Terms of Service
These Terms of Service ("Terms") govern your use of Capsulene at capsulene.com and app.capsulene.com (the "Service"), operated by DDS Services Kft. (registered in Budapest, Hungary; company registration number 01-09-301215) ("Capsulene", "we", "us"). Please read them carefully — by creating an account or using the Service you agree to them.
1. Agreement & eligibility
You must be at least 18 years old (or the age of majority where you live) and able to enter a binding contract. If you use the Service on behalf of an organisation, you confirm you are authorised to bind it. If you do not agree to these Terms, do not use the Service.
2. What the Service does
Capsulene lets you store information in encrypted "capsules" and designate recipients to receive a capsule if you stop confirming that you are active (a "dead-man's switch"). You set a check-in schedule and grace period; if you miss your check-ins according to your settings, we attempt to confirm and then release the capsule to your chosen recipient by the channel you selected (email, SMS and/or WhatsApp).
Text messages (SMS) are optional and region-dependent. SMS is off until you enable it in your account settings; enabling it is your consent to receive those texts, and you can reply STOP to opt out or turn it off in settings at any time (message and data rates may apply). In the United States and Canada, SMS is used only to send you your own check-in confirmations — capsule delivery to recipients there is by e-mail. In the EU/EEA and other regions, SMS may also be used to deliver a released capsule to a recipient you choose. E-mail check-in and delivery are always available regardless of region. How we handle mobile numbers is described in our Privacy Policy.
WhatsApp is optional and plan-dependent. WhatsApp is off until you enable it on a capsule and enter a number; doing so is your consent to receive those messages, and you can turn it off in your settings at any time or block our sender inside WhatsApp. The number you enter must have an active WhatsApp account, and standard data charges may apply. WhatsApp may be used both for your own check-in confirmations and to deliver a released capsule to a recipient — including recipients in the United States and Canada, where capsule delivery by SMS is not available. Because WhatsApp requires businesses to use pre-approved message templates, WhatsApp messages are sent in English with fixed wording and do not carry the personal greeting you may have written for your recipient; that greeting still travels on the e-mail. E-mail check-in and delivery remain available regardless. How we handle these numbers is described in our Privacy Policy.
End-to-end encryption of key-holder capsules. When you store a secret such as a password or a cryptographic key, it is encrypted on your device before it ever reaches us, and the key needed to open it is split into three shares — one held by you, one by your recipient, and only one by us. Two shares are required to decrypt, so we cannot read, inspect, or recover the contents of these capsules, and your recipient can only open a released capsule using the share you gave them. This is described in our Privacy Policy and has important consequences set out in section 5.
Encrypting files. A key-holder capsule can also encrypt files (a "file vault") on your device under the same shares. The resulting encrypted files are handed back to you and stored by you, wherever you choose — they are never uploaded to us, so we never receive, hold, or process your files or their ciphertext. Encrypted files can be decrypted only with the capsule's shares, in your browser or in the downloadable offline decryptor we provide for that purpose; their protection, your responsibilities, and their irrecoverability follow the same rules as your key-holder secret (section 5).
3. Important — Capsulene is a tool, not a will or legal advice
Capsulene is software. It is not a law firm and does not provide legal, financial, tax, or estate- planning advice. A capsule is not a legally binding will, testament, power of attorney, or other legal instrument, and using Capsulene does not create one. Do not rely on the Service as your only means of passing on information, credentials, or assets, and do not use it for medical, safety, or other emergencies. We do not verify a user's death or incapacity; releases happen solely because of missed check-ins under your settings. You are responsible for ensuring that what you store, and your instructions to recipients, are lawful and effective for your purposes — seek professional advice where appropriate. Because key-holder capsules are encrypted so that only you and your recipient can open them, the loss of the required shares means their contents cannot be recovered by anyone, including us; keep secure, independent copies of anything you cannot afford to lose (see section 5).
4. Your account
You must provide accurate information and keep it current — especially the contact details used for your check-ins. Sign-in is passwordless (a one-time email code or Google Sign-In), so you are responsible for keeping access to your email or Google account, and your devices, secure. You are responsible for activity under your account. Tell us promptly at support@capsulene.com if you suspect unauthorised access.
If you enable two-factor authentication, you are also responsible for keeping access to your authenticator app and for storing your recovery codes safely: recovery codes are shown only once and each works only once. If you add a passkey, you are likewise responsible for the security of the devices and password managers that hold it; removing a passkey in your account settings immediately disables it for sign-in. For your security, we cannot and will not restore access to an account or remove two-factor authentication — whatever the circumstances and whatever proof of identity is offered. Losing your second factor and all recovery codes therefore locks the account permanently. For most capsules a lockout does not put them at risk: check-in links continue to arrive by e-mail and keep working, so a capsule stays sealed as long as you keep confirming — though you will not be able to change, pause, or delete it, or manage your subscription, from within the account (see section 9 for stopping payments). One exception you choose deliberately: a capsule you set to signed-in ("login-required") confirmation can only be confirmed from inside your account, so if you are locked out you can no longer confirm it and it will eventually be released to your recipient. That is the explicit trade that option makes, and we warn you when you enable it.
5. Your content and your recipients
You keep ownership of everything you store. You grant us a limited, worldwide licence to host, store, encrypt, process, and deliver your content solely to operate the Service and carry out your instructions; for end-to-end-encrypted key-holder capsules this licence is necessarily limited to storing and transmitting your encrypted data, because we cannot read it. You are solely responsible for your content and for the recipients you designate, and you represent and warrant that:
- you have the right to store that content and to share it with the recipients you choose;
- you have a lawful basis to provide your recipients' personal details (name, email, phone) to us for delivery, and that they would reasonably expect to receive the capsule;
- your content does not infringe anyone's rights or break any law.
Encryption shares and irrecoverable data
For key-holder ("vault") capsules, the contents are end-to-end encrypted on your device and we receive only an encrypted blob plus a single key-share that cannot decrypt anything on its own (see our Privacy Policy). By using these capsules you acknowledge and accept that:
- We cannot access or recover your secret. We cannot read, decrypt, reset, resend, or recover the contents of a vault capsule, and we cannot help you regain access if the shares are lost.
- You are responsible for safeguarding your shares. If you and your recipient both lose the shares we provided, the contents are permanently and irretrievably lost. A recipient can only open a released capsule if they still hold their share, so keep your shares safe and make sure your recipient does too.
Files you encrypt (the file vault)
If you use a key-holder capsule to encrypt files, the encrypted files are produced on your device and remain in your possession. By using this feature you acknowledge and accept that:
- We never receive your files. Your encrypted files are not uploaded to us — not even as ciphertext. We therefore do not, and cannot, store, back up, restore, deliver on your behalf, or recover them. Storing them safely, and keeping independent backups, is entirely your responsibility.
- A capsule is sealed once created. A key-holder capsule's key is fixed when you create it and its encrypted content cannot be changed afterwards. To add files later you seal them for the same capsule or create a new capsule (and give the new share to your recipient); either way, you must hand your recipient their share out-of-band as before.
- Adding files to an existing capsule is a package feature. Sealing additional files for a capsule you have already created requires an active package (sealing files while you create and arm a capsule remains part of that flow). This is a change to feature availability under section 10 — it does not remove, unschedule, or disable any capsule, and it does not affect delivery. Decrypting — on the Service or with the offline decryptor — requires no account or package; keeping decryption freely available is a core commitment of the Service.
- Deleting a key-holder capsule is irreversible and destroys access to its files. When you delete such a capsule we destroy the one share we hold. After that, files sealed with it can be opened only by combining your share and your recipient's share, they can never again be delivered by the Service, and if either of those shares is also lost the files become permanently unrecoverable.
- The offline decryptor is provided "as is." We make a self-contained offline decryptor available for your convenience so your encrypted files remain openable independently of the Service; it is provided without warranty (see section 11), and keeping a copy of it alongside your files and shares is your responsibility.
6. Acceptable use
You must not use the Service to store or distribute unlawful content, to facilitate illegal activity, to harass or harm others, to infringe intellectual-property or privacy rights, to upload malware, or to attempt to gain unauthorised access to or disrupt the Service. We may remove content or suspend accounts that breach these Terms or the law. Because key-holder capsules are end-to-end encrypted, we cannot see, monitor, or moderate their contents; you remain solely responsible for what you store in them, and our ability to enforce this section as to such content is necessarily limited to information actually available to us (such as reports we receive or unencrypted metadata). The encryption utilities are provided for use with capsules you own or have been made a recipient of; using them as a general-purpose or bulk file-encryption service, outside the scope of a capsule, is not a permitted use.
7. The trigger mechanism — your responsibility
The timing and conditions of any release are determined by the settings you choose (check-in cadence, grace period, retries, recipient details and channel). You are responsible for responding to check-ins and for keeping your and your recipients' contact details accurate. To the extent permitted by law, we are not responsible for a capsule being released, not released, or delivered late or to the wrong person where this results from your settings, your missed check-ins, inaccurate details, or failures of third-party email, SMS or WhatsApp networks. The Service is provided on a best-effort basis and we do not guarantee exact delivery timing.
8. Plans, packages & payment
We offer a free tier and paid packages. A package is a recurring subscription that raises the number of capsules you can keep simultaneously active (live per-type ceilings for text and key capsules, additive on top of the free tier) and sets which optional features — custom check-in timing, SMS, WhatsApp, and login-required check-ins — its covered capsules may use, for the period you choose — for example monthly, yearly, or multi-year. A one-time payment can also cover a single capsule. The price, what each package includes, and the billing cycle are shown before you buy and in your account.
The free tier. Capsules you create on the free tier stay yours. If we change the free tier in future — for example by lowering the free allowance or ending free sign-ups — those changes apply to new sign-ups and to capsules created after the change; they do not remove, unschedule, or disable capsules you have already created and are keeping active under the free tier at that time. We will give reasonable notice of any material change to the free tier.
Automatic renewal. Packages renew automatically for the same period at the then-current price unless you cancel before the renewal date. We may change pricing or what a package includes with prior notice; changes take effect from your next renewal.
Payment and merchant of record. Payments are processed by Stripe, which acts as the merchant of record for your purchase (via Stripe Managed Payments). This means Stripe takes the payment, calculates and remits any applicable VAT or sales tax, issues your invoice/receipt, and handles payment disputes and chargebacks. You enter your card and billing details directly on Stripe's secure payment surface (which may be presented as "Link", Stripe's checkout); we never receive or store your card number or billing address. Your purchase is also subject to Stripe's applicable terms. By purchasing, you authorise the recurring charge plus any taxes.
Managing your package. You can cancel, change your payment method, or view and download your invoices at any time from your account or through the Stripe billing portal we link to there.
If a package ends or a payment fails. When a package lapses — because you cancel it, it expires, or a renewal payment fails after Stripe's retries — the extra capacity it provided ends. Capsules that were active only because that package covered them may then be unscheduled (deactivated), which stops their dead-man timers. Keeping a capsule armed therefore depends on maintaining enough active coverage (the free tier or a package) for it; if you rely on a package to keep capsules running, it is your responsibility to keep that subscription in good standing.
Withdrawal (EU/UK consumers). You may have a statutory right to withdraw within 14 days of purchase — note that, by asking us to start the Service immediately, you may agree that this right ends once performance has begun, to the extent the law allows. Refunds, where due, are handled through Stripe as merchant of record.
9. Cancellation, termination & data deletion
Cancelling a subscription is not the same as deleting your account. You may cancel a package (your paid subscription) at any time from your account or the Stripe billing portal (see section 8); paid access continues until the end of the period you have paid for, and except where required by law fees already paid are non-refundable. Cancelling a package does not delete your account — your account and your capsules remain (subject to the coverage rules in section 8).
Deleting your account
Deleting your account is permanent and irreversible. You start it from your account settings; to protect you it requires a confirmation code e-mailed to your login address (plus your authenticator/recovery code if you have two-factor authentication enabled). Because it cannot be undone once complete, deletion runs with a built-in safety window:
- A grace period (soft deletion). Confirming schedules the deletion and immediately signs you out; your account then sits in a cancellable, "scheduled for deletion" state for a short grace period (by default a few days) before anything is actually erased.
- Changed your mind? Just sign in again. Signing back in during the grace period automatically cancels the deletion and keeps your account exactly as it was — there is no separate recovery step. You can also cancel it from inside the app while you are still signed in.
- What deletion removes. When the grace period ends we permanently delete your account and all your capsules — including capsules that have already been delivered, so any recipient link that has not yet been opened stops working — and we cancel and delete your Stripe customer and subscription.
- No way back afterwards. Once the grace period has elapsed and erasure has begun, the account and its contents cannot be recovered by you or by us, and support cannot restore them — whatever proof of identity is offered.
Deletion from our live systems completes promptly; residual copies in our encrypted backups are then overwritten on our normal backup rotation, so full deletion (including from backups) completes within about 35 days. A limited set of records that we or our payment processor are legally required to keep survives deletion — in particular, as merchant of record Stripe retains your invoice and tax records for past purchases under its own legal obligations, and we keep minimal billing/legal records only for as long as the law requires. How we handle retention and deletion is described in our Privacy Policy.
If you have permanently lost access to your account, we can — after verifying your identity — stop your subscription's future charges, effective at the end of the period already paid for; for security reasons this never restores account access and never changes, pauses, or removes capsules. We may suspend or terminate your account if you materially breach these Terms or the law; we will give notice where reasonable.
10. Changes & availability
We may modify, add, or discontinue features, and we may carry out maintenance. We aim for high availability but do not guarantee the Service will be uninterrupted, error-free, or available at any particular time. We will give reasonable notice of material adverse changes where we can.
11. Disclaimers
Except as expressly stated and to the fullest extent permitted by law, the Service is provided "as is" and "as available" without warranties of any kind, whether express or implied, including fitness for a particular purpose, reliability, or that triggers and deliveries will occur accurately or on time. Nothing in these Terms excludes the statutory rights of consumers that cannot be excluded under applicable law.
12. Limitation of liability
To the fullest extent permitted by law, Capsulene will not be liable for any indirect, incidental, special, or consequential loss, or loss of data, profit, or goodwill. Our total liability arising out of or relating to the Service is limited to the greater of the fees you paid us in the 12 months before the event giving rise to the claim, or EUR 100. Nothing in these Terms limits liability that cannot be limited by law — including liability for death or personal injury caused by negligence, for fraud, or for any statutory consumer rights.
13. Indemnity
To the extent permitted by law (and except where you act as a consumer), you agree to indemnify Capsulene against claims, losses, and costs arising from your content, your use of the Service, or your breach of these Terms — including claims by a recipient or other third party relating to data you provided about them.
14. Intellectual property
The Service, the Capsulene name and logo, and all related software and materials are owned by us or our licensors and are protected by law. These Terms grant you no rights in them other than to use the Service as permitted.
15. Governing law & disputes
These Terms are governed by the laws of Hungary, without affecting any mandatory consumer-protection rights you have in your country of residence. Disputes are subject to the courts of Hungary — except that if you are a consumer, you may bring proceedings in the courts of your country of residence, and proceedings against you may be brought only there, where the law so provides. If you are a consumer resident in Hungary, you may also apply free of charge to a conciliation board (békéltető testület); the competent board and how to find the one for your place of residence are set out in our Legal Notice.
16. General
If any provision is unenforceable, the rest remains in effect. We may update these Terms; we will post the new version with a revised date and, for material changes, notify you — continued use after changes means you accept them. We may assign these Terms in connection with a merger or sale; you may not assign them without our consent. Our failure to enforce a provision is not a waiver. We are not liable for failures caused by events beyond our reasonable control.
17. Contact
Questions about these Terms: support@capsulene.com. Operator: DDS Services Kft., 1136 Budapest, Tátra utca 5/a al2, Hungary. Full statutory company, hosting, and consumer-dispute details are in our Legal Notice.