What we keep

Your name and email. Your name is shown to the people in your capsules. Your email signs you in and gets capsule reminders (upload deadline, sealing, unlock). Turn reminders off at any time in Email settings.

Starting as a guest. You can create a capsule without an account. We then make a guest profile that holds only the first name you typed and your capsules, with no email. If you later save it to an account, your email is added to the same profile and nothing moves. A guest profile you never save stays on this device's browser until you delete it or clear your browser data.

What you add. Photos, videos, voice notes and notes are stored privately (Supabase, in the EU) and stay sealed until the capsule opens; before then only you can see your own.

Photo places. Where a photo was taken is stored rounded to about 1 km, for the capsule's Places album. Turn Photo places off in Settings and new uploads keep no location. Place names come from OpenStreetMap (Nominatim), which receives that rounded location.

Joining and signing in. To stop abuse we keep a one-way hash of your IP address and email for up to a day when you join with a link or ask for a sign-in link. If a connection looks suspicious we ask for a Cloudflare Turnstile check.

Cookies. Only the ones the app needs: your sign-in (30 days from your last visit), your language choice, and a short-lived one while you move guest capsules into an account. No advertising or tracking cookies. We count page views with Vercel Web Analytics, which sets no cookies and keeps no personal profile.

AI features. The trip planner sends what you type to an AI model through the Vercel AI Gateway, and looks up places with Google Places and weather with Open-Meteo. If a host taps "Write captions with AI", the day's date, first names, place names and up to three photos shrunk to 512 px are sent to the AI model for that. Nothing is sent unless you use those features.

Payments. Premium is paid through Stripe. Your card details go to Stripe and never reach us; we keep which capsule or plan you paid for.

Who else. We use Supabase (database and storage), Vercel (hosting and page-view counts), Resend (email) and Sentry (error reports, which leave out names, emails, cookies, photos and sign-in links). We don't sell your data or show ads.

Your data, your call. In Settings you can download everything we keep about you, or delete your account and everything in it. Deleting takes effect after 7 days so you can change your mind; until then you can cancel in Settings. After that your files and account are removed, and each capsule you host passes to its longest-standing member, or is deleted if nobody else is in it.