Terms of Service

1. Overview & Agreement

Welcome to Capsule. These Terms of Service ("Terms") constitute a legally binding agreement between you ("you," "user," or "licensee") and the operators of Capsule ("Capsule," "we," "us," or "our").

These Terms govern your access to and use of our software applications, including the Capsule desktop application (macOS, Windows, Linux, Android), Capsule Web and its player (hosted at withcapsule.app/web and open.withcapsule.app), the Capsule command-line interface (CLI) and Model Context Protocol (MCP) server, the official website (withcapsule.app), and any associated documentation (collectively, the "Services").

By downloading, installing, accessing, or using any part of the Services, you confirm that you have read, understood, and agreed to be bound by these Terms and our Privacy Policy. If you do not agree with these Terms, you must not access or use the Services.

2. The Capsule Architecture

Capsule is a local-first application container and runtime platform built on the fundamental premise that a document is an app. A .capsule file is a portable, single-file container Technical details Each container is an embedded SQLite database storing UI in app_ui and app_assets, data in doc_records, doc_storage, and doc_assets, and policy in app_permissions and app_meta. that packages together:

• Application UI: The self-contained interface, styling, code, and visual assets;
• Structured Data: Your document records, key-value storage, and embedded files;
• Permissions & Metadata: Declared runtime permissions (such as optional outbound network access) and application metadata.

Unlike traditional cloud software-as-a-service (SaaS) platforms, Capsule does not require you to create an account, does not maintain a centralized user database, and does not store or process your documents on remote servers. All computation, storage, and execution occur locally on your own hardware or inside your client browser.

3. Runtime Protection & Security Architecture

Capsule is engineered to run interactive document applications safely. Because a .capsule file packages rich user interfaces, code, and structured data into a single container, Capsule implements multi-layered runtime boundaries Technical details On desktop: per-document Content Security Policies (CSP), Tauri capability ACLs, and host window-label guards. In web player: iframe sandboxing without allow-same-origin. designed to protect your device and preserve your privacy:

• Offline by Default: Documents operate completely offline by default. Outbound network connectivity is blocked unless you explicitly grant access, ensuring document code cannot silently transmit data across the internet.
• Host Boundary Separation: In the desktop application, documents run in an isolated environment separate from native operating system capabilities. Document applications cannot access host APIs, system commands, or files outside their own container.
• Explicit Permission Prompts: Actions that require elevated privileges—such as outbound network access or calling external AI models—require your explicit consent through isolated, trusted prompts that document code cannot tamper with or bypass.
• Browser Sandboxing: In Capsule Web, documents execute client-side within an isolated sandbox that prevents document scripts from accessing cookies, local credentials, or session data.
• Sharing Awareness: While Capsule’s container architecture provides strong defense-in-depth protections, we always recommend standard digital hygiene when opening files received from unfamiliar sources, just as you would with any document or software downloaded from the web.

4. Ownership of Your Content & Intellectual Property

You Own Your Data: You retain complete and unencumbered ownership, copyright, and intellectual property rights in and to any data, documents, templates, code, graphics, databases, notes, or other materials you create, import, or store within Capsule ("User Content"). Capsule does not claim any proprietary rights, licenses, or title to your User Content.

No Transmission or Harvesting: Because Capsule is local-first, your User Content is never uploaded to, transmitted to, or scanned by Capsule servers for advertising, telemetry, or model training.

Capsule Intellectual Property: The Capsule name, brand assets, logo, website design, software, and documentation are protected by copyright, trademark, and other applicable laws. Your use of the software is governed by the applicable license terms provided with the application.

Open-Source Templates & Libraries: Built-in starter templates and vendored third-party libraries (such as SQLite, sql.js, and helper utilities) bundled with Capsule are provided under their respective permissive open-source licenses.

5. AI Features & External Models

Capsule includes features that enable you to generate, inspect, and modify applications using Large Language Models (LLMs). Our AI integration is governed by the following rules:

• Bring Your Own Key (BYOK): Capsule does not resell AI tokens or proxy AI requests through proprietary middle-tier servers. You provide your own API credentials for external AI providers (such as Google Gemini, Anthropic Claude, OpenAI, or local runtimes such as Ollama or LiteRT).
• Direct Client-to-Provider Communication: When you invoke AI capabilities, your prompts and document context are transmitted directly from your local machine to your configured provider. You are subject to the terms of service, acceptable use policies, and data privacy terms of each respective provider.
• Explicit User Consent: An application within Capsule cannot invoke AI text generation without your explicit permission through an isolated host consent dialogue.
• No Warranty on AI Outputs: Outputs generated by AI systems may contain inaccuracies, logical bugs, unintended behaviors, or security vulnerabilities. You are solely responsible for testing, reviewing, and verifying all code or data generated through AI interactions before deploying or relying upon it.

6. Capsule Web & Google Drive Integration

The Capsule Web (available at withcapsule.app/web) allows users to run and edit .capsule files entirely client-side using WebAssembly (sql.js).

Optional Google Drive Integration: Users may optionally link their Google Drive account to open and save .capsule documents directly to Drive:

• Restricted Scope: Capsule requests only the drive.file scope, meaning the application can only access files that you explicitly create with Capsule or select through the Google Drive file picker. Capsule has zero visibility into the rest of your Google Drive.
• Token & Session Handling: OAuth access tokens are kept in temporary browser session memory (sessionStorage) and are discarded when the tab closes. Display-only metadata — your account name and the file's name — is stored in localStorage for convenience across visits and can be cleared at any time through your browser's site data settings. Tokens are never transmitted to or recorded on Capsule servers.
• Google API Policy Compliance: Capsule's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Acceptable Use Policy

You agree to use Capsule in full compliance with all applicable local, national, and international laws and regulations. You agree that you will not:

• Package, distribute, or propagate malicious code, viruses, worms, trojans, ransomware, spyware, or exploit payloads inside .capsule files;
• Use Capsule to develop, distribute, or facilitate deceptive software, phishing interfaces, or unauthorized data exfiltration tools;
• Attempt to probe, breach, exploit, or circumvent the security boundaries, Content Security Policies, sandbox restrictions, or permission systems of the Capsule runtime;
• Use the website, download endpoints, or online infrastructure in any manner that could damage, disable, overburden, or impair server infrastructure or interfere with any other party's use;
• Violate, misappropriate, or infringe upon the intellectual property, privacy, or publicity rights of any third party.

8. Disclaimer of Warranties

WITHOUT LIMITING THE FOREGOING, WE MAKE NO REPRESENTATION OR WARRANTY THAT (A) THE SOFTWARE WILL MEET YOUR REQUIREMENTS, (B) THE OPERATION OF THE SERVICES WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, (C) DATA STORED IN A .capsule FILE WILL BE FREE FROM LOSS OR CORRUPTION, OR (D) DEFECTS IN THE SOFTWARE WILL BE TIMELY CORRECTED.

9. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT SHALL CAPSULE, ITS PROJECT LEADS, CONTRIBUTORS, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE, OR SYSTEM MALFUNCTION, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SOFTWARE OR SERVICES, REGARDLESS OF THE THEORY OF LIABILITY (WHETHER CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

IN JURISDICTIONS WHERE LIMITATIONS OR EXCLUSIONS OF INCIDENTAL OR CONSEQUENTIAL DAMAGES ARE NOT PERMITTED, OUR LIABILITY SHALL BE LIMITED TO THE GREATEST EXTENT PERMITTED BY APPLICABLE LAW, OR THE TOTAL SUM OF FIFTY UNITED STATES DOLLARS ($50.00 USD), WHICHEVER IS LESS.

10. Indemnification

You agree to defend, indemnify, and hold harmless Capsule, its maintainers, contributors, agents, and licensors from and against any and all claims, liabilities, damages, losses, judgments, demands, costs, and expenses (including reasonable legal and attorneys' fees) arising out of or relating to: (a) your access to or use of the Services; (b) any .capsule files, code, or content you author, import, or distribute; (c) your violation of these Terms; or (d) your violation of any third-party right, including intellectual property, privacy, or data protection rights.

11. Changes & Termination

Modifications to Terms: We may update or revise these Terms from time to time. If we make material modifications, we will notify you by updating the "Last updated" date at the top of this page. Your continued use of the Services following the posting of revised Terms signifies your acceptance of the changes.

Termination: You may terminate this agreement at any time by ceasing all use of the Services, deleting your copies of the Capsule desktop application, and deleting your .capsule files. We reserve the right, without prior notice or liability, to suspend or terminate your access to web-hosted components of the Services (such as website downloads or online preview tools) if you breach these Terms.

12. General Provisions

Severability: If any provision of these Terms is found to be unlawful, void, or unenforceable by an arbitrator or court of competent jurisdiction, that provision shall be deemed severable and shall not affect the validity and enforceability of the remaining provisions.

Entire Agreement: These Terms and our Privacy Policy constitute the entire agreement between you and Capsule with respect to the subject matter hereof and supersede all prior or contemporaneous agreements, understandings, or representations.

No Waiver: No failure or delay by Capsule in exercising any right, power, or remedy under these Terms shall operate as a waiver thereof.

13. Contact & Inquiries

If you have questions, feedback, or legal inquiries concerning these Terms of Service, please reach out to us: