Hi Product Hunt — Matias here, maker of Playtcha.

Every CAPTCHA you've used does two things you didn't ask for. It profiles your visitors, and it ships a quarter-megabyte of JavaScript to do it. reCAPTCHA v3 scores users by fingerprinting the browser and shipping the signal to Google's ad graph. Turnstile does the same, owned by Cloudflare. hCaptcha does the same, sold to a different ad sidecar. The trade-off they all hide is who gets the data — not whether it happens, and not what it costs your page-load budget.

Playtcha doesn't hide it. We just don't do it.

The bot problem doesn't actually require surveillance. It requires asking the user to do something humans find easy and bots find annoying, then verifying. So that's all this is: a 5-second mini-game runs in the visitor's browser, the result is signed with a single-use JWT, your server verifies it. Zero behavioral data leaves the device. The customer-facing privacy policy line is one sentence.

What's in v1:

15.86 KB gzipped initial widget. Games lazy-load as ~4 KB chunks only when the user starts playing. For comparison: reCAPTCHA ships ~250 KB across multiple scripts; hCaptcha is similar; Turnstile is lighter but still 4-5× larger.
8 mini-games, random per load, mobile-tuned
2-minute, single-use, domain-bound JWT — no replay, no farming
5-minute integration: one <script> + one POST /v1/verify (same contract shape as reCAPTCHA, drop-in)
Free until 5,000 verifications/month, no credit card. €4.99 / €9.99 above that.
Hosted in Dublin (EU). GDPR-clean by design, not by paperwork.

What I'd love feedback on:

Game difficulty — too easy? too hard? Mobile feel especially.
/docs/quickstart — is the integration obvious in 5 minutes?

Live demo's on the homepage. Roast it.