Privacy

What we store

We store your message and optional media encrypted at rest, the opening date, and a random browser identifier. Your device remembers capsule links and separate management keys. The sealed payload includes the browser identifier for integrity verification.

When blockchain anchoring is enabled and succeeds, a one-way fingerprint is published on the Sepolia test network. The public record contains the fingerprint, not the message.

Who can read a capsule?

The server enforces the opening date. Anyone with the private share link can read the capsule after that date. Keep the link private.

We encrypt stored text and media, but hold the encryption key on our server. This is not end-to-end encryption: an operator with the key can technically decrypt the content.

Blockchain records support integrity checks. They do not enforce the opening date or preserve the message if this service becomes unavailable. Sepolia is a test network, not a permanent-storage guarantee. Download an opened capsule to keep an independent copy.

Drafts, recovery and reminders

Draft saving is optional and uses unencrypted session storage in this browser tab. Drafts can be restored for up to 24 hours; expired drafts are removed on the next visit. Discard a draft from the creation screen. Saved links in My capsules stay until you forget them or clear browser storage. Forgetting a link does not delete the sealed capsule.

You may confirm your own email for recovery and optionally request one opening reminder. Addresses and the selected email language are encrypted in our database. Resend processes the address for delivery. Recovery links expire after 15 minutes and work once. A reminder contains the private share link, never the message. You can turn reminders off from its settings link. Email features require delivery to be configured.

AI reflections use only the current information you choose to provide. Outcomes are reported by you or marked unknown. Reflections are generated on request and are not part of the original sealed record.

Cookies and similar tools

A functional cookie, capsula_locale, remembers your choice of Greek or English for one year. Local storage holds your browser identifier, saved capsule links and management keys. Optional drafts use this tab’s session storage. These are not tracking cookies.

Analytics, advertising and browser performance tracking are disabled. We do not load Firebase Analytics, Google AdSense or Vercel Speed Insights, even if an earlier preference allowed them. Our hosting provider still processes requests needed to serve the site.

Who processes your data

Capsule contents are stored on Google Firestore. Conversations and reflections requested with AI are processed by Google Gemini. Letters written without AI do not use Gemini. Vercel hosts the site; Resend delivers requested emails. Sepolia holds public fingerprints when anchoring succeeds.

Previous preferences

No optional tracking runs in this version. You can remove an older tracking preference below.

Contact

For privacy questions, access or deletion requests, email us. We cannot delete a published blockchain fingerprint.