Legal
Privacy Policy
NullFlare is built to keep as little as possible. The API counts your solves and nothing else about them. The Chrome extension collects nothing at all.
Effective 27 September 2026. NullFlare is operated by Byte Ashen (“we”, “us”). Questions about this policy go to [email protected].
Summary
- No accounts, no tracking. There are no user accounts, no analytics, no advertising, and no cookies set by us.
- The API keeps counts, not content. For each key we store how many credits it has and how many solves it used per day and per month. We do not store what you solved, the tokens or cookies we returned, your proxy credentials, or your IP address.
- The extension never phones home. It sends nothing to us or anyone else.
- We do not sell data. We have none worth selling, and we would not.
Chrome extension
NullFlare Turnstile Solver runs entirely in your browser. It does not collect, transmit, or share any information. It makes no network requests to us or to any third party; its only activity is on the Turnstile widgets it clicks.
Its settings, such as whether it is on and the click delay, are saved by Chrome on your own device. We cannot see them. Removing the extension removes them.
API
What a solve request contains
A request carries your key, the page URL and sitekey (or the challenged
URL for WAFv3), optional widget values such as action and
cData, and optionally a proxy. We use these only to perform
that solve. When the solve finishes, the request is discarded. The result
(a token, or a WAFv3 clearance, User-Agent and cookie jar) is returned to
you and not kept.
What we store per key
| Data | Why | Kept |
|---|---|---|
| The key itself | To authenticate your requests. | Until the key is deleted |
| A label | So we know whose key it is. Usually a name or handle you gave us. | Until the key is deleted |
| Credits granted and used | Your balance. | Until the key is deleted |
| Solves per month | Billing records. | Until the key is deleted |
| Solves per day | Spotting problems and changes in usage. | 62 days |
| Created and last-used times | Account housekeeping. | Until the key is deleted |
| Status and simultaneous-solve limit | Enforcing the limit and suspensions. | Until the key is deleted |
None of these records which sites you solved for.
Proxy credentials
A proxy you send is used to make that solve's connections and is then discarded. Credentials are never written to storage or logs; our software masks them wherever a proxy could be printed.
Diagnostic logs
When a solve fails, our servers log the reason so we can fix it. That message can include the target URL and sitekey. It does not include your key, your IP address, or your proxy, and it is not linked to your account. Solving machines also keep a short in-memory log of their work, which may include target URLs; it is erased when they restart. We use these logs only to diagnose and improve the service.
What the target site sees
Solving a challenge means connecting to the site you name, just as a browser would. That site and Cloudflare see those connections, from your proxy's address if you supplied one, and from ours if you did not.
Website
nullflare.com and api.nullflare.com use no cookies, analytics, or third-party scripts of our own. Both are delivered through Cloudflare, which processes connection information such as IP addresses to deliver and protect them, and may set its own security cookies. See Cloudflare's privacy policy.
Support and purchases
If you email us or message us on Discord, we receive what you send and the contact details that come with it (your email address or Discord account). If you buy credits, we keep the records of that purchase, such as the amount, date and key, as required for accounting. Payment details are handled by whoever processes the payment and are not stored by us.
Sharing
We do not sell, rent, or trade information. We share it only:
- Providers Cloudflare, to deliver our sites and API, and whoever processes a payment you make.
- The law When we are legally required to, for example by a valid court order. Because we keep so little, there is usually little to give.
- Abuse When needed to stop abuse of the service or of others, as described in the Terms of Service.
Retention
Solve requests and results are not retained. Daily counts are kept for 62 days. Key records, monthly counts and purchase records are kept while the key exists and as long as accounting rules require afterwards. Diagnostic logs are kept only as long as they are useful for fixing problems, then deleted.
Your choices
You can ask us what we hold about your key, to correct its label, or to delete the key and its history, by emailing [email protected] from an address we can connect to the key. Deleting a key ends its access and its remaining credits. Purchase records we are required to keep are retained for that purpose only.
The service is not directed at children, and we do not knowingly collect information from anyone under 18.
Changes
If this policy changes, we update it here and change the effective date. If a change affects what we collect, we will say so on this page before it takes effect.