Privacy Policy

Overview

CapsuleChat includes our mobile app and website. It lets you create an account and seal messages, photos and videos inside capsules that open at a chosen time or place. This policy explains what we collect, how we use it, and the choices you have.

By creating an account and using the app, you agree to this policy.

Information you provide

Account details: your email, display name, username, and (at sign-up) your name and birthdate, used to run your account and confirm you are at least 18 years old.

Content you create: the text, photos, and videos you seal into capsules, plus direct messages you send. Capsule contents are stored so the person you sent them to can open them at the right moment. A capsule set to self-destruct has its content deleted once it has been shown — straight away for text and voice, within a few minutes for a photo, and within about a quarter of an hour for a video, so it can finish downloading and be played to the end; a group capsule waits until the last member has opened it. Any other capsule can still only be opened once, but its content stays stored with the capsule until you delete your account.

Website sign-in and local storage

The website uses Firebase Authentication to create and maintain your signed-in session. Firebase may store authentication state in your browser so you stay signed in; CapsuleChat also stores only your language preference locally. We do not use advertising trackers or cross-site behavioral advertising cookies.

Location

If you send or open a location-locked capsule, the app reads your device location to place the capsule or check that you reached its unlock spot.

Sharing your location with friends is off unless you turn it on. To share, tap the location-sharing button on the map and choose 15 minutes, 1 hour or 8 hours. While sharing is on, we upload your current position while the app is open and show it on your friends’ maps, except to anyone you blocked. Sharing stops by itself when the time runs out, and you can tap the button again to stop it sooner; stopping deletes the stored position.

Anonymous capsules

You can send capsules anonymously. We hide your name from the friend you send it to, but your identity is still recorded on our servers so we can enforce our rules, prevent abuse, and power features such as the Anonymous Opener. You can only send anonymous capsules while “Receive anonymous capsules” is on in Settings.

Friends, suggestions and chat features

Friend suggestions: your display name, username and profile photo can be suggested to other people — under “People you may know” to people you share friends with, and under “Meet new people” to other CapsuleChat users at random. They can only send you a friend request; nobody can message you until you accept.

Typing and replies: while you type in a chat, the people in that chat can see that you are typing (never what you type). A reply stores only which message it answers.

Reports and hidden people: if you report someone, we keep the report as described below, and your account keeps a private list of the people you reported so their chats, capsules and messages stay hidden from you. Only you can see that list; you can clear it in Settings › Blocked accounts.

Emails to us: messages you send to our support, privacy, security or copyright addresses are stored with our moderation records so we can act on them and reply.

How we use your information

To operate core features: delivering capsules, unlocking them under the right conditions, direct messages, friends, and groups.

To send notifications you have enabled (a capsule arrived, unlocked, a message, a friend request).

You can disable notifications from the in-app settings at any time. When disabled, we remove the stored push token from your private account data and suppress CapsuleChat’s local alerts until you enable them again.

To keep the service safe: preventing fraud, abuse, and unauthorized purchases.

Automated content screening: photos you upload (capsule media, profile and group photos) are sent to Google Cloud Vision SafeSearch for automated screening, and the text you send (capsule text, chat and group messages, usernames and display names) is checked automatically against a list of prohibited terms on our servers. Flagged content is removed or hidden and may be reviewed by a moderator. Reports and moderation decisions are kept as evidence for up to 12 months.

Purchases

Capsule Keys, Anonymous Openers, and Premium are sold through the Apple App Store and Google Play. Payments are processed by Apple or Google under their terms — we never see your card details. We verify a purchase receipt on our servers before granting what you bought.

Premium is an auto-renewable monthly subscription. You can manage or cancel it at any time in your App Store or Google Play subscription settings. Cancellation stops the next renewal; Premium access continues until the end of the period you already paid for.

Cancelling a subscription does not automatically refund the current paid period. Refund eligibility and processing are controlled by Apple or Google under their policies and applicable law. If a store refunds or revokes a purchase, the related entitlement may end immediately.

Service providers

We use Google Firebase for authentication, database, storage, and cloud functions; Firebase Cloud Messaging (Google) to deliver notifications to your device; RevenueCat to verify store purchases and track subscription status; Google Cloud Vision SafeSearch to screen the photos you upload (capsule media, profile and group photos); OpenFreeMap (operated by Hyperknot Software Kft., delivered via Cloudflare) to serve the map backdrop; and Apple / Google for payments. These providers process data on our behalf to run the app.

When a map is on screen, your device requests map tiles directly from OpenFreeMap. Those requests carry your IP address and reveal which area of the map you are viewing. They do not include your account, your capsules, or the exact position of any capsule. No account or key identifies you to the map provider.

Legal bases and purposes

Where GDPR or similar law applies, we process account, message, capsule, purchase-validation, and location data as needed to perform our contract with you; security and limited service diagnostics for our legitimate interests in protecting users and the service; optional notifications and device permissions with your consent; and records when required by law. You may withdraw consent through device or in-app settings without affecting earlier lawful processing.

Data categories and disclosures

In the preceding 12 months we may have collected identifiers and account details, user-generated content and communications, location used for a location lock, purchase and entitlement records, device or push identifiers, and security logs such as timestamps, request outcomes, and a one-way code made from your IP address (not the address itself) that we use to limit repeated requests. We disclose only the data needed to providers that host, secure, notify, moderate, or process store purchases. We do not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics.

Crash and error reports

When something goes wrong in the app, CapsuleChat sends us an automatic error report so we can fix it. A report contains the error message and, where available, a technical stack trace, the names of the screens you visited just beforehand, any store steps just beforehand (for example that a purchase was started, cancelled or restored — never payment details), the times the app was opened, put away, brought back or ran low on memory just beforehand, your account identifier, your app version, your device model and its operating system version. It does not contain the contents of your capsules, messages, photos or your location, and access tokens and full email addresses are removed before a report is sent.

Reports are sent only when an error actually occurs — never as ongoing usage tracking. If the app closes unexpectedly, the report is sent the next time you open it. They are stored with Google Firebase (Firebase Crashlytics and our own Firebase database), are readable only by us, and are used solely to diagnose and fix faults.

Data retention

We keep account and content data while your account is active. A self-destructing capsule loses its content once it has been shown; the content of any other capsule stays stored until the account is deleted. You can delete your account and all associated data at any time in the app (Settings → Delete account), or ask us to do it for you.

International transfers

Our providers may process data outside your country. Where required, transfers are protected through recognized safeguards such as adequacy decisions, standard contractual clauses, or an equivalent lawful mechanism made available by the provider.

Security

Capsule contents are stored separately from their metadata and are gated so only the person a capsule was sent to can read it, and only once the unlock condition is met. No system is perfectly secure, but we design the app so a capsule cannot be opened before its time.

Security incidents

We monitor authorization failures, abuse limits, and service errors without intentionally putting message content into security logs. We investigate suspected incidents, contain them, preserve relevant evidence, and notify regulators and affected people within the time and manner required by applicable law. Contact security@capsule-chat.com to report a vulnerability; do not access or alter other users’ data while testing.

Your privacy rights

Depending on where you live, you may request access to or a copy of your data, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may complain to your data-protection authority. California residents may request the categories, sources, purposes, who we share it with, and specific pieces of personal information collected; request correction or deletion; and receive equal service when exercising a right. Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or share opt-out to process. Send a request to privacy@capsule-chat.com. We will verify it proportionately and respond within applicable deadlines; an authorized agent may act where local law permits.

Children

CapsuleChat is for people aged 18 and over. It is not intended for anyone under 18, and we do not knowingly collect data from anyone below that age. We ask for a date of birth at sign-up and refuse to create an account for anyone younger.

Your choices

You can choose whether to receive anonymous capsules (“Receive anonymous capsules” in Settings), turn notifications on or off, block other users, report content, and delete your account. To exercise any of these rights, use the in-app settings or contact us.

Contact

Questions about this policy? Reach us at privacy@capsule-chat.com.

To report inappropriate activity or get help with your account, email support@capsule-chat.com.