Privacy policy
What we keep, and what we never touch.
- Effective
- 17 September 2026
- Version
- 9
- Covers
- trycapsule.app, the guest camera and the film app
A privacy policy is usually written to be survived rather than read. This one is a promise you can check: the photographs of your night reach the people who were there and nobody else.
The short of it — nobody has to sign up. The app makes a key on your phone and that is your account: no phone number required. You can add an email and password in You if you want the same films on another phone, or Sign in with Apple. Hosts and guests each give a film a name to go by. We hold the photographs, we hand them back, and in between we do not look at them, learn from them, or show them to anyone outside the film.
Version 9 replaces the policy of 14 September 2026. What changed: this marketing site can count visits and record how the pages get used, after you say yes on the card in the corner. The app and the films are untouched.
Who we are, and what this covers
Capsule is made by Bulk Studio, the trading name of ManagementSupport LLC, a limited liability company registered in Wyoming, in the United States. Where data protection law such as the GDPR applies, we are the controller: if something goes wrong with your data, we are the ones who answer for it.
This covers the site you are reading, the Capsule app on iPhone, and the same app on the web at app.trycapsule.app. It stops where your download begins.
What a host gives us
A host is whoever starts a film, and the account is deliberately thin. The app makes a random key on your phone and signs you in with it. An email and password are optional, in You, if you want the same films on another phone.
- A key on your phone
- The key lives on your phone. We store only a one-way fingerprint of it, which is enough to recognize the phone and useless for anything else.
- The name you host under
- Guests see it on the invitation and in the film.
- Sign in with Apple, if you use it
- Optional, and only there so you can get your films back on a new phone. Apple gives us an ID for your Apple Account, your name if you share it, and an email address, which can be one of Apple’s private relay addresses. We do not send film or marketing mail to it.
- Email and password, if you add them
- Optional, in You. We store the email and a one-way hash of the password so another phone can sign in. We do not send a reset mail, or any film or marketing mail.
- The films you make
- Title, cover picture, dates and times, the size and settings you chose, and the pass code that lets people join. They live as long as the film does.
- What you paid
- Films are bought in the app, and Apple takes the payment; we never see the card or your Apple Account. From Apple we keep the transaction number, what it bought, the price and currency, the App Store country and the date, because tax rules need them.
- Notifications, if you allow them
- On iPhone, a push token and your selected language, so we can tell you when a film seals or develops, and who has joined, in that language.
- Server logs
- Cloudflare, which runs our servers, logs requests and errors so we can find faults, and keeps them for up to seven days. When a phone signs in for the first time, its IP address is checked to slow down mass sign-ups, and we do not store it.
Lawful basis, where the law asks for one: our contract with you, for running films and payments. For logs and abuse protection, legitimate interests — namely keeping the thing running.
What a guest gives us
Very little, and that is the design rather than an oversight. No sign-up, no password, no email address, no phone number, no address book, no location. A guest opens a film’s link, gives a name and has a camera.
- The photographs they take
- The point of the whole thing. They have a clause of their own below.
- A name for the film
- Joining asks for one. The host and everyone else in the film see it next to the guest’s photographs. A first name or a nickname is plenty.
- A key on their phone
- The same quiet account a host has: a random key on the phone, or in the browser on the web, and its fingerprint with us. It is how the counter knows which shots are yours.
- Captions and loves
- A caption, if they write one, and which photographs they love once the film develops.
- Notifications, if they allow them
- On iPhone, a push token and the selected language, so we can say when the film develops in that language.
Guests do not need to provide an email address or phone number to join. A device account keeps access to the films it has joined. Optional Sign in with Apple may provide a name and email address.
The photographs, and how long we keep them
A photograph is the most personal thing anyone hands us. It uploads over an encrypted connection and is stored encrypted, with AES-256, on Cloudflare’s storage in its Eastern Europe region.
Your phone prepares it first: the photograph at up to 2,400 pixels on its long side, and two small copies with the film look developed into them. Preparing it writes a fresh file, so what we store carries no location and none of the other details a camera tucks into a photo. Capsule never asks where you are. A photograph should not be able to tell a stranger which house you were in.
While a film is sealed, the photographs stay closed. Everyone in the film can see who took each one, when, and any caption, over a tiny blurred preview. Two settings open things early, and both start off: the host can let guests see their own shots, and can let themselves peek.
- Films and their photographs
- Kept until the host deletes the film. The terms let us delete a free film thirty days after it develops; we do not do that yet, and this line will change before we start.
- A film you delete
- The photographs go at once, for everyone in it, with the captions, loves and guest list. We keep a record that the film existed (its title, dates and host) and its payment records. Our database can be restored to any point in the last thirty days, so those other records can be brought back that long; the photographs cannot.
- Your account
- Kept until you delete it, in the app under You, then Delete account. It goes straight away: your sign-in, your name, your captions and loves, and every film you host, for everyone in it, with no record left that it existed. Your photographs in other people’s films go too, unless you choose to leave them there as “Guest”, with no name or caption. If you signed in with Apple, we ask Apple to end Capsule’s access. Payment records stay, without your name, for as long as tax rules require.
- Backups
- Our database, and each film’s list of shots, captions and loves, can be restored to any point in the last thirty days. If we ever restore one, we delete again every account that was deleted after that point. Deleted photographs cannot be brought back.
- A frame someone asks us to pull
- Gone from the film and from our storage within a day. We cannot reach a download somebody already made, and we will not pretend otherwise.
- A link to a photograph
- Private, signed, and dead within two hours. Anyone holding a live link can open it, so do not paste one anywhere public.
Nobody here browses films, and there is no internal tool for it.
What we never do
Everything above is what we do. This is the part we would have to break the company to change, set down in the same document as the boring ones.
Who else touches any of it
We do not run data centers, and we do not send email. These four companies handle something for Capsule, and jsDelivr only ever sees the IP address of a phone loading a script from them. This is the whole list. Visit counts from this site, after you say yes, live on our own server in the EU — they are not in the table because no other company sees them.
| Company | What they do | Where |
|---|---|---|
| Cloudflare | Runs our servers, the database and photo storage, and serves this site and the web app | Stored in Eastern Europe, served worldwide |
| Apple | Sign in with Apple, payments for films bought in the app, and delivering notifications to iPhones. We never see the card | United States and Ireland |
| Expo | Passes notifications on to Apple: a device token, the film’s name and the message | United States |
| jsDelivr | Serves the QR scanner the web app loads, so they see your IP address | Worldwide network |
Add one or drop one and this table changes the same day, and the version at the top goes up.
Cookies — we use none
This site sets no cookies, and neither does Capsule on the web. There is a small card in the corner: if you say yes, we count visits on this marketing site and record how the pages get used — session replay and heatmaps — so we can see what is working. Not ads. Never the films, and never the app. If you say no, we load none of it. Your choice lives in your browser’s own storage, next to the language you picked.
On the web, the app keeps its key, your sign-in, the name you last used and your language choice in your browser’s own storage, on your own device. Clear it and that browser loses its way back into your films. The iPhone app keeps these details in the phone’s keychain. Deleting your account clears the key, sign-in and name, and the photographs the app kept, from the phone or browser you delete it on. This website also remembers your language choice, and your answer to the card, in your browser’s local storage.
Where your data lives, and where it travels
Photographs and the database are stored with Cloudflare, in its Eastern Europe region. That is where they were set up rather than a legal guarantee, and if it changes, this page changes. Each film’s running state (its list of shots, captions and loves) sits in a Cloudflare data center near where the film was started.
Some things travel, and we will name them. Cloudflare serves pages and photographs from data centers around the world, near whoever is looking. Notifications pass through Expo, in the United States, on their way to Apple. Payments and Sign in with Apple are Apple’s. And the company that runs Capsule is in the United States.
If you are in the UK or the EU, that means your data is handled outside it. Ask, and we will tell you where anything of yours is and who holds it.
Children
Hosting a film takes being at least sixteen, and a guest under sixteen takes part only with a parent or guardian’s agreement, which the host confirms. We do not ask anyone’s age. We do not knowingly hold an account belonging to a child, and if we find one we close it.
The honest part: children are at parties, and children end up in photographs. No policy solves that. What we can do is this — a parent or guardian can ask us to pull any frame a child appears in, from any film. We do not ask for proof and we do not ask why. It goes within a day.
Your rights, and how to use them
You can ask for a copy of everything we hold about you, ask us to correct it, delete it, hand it over in a portable file, object to a use, or withdraw consent. Rights, not favors, and free.
Email privacy@trycapsule.app and say what you want in your own words. No form, no portal, no reference number. If it is about one film, name the film.
Deleting your account is in the app, under You, then Delete account, and it happens straight away. If you can no longer open the app, write to us instead. An account linked to Apple, or saved with an email and password, can also be reached on another phone and deleted from there.
We answer within thirty days. If the request touches a film, we may ask for something only someone in it would know, like its pass code and the name you joined under — the only way to tell you from someone else asking for your photographs.
If we get it wrong, complain to the data protection authority where you live; in the UK that is the Information Commissioner’s Office. You do not have to come to us first. We would prefer it. Your call.
When this policy changes
It will change, because the company will. The version goes up, the date changes, and old versions stay — ask and we will send you any of them.
If a change is material — a new company handling your data, a longer retention period, a new use of anything — it goes up here thirty days before it takes effect. Not after.
How to reach a person
Write to privacy@trycapsule.app. A person reads it and answers it, with no ticket system in between. There is no office to post a letter to; email is the way in.
Capsule is made by Bulk Studio, the trading name of ManagementSupport LLC. Everything that is not a privacy question — support, events, press — is on the contact page.
That is all of it. Now put the phone down and have the night.