Capsule

Privacy Policy

Last updated October 18, 2026

Capsule is a voice journal and a way to seal messages until a later moment. This policy explains what Capsule stores, where, and who can read it. "We" means the developer of Capsule; you can reach us at support@naperian.io.

Your journal

Entries (voice, video, photos, notes), their transcripts, summaries, search indexes, your daily questions and where each entry was recorded are stored on your iPhone and in your own iCloud private database. We cannot read them there.

To transcribe, summarise and index an entry, write your daily question, polish a recording and answer what you ask your journal, the app sends the content involved (the entry's sound, photo or text, or the excerpts relevant to your question) to Capsule's server. The server passes it to Google's Gemini API, returns the result to your phone and keeps none of it. Google processes it under the Gemini API terms. Location is never sent to our server or to Google; to turn coordinates into a place name the app uses Apple's geocoder on your phone. To remind you when and where you usually write, the app looks at the times and places of your latest entries on your phone only.

Capsules

A capsule is encrypted on your phone before it leaves it. For a capsule for yourself, our server keeps only the key, and gives it back once the capsule's date has passed; the encrypted capsule is in your iCloud. For a capsule for someone else, our server stores the encrypted capsule and one half of its key; the other half is only in the capsule's link, so we cannot read it. We do store its recipient's name, your name, its title, its kind, its size and when it opens.

If you ask Capsule to deliver a capsule, we store the recipient's email address and, until delivery, the second half of the key, so the capsule can be sent at its moment. That half is deleted when the email is sent or the recipient's app confirms it has the capsule. Emails are sent through Resend.

If you set up "If I'm gone", we store your trusted contacts' names and the email addresses you give for them, your chosen waiting periods and the state of your plan, so we can contact them and release your capsules as you asked.

Pen pals

Pen pal letters are end-to-end encrypted on your phone; our server relays them without being able to open them and deletes each one once the recipient's phone has it, or after 30 days. We store your pen name, country, languages, topics, anything you chose under "What you're going through" (optional, from a fixed list, such as cancer treatment or caring for someone, which can be health information; we use it only to suggest pen pals and show another person only what you both chose, and leaving pen pals deletes it), public key, who you are paired with, who you blocked, when letters were sent, delivered and opened, and your push token. If you report a letter, your phone sends us that letter so we can review it; reports are kept for 90 days. Pen pal letters are never sent to Google or iCloud.

Your account

You sign in with Apple or Google. We store an account identifier, the email address and name the provider shares, your plan, hashed session tokens and daily usage counts (how many entries were processed or questions asked, never what they said). Payments are handled by Apple; we never see your payment details.

Who else is involved

We do not sell your data, show ads or track you across apps and websites.

Keeping and deleting

Settings → Delete account removes every entry, capsule, recap and key from your phone, your iCloud and our server, including capsules you left for others. You can export everything first in open formats. Sealed entries can't be deleted one by one; that is how the journal works.

Children

Capsule is not meant for children under 13, and pen pals are for adults 18 and over.

Changes and contact

We will update this page when what we store changes, and tell you in the app about important changes. Questions or requests: support@naperian.io.