Wicket and visitor privacy

To tell a person from a script, the Wicket widget reads some technical facts about the visitor's browser and network. This page lists what it reads, what we keep, and for how long, so that you can describe Wicket accurately in your own privacy policy.

When the widget runs on your page, the visitor's browser sends us these things, in four groups:

Browser and device features

Facts a browser reports about itself and the device, such as its language, time zone, screen size, graphics and how it draws, and whether a program seems to be driving it. The browser's own user agent text comes with the request, as it does with every web request.

How the check box was ticked

When a visitor has to tick the box, whether they used a pointer, a finger or the keyboard, how much the pointer moved before the tick, and how long the visitor took. The widget does not record what a visitor types, and it does not send where on the page the pointer was.

The proof-of-work timing

How long the small calculation took in the visitor's browser, and how long the widget took to appear and to finish (How Wicket works).

The network the request came from

The visitor's IP address, which reaches us as it reaches any server. We use it to find the visitor's country, the kind of network it belongs to (a home connection, a data centre or a VPN, for example) and what we already know about abuse from it.

Your page adds its own hostname, and the action and cdata you set on the widget. Keep personal details out of both. The action appears in your analytics.

For your analytics

Counts for each widget by hour and by day. Each count can be split by the page's hostname, the action, the visitor's country, and the browser and operating system families. The numbers name no visitor (Read a widget's analytics).

To improve the check

The features the check worked out, the country, the kind of network, and hashes of the network and of the browser's feature signature. Each hash is salted with a value that changes every day, so a hash cannot follow a visitor from one day to the next. We keep no IP address, no user agent text and no raw browser readings.

Reports

A visitor's note from Having trouble?, and the reports you send from your server, each with the reference of the check it is about. The widget asks visitors to leave personal details out of the note.

The record of a token

That a token was verified, so that it works once. When you send remoteip, we keep only whether it is in the same network as the one that did the check, and not the address (Verify a token on your server).

When you delete a widget, we delete its settings and hostnames at once. Its counts stay until they age out, as the table says.

Wicket sets no cookie. The script and the frame read no cookie, and they store nothing in the visitor's browser, so Wicket adds nothing to your list of cookies. The frame makes requests to Wicket and to no one else.

Your policy should say, in your own words, that:

• Your site uses Wicket, a bot check from Coritan, on the forms where you added a widget.
• When a visitor loads one of those forms, the visitor's browser contacts Wicket's servers, which receive the visitor's IP address, technical facts about the browser and device, and the address of your page.
• You use it to protect the form from spam and abuse.
• Wicket sets no cookie and stores nothing in the browser.

How the law where your visitors live applies is for you and your own adviser to decide. The terms and policies that apply to Coritan's services say the rest (Legal terms and policies).

• Add Wicket to your site to put the widget on a page.
• Read how Wicket decides when a check refuses a visitor.
• Check the limits of your plan for how far back your analytics reach.