FCaptcha hosted demo and research consent

The FCaptcha live demo runs the current production detector in interactive and invisible modes. It is useful for checking browser behavior and accessibility without deploying a server first. The page is hosted on WebDecoy’s product site; its FCaptcha widget sends verification and scoring requests to the API service at fcaptcha.webdecoy.com.

Optional research contribution

The demo includes an unchecked research-consent control. Consent is off by default and resets on every page load. If you opt in, one privacy-reduced sample from each demo endpoint may be retained for up to seven days for false-positive and automation-detection research.

You can also self-report the primary input method: mouse, trackpad, touch, or keyboard. This label is exploratory evidence, not trusted ground truth and never contributes to a published false-positive rate or release gate.

What the demo does not retain

The research record excludes:

• form values and key values;
• full IP addresses and full user agents;
• widget or session identifiers;
• challenge nonces;
• exact screen and viewport sizes;
• time zones, timestamps, origins, and referrers;
• free-text detection reasons that could contain visitor-derived fragments.

The test-message field stays in the browser and is not submitted. A keyed subject identifier rotates daily and exists only to avoid retaining repeated samples from the same likely visitor during that day.

How to interpret a demo result

A single allow or challenge is not an accuracy measurement. Browser state, shared network rate limits, privacy extensions, input method, and the time spent on the page can all affect contributory signals.

The project keeps hosted-demo samples separate from the captured regression corpus because their human label is self-reported. Read the benchmark methodology for the evidence tiers and release gates.

For deployment-specific retention and export controls, see the production capture documentation.