The short version
What this module is for
Protecting a form from bots without sending your visitors to a third party. SafeCaptcha draws its challenges on your own server, from randomly picked geometric shapes: the visitor clicks a box, a grid of symbols appears, and they point at the one that shows up only once.
Nothing leaves
No request to any outside service, no API key, no account to create. Nothing to add to your privacy policy.
Accessible
A written challenge is offered as an alternative to the visual one, one click away, in the visitor's language.
Three nets
Beneath the visible challenge: a trap field, a minimum submission delay and a signed single-use token.
Why not reCAPTCHA? Because it hands your visitors' IP address and browsing behaviour to a third party, before any consent. Putting it behind the cookie banner amounts to disabling it for those who decline — that is, letting the bots through.