Privacy Policy

Last updated: 12 August 2026

Capsulene ("Capsulene", "we", "us") helps you store important information and have it delivered to people you trust if you stop checking in (a "dead-man's switch"). Because that information is often sensitive, protecting it is central to how we build the product. This policy explains what personal data we process, why, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR) and is intended to also satisfy the UK GDPR and applicable US state privacy laws.

1. Who we are (data controller)

The Service at capsulene.com and app.capsulene.com is operated by DDS Services Kft., registered office 1136 Budapest, Tátra utca 5/a al2, Hungary (company registration number 01-09-301215) ("the Controller"). For any privacy question or to exercise your rights, contact us at privacy@capsulene.com. Full statutory company details are in our Legal Notice.

2. The data we collect

Account & identity

• Email address — your identifier and how you sign in.
• Name — as you provide it.
• Authentication data — we use passwordless sign-in: when you log in by email we send a one-time code and store only a short-lived, hashed copy of it; alternatively, if you use Sign in with Google, Google provides us your email and name. We also keep a token identifier to manage your session.
• Two-factor authentication data — if you enable it: your authenticator (TOTP) secret, stored encrypted; hashed recovery codes; your chosen verification mode; and verification timestamps. Used solely to secure sign-in. Note that for your security we cannot restore access to an account whose second factor and recovery codes have been lost.
• Passkey (WebAuthn) data — if you add a passkey: the credential's public key and identifier, the optional nickname you give it, and creation/last-used timestamps. Used solely to verify your sign-in. Your fingerprint, face, or PIN never leaves your device — we receive a cryptographic signature, not biometric data — and deleting a passkey removes its record immediately.
• Subscription & billing status — your plan/package, its status and renewal date, and a reference (a customer/subscription id) that links your account to our payment processor. Your card and billing details are entered directly with Stripe (see §5); we never store your card number or billing address.

The contents of your capsules

The information you choose to store — titles, messages, and secrets such as passwords or cryptographic keys. We treat this as strictly confidential, and we never use the contents of your capsules for any purpose other than storing and delivering them as you instruct.

Key-holder ("vault") capsules are end-to-end encrypted and we cannot read them. When you store a secret such as a password or a cryptographic key, your browser encrypts it on your device before anything is sent to us, and the key needed to decrypt it is split into three "shares" of which we receive only one — not enough, on its own, to unlock anything. The other two shares stay with you and with the recipient you choose. As a result we hold only an encrypted blob plus a single, useless-on-its-own key fragment: we cannot decrypt, read, inspect, scan, or recover the secret inside a vault capsule, and neither can anyone who merely gains access to our systems. Section 9 explains how this works.

Files you encrypt stay with you. A key-holder capsule can also encrypt files. When you do this, your browser encrypts the files locally and hands the encrypted copies back to you — they are never uploaded to Capsulene. We do not receive, store, or process your files or their ciphertext; you keep them wherever you choose, and only your capsule's shares can open them (see §9).

Everything else — a capsule's title, schedule and recipient details, and the body of plain-text message capsules — is not encrypted in this client-side way. It is encrypted in transit (TLS) and at rest, and we access it only as needed to operate and deliver the Service.

Recipient (beneficiary) details

For each capsule you provide details of the person who should receive it — their name, and email address and/or mobile number. You provide this on their behalf; see §3 and our Terms for your responsibilities.

Activity & trigger data

Your check-ins ("I'm still here" confirmations), the schedule and state of your triggers, and related timestamps — this is what the dead-man's switch relies on.

Communications & support

The emails, SMS and WhatsApp messages we send you (one-time codes, check-in reminders, delivery notices) and any correspondence you send us for support.

Text messages (SMS): consent, use, and opt-out

SMS is optional and off by default. We collect and use a mobile phone number for text messaging only when you choose to turn it on. What we use SMS for depends on where the number is located:

• United States & Canada: we use SMS only to send you, the account holder, your own check-in confirmation messages — the "are you still active?" prompts, with a secure link, that keep your capsules on schedule. We do not send capsule-delivery texts to recipients with US or Canadian numbers; those deliveries are made by e-mail.
• European Union/EEA and other regions: in addition to your own check-in confirmations, SMS may also be used to notify a recipient you designated when a capsule is released to them.

How you opt in. Text messaging is never enabled automatically. You opt in yourself, inside your account settings, by entering the relevant mobile number and switching SMS on for check-ins (and, where available, for a recipient) — that action is your express consent to receive these messages. Where you provide a recipient's number, you confirm you have that person's permission to give it to us (see our Terms).

How you opt out. You can turn SMS off at any time in your account settings, and you can reply STOP to any message to stop all further texts; reply HELP for help. Opting out of SMS does not affect e-mail check-ins, which remain available for free.

Frequency & charges. Message frequency depends on the check-in schedule you set (for example, a reminder around each scheduled check-in, plus any retries you configure), so it varies. Message and data rates may apply from your mobile carrier.

We never share or sell your number for marketing. Mobile phone numbers and SMS opt-in/consent data are used solely to send the messages described above. We do not share or sell this information — including your opt-in and consent — with any third parties or affiliates for their own marketing or promotional purposes. Texts are sent through our messaging provider acting as our processor, purely to transmit the message on our behalf.

WhatsApp messages: consent, use, and opt-out

WhatsApp is optional and off by default. We collect and use a phone number for WhatsApp messaging only when you choose to turn it on, and only on plans that include the WhatsApp feature. We use it for two things:

• Your own check-in confirmations — the "are you still active?" prompts, with a secure link, that keep your capsules on schedule.
• Recipient delivery — notifying a recipient you designated when a capsule is released to them. Unlike SMS, this is available for recipients worldwide, including the United States and Canada.

How you opt in. WhatsApp messaging is never enabled automatically. You opt in yourself, inside your account, by entering the relevant number and switching WhatsApp on for check-ins (and, where you choose, for a recipient) — that action is your express consent to receive these messages. Where you provide a recipient's number, you confirm you have that person's permission to give it to us (see our Terms).

How you opt out. You can turn WhatsApp off at any time in your account, and you can block our sender inside WhatsApp itself to stop all further messages. Opting out does not affect e-mail check-ins, which remain available for free.

Message content. WhatsApp requires businesses to use message templates approved in advance. Our WhatsApp messages therefore use fixed wording in English and carry only your capsule's sender name, recipient name and the secure link — they do not contain your capsule's contents or any personal greeting you wrote. Standard data charges may apply.

Meta as our processor. WhatsApp messages are transmitted by Meta (the WhatsApp Business Platform) acting as our processor, purely to send the message on our behalf. Meta processes the destination number and message metadata to deliver it; delivery also involves the recipient's own WhatsApp account, which is governed by their own agreement with WhatsApp. We do not share or sell these numbers — including your opt-in and consent — with any third parties or affiliates for their own marketing or promotional purposes.

Technical data

We keep minimal technical logs (such as IP address and timestamps) needed to run and secure the Service. Our marketing site also uses Google Analytics to understand, in aggregate, how the site is used (see §12). We do not run advertising networks or build advertising profiles about you.

3. How and why we use your data (legal bases)

• To provide the Service — create your account, store capsules, run triggers, and deliver capsules to your recipients. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To send essential messages — sign-in codes, check-in reminders, and delivery notifications. Legal basis: contract.
• To take payment for paid plans. Legal basis: contract.
• To keep the Service secure and prevent abuse or fraud, and to comply with law. Legal basis: our legitimate interests and legal obligations (Art. 6(1)(c),(f)).
• With your consent where we ask for it (e.g. any optional messages) — you can withdraw consent at any time. Legal basis: consent (Art. 6(1)(a)).

Where you provide recipients' details and the special-category or financial information you may store in capsules, you do so on your own initiative; you are responsible for having a lawful basis to share that information with us and with your chosen recipients (see Terms).

If someone named you as a recipient

If a Capsulene user has named you as a recipient, we hold the contact details they gave us about you — your name, and e-mail address and/or mobile number — solely to deliver their capsule to you if it is released, and for no other purpose. Legal basis: our legitimate interest in carrying out our user's instructions (Art. 6(1)(f)). We do not contact you before a release, because doing so would reveal the existence and confidential purpose of the capsule and would seriously impair the service the user asked us to perform (Art. 14(5)(b)); this policy is always available at capsulene.com/privacy. You may exercise the rights described in §10 — including asking us to delete your contact details — at any time by emailing privacy@capsulene.com.

4. The dead-man trigger (automated processing)

Our core feature is automated: based entirely on the schedule and rules you set, if you stop confirming you are active, we automatically attempt to confirm and then release the relevant capsule to your chosen recipient. We do not independently verify death or incapacity — release is driven solely by your settings and your missed check-ins. You can change, pause, or delete any trigger at any time while your account is active. We do not use this processing to make any other decision about you.

5. Who we share data with (sub-processors)

We share personal data only as needed to run the Service:

• Your recipients — when a capsule is released, it is delivered to the recipient(s) you designated, by the email, SMS or WhatsApp channel you chose. For end-to-end-encrypted vault capsules we can only transmit the encrypted blob and our single key-share; the recipient unlocks it in their own browser using the share you gave them, so the secret is never readable by us in the process.
• Amazon Web Services (AWS) — hosting, database, file storage, content delivery, and transactional email (Amazon SES). Our primary infrastructure and your data are hosted in the EU (Frankfurt, Germany).
• Twilio — sends our SMS messages (your own check-in confirmations and, outside the US/Canada, recipient delivery notifications) as our processor, purely to transmit the message on our behalf. Twilio may process phone numbers and message content in the United States; such transfers are protected as described in §7.
• Meta (WhatsApp Business Platform) — sends our WhatsApp messages (your own check-in confirmations and recipient delivery notifications) as our processor, purely to transmit the message on our behalf. Meta may process phone numbers and message metadata outside the EEA, including in the United States; such transfers are protected as described in §7. See WhatsApp messages.
• Stripe — payment processing for paid packages. Stripe acts as the merchant of record (via Stripe Managed Payments): you enter your card and billing details directly on Stripe's secure surface (which may appear as "Link", Stripe's checkout), and Stripe collects and remits applicable taxes, issues your invoice, and handles fraud and disputes. We never receive your full card number or billing address — only limited details such as your plan/package, payment status, and a customer/subscription reference. Stripe processes the payment data it collects as an independent controller under its own privacy policy, and is PCI-DSS compliant.
• Google — if you use "Sign in with Google" (to verify your identity), to serve the web fonts on our site, and Google Analytics for aggregate usage statistics on our marketing site.
• HubSpot — on our marketing site only (not the app), for website analytics and contact/marketing forms. Its tracking loads only after you accept analytics cookies in our consent banner (see §12), and HubSpot processes the data it collects under its own privacy policy.
• Authorities / legal — where we are legally required, or to protect our rights, users, or the public.
• Business transfer — if Capsulene is involved in a merger, acquisition, or asset sale, with notice to you and continued protection of your data.

Each provider acts as our processor under a data-processing agreement and may only use the data to provide their service to us.

6. We do not sell your personal data

We do not sell, rent, or trade your personal data to anyone. We do not share it for advertising, and we do not engage in "cross-context behavioural advertising" or the "sale" or "sharing" of personal information as those terms are defined under US state privacy laws (including the California CCPA/CPRA). This includes your mobile phone number and SMS or WhatsApp opt-in/consent data, which we never share or sell to third parties or affiliates for their marketing or promotional purposes (see Text messages and WhatsApp messages).

7. International transfers

Your account data and capsule contents are stored in the EU. Some sub-processors (for example Stripe, Google, and certain SMS and WhatsApp routing) may process limited data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision.

8. How long we keep your data — and deletion on cancellation

We keep your personal data only while your account is active. When you delete your account (or we close it), we permanently delete your personal data and the contents of your capsules — we do not retain personal data afterwards, apart from the limited legally-required records noted below.

Account deletion has a grace period (soft deletion). To protect you against mistakes and against someone else acting on your account, deleting your account does not erase anything immediately. It is confirmed with a code we e-mail to your login address (plus your two-factor code if you have it enabled) and then enters a cancellable grace period — by default a few days — during which the account still exists but is scheduled for deletion. Signing in again during that window automatically cancels the deletion and restores your account; only if the window passes without a sign-in does the erasure proceed. The full flow is described in our Terms.

Backups. Once your account is erased from our live systems, residual copies in our encrypted backups are overwritten on our normal backup rotation, so full deletion — including from backups — completes within about 35 days.

Records we are required to keep. The only data that survives deletion is what we or our processors are legally required to retain. In particular, as merchant of record, Stripe issues and retains your invoice and tax records for past purchases under its own legal obligations (see §5 and Stripe's privacy policy), and we keep minimal billing or other legally-mandated records only for as long as the law requires and then delete them.

9. How we protect your data

We use encryption in transit (TLS) and encryption at rest, strict access controls and least-privilege permissions, and we host on reputable EU infrastructure. No online service can be guaranteed 100% secure, so you also play a part: keep access to your email/Google account and your devices secure, and consider adding a passkey and enabling authenticator-app two-factor authentication on your account (Account → Security). If a breach affects your rights, we will notify you and the relevant authority as required by law.

End-to-end, zero-knowledge encryption of your key vaults

For key-holder capsules (passwords, recovery phrases, and other cryptographic keys) we use client-side, end-to-end encryption, so that the secret is readable only on your device and your recipient's — never on our servers. When you create such a capsule, your browser:

• generates a random encryption key and encrypts your secret locally with AES-256-GCM;
• splits that encryption key into three shares using Shamir's Secret Sharing, where any two of the three are required to rebuild it; and
• gives one share to you and one to your chosen recipient (to keep out-of-band), and entrusts only one share to us, which we store alongside the encrypted blob.

Because we hold a single share — one short of the two needed — we are mathematically unable to reconstruct the key or decrypt your secret. We cannot read, search, export, or hand over the contents of a vault capsule — whether requested by you, by a third party, or by an authority — because we simply do not possess the means to do so. Decryption happens only in a browser that supplies a second share.

The flip side is that recovery depends on those shares. If you and your recipient both lose your shares, the secret can never be recovered — not by you and not by us. Please store your shares safely; we cannot reset, resend, or recover them on your behalf.

Encrypting files (the file vault). The same client-side scheme extends to files. When you seal files with a key-holder capsule, your browser encrypts each file locally — a fresh random key per file, wrapped by your capsule's key — and hands the encrypted files back to you. These files are never uploaded to Capsulene; we never receive, store, or process your files or their ciphertext. They can be decrypted only with the capsule's shares, either in your browser or in a self-contained offline decryptor you can download to keep your files openable independently of us. As with your key vault, if the required shares are lost the files cannot be recovered by anyone, including us — so keep your encrypted files, your shares, and the offline decryptor safe.

10. Your rights (EU & UK)

Under the GDPR and UK GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any right, email privacy@capsulene.com. We respond within one month. You can also delete your account at any time from your account settings. If you believe we have mishandled your data, you may lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your national data-protection authority. Our lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

11. United States & California

If you are a US resident, you may have rights to know, access, correct, and delete the personal information we hold, and to be free from discrimination for exercising them. We collect the categories described in §2 for the purposes in §3. We do not sell or "share" your personal information and have not done so in the past 12 months. To make a request, contact privacy@capsulene.com; we will verify your request before acting on it.

12. Cookies & local storage

In the app we use essential browser storage (a token to keep you signed in and your light/dark theme preference). Our marketing site uses Google Analytics (the Google gtag.js tag), which sets cookies and collects aggregate, statistical information about how the site is used — such as pages viewed and approximate location derived from your IP address — and shares this with Google, which may process it outside the EEA under appropriate safeguards. We do not use it for advertising or to build a profile about you. Analytics runs only after you accept analytics cookies in our consent banner (via Google Consent Mode); you can change or withdraw your choice at any time using the “Cookie settings” link in the footer. You can also opt out using Google's browser add-on (tools.google.com/dlpage/gaoptout) or your browser's privacy settings. Our marketing site also loads HubSpot (website analytics and contact forms), which likewise sets cookies and runs only after you accept analytics cookies in the same consent banner; if you decline, it is not loaded. Our site also loads web fonts from Google.

13. Children

Capsulene is intended for adults and is not directed to children under 16. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a revised "Last updated" date and, for material changes, notify you by email or in the app.

15. Contact us

Privacy questions and requests: privacy@capsulene.com. Operator: DDS Services Kft., Budapest, Hungary.