices are not sent to the server or attached to your identity or results. This storage is not an advertising identifier.

You can clear site cookies and storage in your browser. Blocking essential cookies prevents sign-in from working. Clearing cookies does not delete server records; use the contact process below for that.

Service providers and disclosure

The optional audio challenge plays a song preview directly from Apple Music. Playing the clip connects your browser to Apple's audio servers, which receive your IP address and browser request information. DPRKaptcha does not include your sign-in identity or game answers in that request.

Cloudflare hosts the site, server code, and application database, and routes support email to our support inbox. Our email provider processes support correspondence. These services process information as needed to deliver, maintain, and protect the service, and may process it in countries other than yours. See Cloudflare's privacy policy.

Your chosen sign-in provider handles authentication under its own policies: GitHub, Google, X, or Telegram. Signing in requires communication with that provider. If you share a result on another service, that service's policies apply to your post.

Access to nonpublic application records is limited to operating and supporting DPRKaptcha and the service providers involved. We may disclose information when legally required or when necessary to address abuse, security incidents, or threats to people's rights or safety. We do not give advertisers access to sign-in data.

How long records remain

Account and game records currently have no automatic deletion schedule. They remain in the application database unless removed through a deletion request or service maintenance. This includes completed results and records of abandoned runs. An abandoned run stops being playable after two hours; that does not delete its record.

Expired login transactions and session records are removed in bounded cleanup runs scheduled every five minutes and during later sign-ins. Expiration ends their validity even before that cleanup occurs. Signing out revokes the current server session.

Cloudflare Analytics Engine retains traffic metric data for three months.

Removal from the active application database does not recall copies already downloaded or shared by others. Hosting recovery copies may retain earlier data under the provider's backup and recovery practices.

Your choices and requests

For questions, a copy of your information, corrections, or deletion of an account and its results, email support@dprkaptcha.com. Include your sign-in provider and public username if available, and any relevant result links. Do not send passwords, access tokens, or client secrets.

Requests are handled manually; there is no automatic account deletion control in the game. We may ask you to demonstrate control of the relevant provider account before changing or deleting records. We will explain any request we cannot fulfill, including information that must be retained by law. Your privacy rights may depend on where you live.

You can also revoke DPRKaptcha's access in your provider's account settings. Revocation stops that authorization; it does not itself delete records already held by the game.

Children

DPRKaptcha is not directed to children. Use it only if you meet your chosen sign-in provider's minimum age and eligibility requirements and the requirements of applicable law. If you believe a child has provided information inappropriately, contact us so we can review and remove it where appropriate.

Changes to this policy

We will update this page and its date when our practices change. If we propose a materially different use of sign-in data, we will provide notice and obtain any required consent before using existing data in that new way.