Privacy Policy

1. Privacy by Architecture

At Capsule, we believe privacy is not an afterthought or a collection of legal promises; it is an architectural invariant. Modern cloud software frequently centralizes user data, exposing sensitive documents to corporate surveillance, data breaches, and unwanted AI model scraping.

Capsule is built to reverse that trend. The core container format—the .capsule file—packages your application code, assets, records, and metadata into a single portable file that runs locally on your machine or in your browser Technical details Under the hood, a .capsule file is an embedded SQLite database. In desktop environments, Capsule opens it directly; in the browser, Capsule uses a WebAssembly build of SQLite (sql.js) to execute queries purely in client memory without server involvement..

Because there is no centralized database holding user content, Capsule operators have no ability to read, index, monetize, or disclose the contents of your documents.

2. Data We Do Not Collect

To provide complete transparency, the following categories of information are never collected, stored, or processed by Capsule servers:

• Document & Database Content: We do not receive, store, or view the data, tables, text, images, files, or records stored inside your .capsule files.
• User Account Credentials: Capsule operates without user registration or accounts. You do not need to provide a name, email address, password, or profile information to use the desktop application or web player.
• Application Telemetry: We do not track which templates you open, what features you click, how long you work, or what applications you build. The desktop application includes no analytics SDKs or remote diagnostic beacons.
• Document Code or Assets: Custom HTML, CSS, JavaScript, or media assets embedded in your capsule documents are never transmitted to our servers.

3. Local Device Processing

When you run the Capsule desktop application (macOS, Windows, Linux, Android), all processing occurs on your local hardware:

• File Storage: Your .capsule files are saved directly to the locations on your file system that you choose (such as Documents, Desktop, or external drives).
• Local Preferences: Desktop application settings (such as recent file paths, window bounds, and AI provider configurations) are stored locally in standard application data directories managed by your operating system Technical details Preferences are stored in standard OS paths (such as ~/Library/Application Support/capsule on macOS or %APPDATA%/capsule on Windows). AI keys reside in ~/.capsule/ai_config.json with user-only file permissions..
• AI Provider Keys: If you configure an API key for an AI provider (such as Google Gemini, Anthropic, or OpenAI), the key is stored securely in your local configuration file and is only read by the native desktop process to communicate directly with the API endpoint you selected.
• Software Updates: The desktop application periodically checks for new releases by fetching version information from our downloads server Technical details Requests fetch static version metadata from https://downloads.withcapsule.app/latest.json over HTTPS. No analytics, device telemetry, or document information is transmitted..

4. Capsule Web & Player Sandbox

The Capsule Web (hosted at withcapsule.app/web and open.withcapsule.app) enables users to inspect and run .capsule documents directly inside their web browser.

• In-Browser Execution: When you open or drag and drop a .capsule or .html file into the browser, the file is read and run entirely within your browser's memory. The file is never uploaded to Capsule servers.
• Sandboxed Security Boundary: The document's user interface runs inside an isolated browser sandbox Technical details The document UI is mounted inside an <iframe> configured with sandbox="allow-scripts allow-forms" and expressly omitting allow-same-origin. In-browser SQLite queries run via WebAssembly (sql.js). that strictly blocks document code from accessing your browser cookies, local storage, or credentials on the host origin.
• Session Data: Any changes made while previewing a document in the browser remain in local memory until you choose to download the modified .capsule file or save it to your connected Google Drive.

5. Google Drive & Google API Limited Use Disclosure

On the web player (open.withcapsule.app), users may optionally connect Google Drive to open existing .capsule files or save edits back to their cloud storage.

Our integration with Google APIs operates strictly under the following safeguards:

• Strictly Limited File Access: Capsule can only access files that you explicitly open through the Google Drive file picker or files created by Capsule Technical details OAuth access is requested under https://www.googleapis.com/auth/drive.file via GIS. Temporary access tokens live in sessionStorage["capsule_gdrive_token"]; display info is in localStorage.. Capsule cannot view, list, search, or access any other files or folders in your Google Drive.
• Direct Client-to-Google Communication: Requests travel directly between your browser and Google's servers. Capsule operates no proxy or backend service in between, so your files and credentials never touch our servers.
• Temporary Session Tokens: Authentication tokens are temporary and discarded when you close the browser tab. They are never saved to permanent disk storage or shared with anyone.
• No AI Model Training: Information received through Google APIs is never used to train, fine-tune, or improve machine learning or artificial intelligence models.
• No Server-Side Access: Because all communication stays between your browser and Google, Capsule has no access to your Google account data, files, or profile. Nothing is shared with data brokers, advertisers, or third-party marketing services.

6. Third-Party AI Services (Bring Your Own Key)

Capsule provides optional AI-assisted document creation and editing tools (such as "Edit with AI" in the desktop host). Our AI integration is strictly Bring Your Own Key (BYOK):

• Direct Transmission: When you execute an AI command, your prompt and relevant document context are transmitted directly from your machine to your configured AI provider's API endpoint (e.g., Google Cloud Gemini API, Anthropic API, OpenAI API, or local endpoints).
• No Middleman Logging: Capsule operates no intermediate proxy servers that inspect, cache, or log your prompts, completions, or API keys.
• Third-Party Terms: Data sent to external AI providers is governed by the respective provider's privacy policy and data retention terms. We encourage you to review their policies:
  • On-Device Providers: If you choose an on-device runtime such as LiteRT or Ollama, model inference runs entirely on your machine. No prompts, completions, or document data ever leave your device Technical details Initial setup downloads verified, public model weights once from model repositories (such as Hugging Face). Once downloaded, all prompt processing and text generation operate completely offline..
  • Google Privacy Policy & Gemini API Terms
  • Anthropic Privacy Policy
  • OpenAI Privacy Policy

7. Website Infrastructure & Server Logs

The marketing website (withcapsule.app) and web player are hosted using Firebase Hosting, a content delivery network (CDN) provided by Google Cloud.

When you visit our website, standard web server access logs are automatically recorded by the CDN edge nodes for operational and security purposes. These logs may include:

• Your Internet Protocol (IP) address;
• Date, timestamp, and HTTP request method and path;
• User-agent string (browser type, operating system version);
• Referring URL and response status code.

These logs are processed solely to deliver cached assets, diagnose network routing issues, prevent distributed denial-of-service (DDoS) attacks, and maintain server reliability. They are not linked to personal user profiles and are retained according to Google Cloud's standard infrastructure retention policies.

8. Cookies & Local Browser Storage

No Tracking Cookies: The Capsule website and applications do not use cookies for cross-site tracking, advertising profiling, or behavioral analytics.

Functional Storage Only: In the web browser player, local browser storage Technical details Uses sessionStorage["capsule_gdrive_token"] for the session token, localStorage["capsule_download_banner_dismissed"] for the banner, and localStorage["capsule_gdrive_user"] for display metadata. is used strictly for necessary functional purposes—such as keeping you signed in to Google Drive during your session and remembering non-identifying UI preferences (like dismissing an announcement banner). None of this data is transmitted to Capsule servers.

You can clear this storage at any time through your browser's settings without affecting your ability to open and edit files.

9. Data Retention & User Sovereignty

Because Capsule does not store your documents, records, or personal data on remote servers, you hold complete sovereignty over your data lifecycle:

• Complete Control: Your data remains on your physical storage media for as long as you retain the .capsule file.
• Instant Permanent Deletion: To permanently delete all data associated with a capsule, simply delete the .capsule file from your computer or cloud drive. Because we maintain no central server copies or cloud backups, deletion is immediate and irrevocable.
• Data Portability: A .capsule file is standard SQLite. You can open, inspect, and export your tables at any time using any standard SQLite client, the Capsule Data Editor, or our CLI tools without proprietary vendor lock-in.

10. Your Rights (GDPR, CCPA/CPRA & Global Privacy Laws)

Depending on your jurisdiction, you may have statutory rights under data protection laws such as the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK GDPR, and other regional frameworks.

Capsule's local-first architecture inherently upholds these rights:

• Right of Access & Portability: All your data is stored in open, standard SQLite format directly on your machine. You always have 100% direct access to your data.
• Right to Erasure (Deletion): You can erase any document or dataset instantly by deleting the file from your disk.
• No Sale or Sharing of Personal Data: Capsule does not sell, share, or monetize personal data. We do not engage in targeted cross-context advertising.
• Non-Discrimination: We do not discriminate against any user for exercising their statutory privacy rights.

For any inquiries regarding personal data processed via our web hosting infrastructure, you may contact our data protection team at privacy@withcapsule.app.

11. Children's Privacy

The Services are not directed to children under the age of 13 (or under 16 where required by local law). Capsule does not knowingly collect, request, or solicit personal information from children. If you become aware that a child has provided personal information through our website infrastructure, please contact us immediately so we can take appropriate steps to delete such data.

12. Changes to This Policy

We may update our Privacy Policy periodically to reflect changes in software capabilities, statutory requirements, or operational practices. When updates are published, we will revise the "Last updated" date at the top of this document.

Because Capsule maintains no user email lists or account registries, we encourage users to check this page periodically. Continued use of Capsule following any changes indicates your acceptance of the updated policy.

13. Contact & Data Officer

If you have questions, comments, or data privacy requests concerning this Privacy Policy, please contact us: