What's a privacy-friendly open source CAPTCHA I can self-host?

Altcha is worth testing, but pay attention to the proof-of-work cost. A fixed setting can make a phone wait several seconds while a powerful desktop or server finishes almost immediately.

Test the challenge on a range of devices before settling on a configuration. Also check which widget features are included in the open source version rather than assuming the paid features are available when self-hosting.

Cap.js is another option if you want something fairly simple to host. The tradeoff is that it has limited integrations and no automatic difficulty scaling, so check whether you're comfortable doing more of the setup yourself. Since you're already hitting installation errors, the available documentation and support are worth checking before committing to it.

Take a look at Private Captcha too. Check its current licensing and pricing against your intended use, especially if the site is commercial. Anubis is another self-hosted option to investigate, although you'll need to see how well it fits your forms and payment flow.

Turnstile is a hosted alternative if you decide that easier integration matters more than self-hosting. It doesn't meet your open source, self-hosted requirement, though, and legitimate visitors interact with the provider too. Review its data practices yourself rather than assuming a hosted challenge avoids tracking concerns.

For card testing, I wouldn't rely on a CAPTCHA alone. Ask your payment provider what controls it offers for repeated attempts and make sure you can monitor and limit suspicious payment activity. Account creation and payment abuse are related bot problems, but they don't necessarily need the same controls.