Privacy Policy

Capsule is a social feed of interactive apps (“capsules”) that people create with AI and share. This policy explains what we collect, why, who processes it, and the control you have over it. The short version: we collect what's needed to run the service, public content is public, we don't sell your personal information, and you can export or delete everything yourself.

Who is responsible

The data controller is Nadir Balena, Milano, Italy (individual operator; pre-launch beta, not yet commercially operated). For anything privacy-related, write to legal@thecapsuleapp.com.

What we collect

• Account: your email address (used to send sign-in codes) and the profile you set up — display name, username, bio, avatar.
• Content you create: capsules, the prompts you write to generate them, comments, likes, saves, follows, and reports you file.
• Capsule interaction data: when capsules are played we record events such as plays, time spent, screen changes, and tap positions inside the capsule. These power each creator's analytics dashboard. Events are tied to a random session id and, if you're signed in, your account.
• Product analytics: a small set of named events about how people move through Capsule (for example: landing page viewed, signed in, capsule generated, capsule published). We do not record your screen, keystrokes, or the text of what you tap.
• Usage limits: how many AI generations and tokens you've used, to enforce plan limits. If you're signed out, limits are keyed to a hashed version of your IP address.
• Payments: purchases are sold through Link, Stripe's merchant-of-record service. Stripe collects your name, email, billing address and payment details to process the payment and meet its tax obligations, as an independent controller under its own privacy policy. We receive and store your plan, subscription status, purchase history and a Stripe customer id; we never see or store your card details.
• Technical data: server logs and error reports (IP address, browser and device type, timestamps, the error that occurred) used for security and to fix bugs.

Why we use it (legal bases)

• To provide the service you signed up for (contract): your account, generating and hosting capsules, the feed, comments, creator analytics, subscriptions.
• Legitimate interests: keeping Capsule secure, preventing abuse and spam, enforcing usage limits, fixing errors, and understanding in aggregate how the product is used so we can improve it. You can object at any time (see Your rights).
• Legal obligations: keeping billing and tax records, and responding to lawful requests.
• Consent, where the law requires it — you can withdraw consent at any time without affecting what happened before.

How AI generation works with your data

When you generate a capsule, chat with an AI capsule, or generate an image, your prompt and the relevant context (for example the capsule you are editing) are sent to an AI model to produce the result. Text requests go through OpenRouter, a service that routes each request to a model provider such as Anthropic, OpenAI, Google, or another provider we select for quality and cost; Anthropic is also used directly as a backup. Images are generated by Google. We configure OpenRouter to use only providers that do not use your prompts to train their models. These providers process your data only to return the result. Please don't put sensitive personal information (yours or anyone else's) in prompts.

Capsules are AI-generated, and some capsules contain an AI chat: when you talk to one, you are talking to an AI, not a person.

What's public

Published capsules, your profile (name, username, bio, avatar, follower counts), comments, and likes are visible to other users — that's the point of a social feed. Published capsules can be remixed by other users (see the Terms). Your email is never public. Unpublished capsules are visible only to you.

Who processes your data

We use these service providers, each bound by a data processing agreement:

• Supabase — database, authentication, file storage (EU region).
• Vercel — hosting and serving the app.
• OpenRouter and the model providers it routes to; Anthropic — AI text generation.
• Google — AI image generation.
• Stripe — payments and subscriptions. When you buy, Stripe (through Link) is the merchant of record and an independent controller for the checkout data it collects.
• Resend — sending sign-in emails.
• PostHog — product analytics (the named events above).
• Sentry — error monitoring.

Advertisers: Capsule may show ads or sponsored content. Advertisers receive aggregate performance statistics (plays, taps, completions) — never your identity or contact details. We do not sell your personal information. Legal: we may disclose data when required by law or to protect users and the service.

International transfers

Several of these providers are based in, or process data in, the United States. Where personal data leaves the European Economic Area, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

Cookies and local storage

We use a cookie to keep you signed in and your browser's local storage for drafts and preferences. Our product analytics run through our own domain and store a random identifier in your browser so visits can be counted. We don't use advertising or cross-site tracking cookies.

How long we keep it

• Account, profile, and content: while your account exists. Deleting your account removes your profile, capsules, comments, and interactions.
• Server logs and error reports: short-term, typically no more than 30 days.
• Usage-limit counters: only as long as needed to enforce current limits.
• Billing records: as long as tax and accounting law requires (up to 10 years).
• Aggregate statistics that no longer identify you may be kept.

Your rights

You can access, correct, export, or delete your data, restrict or object to how we use it, and withdraw consent. Export and account deletion are self-service in Settings; for anything else write to legal@thecapsuleapp.com and we'll respond within one month. You also have the right to lodge a complaint with a data protection authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live.

Age

Capsule is for people aged 14 and over, or the higher minimum age for using online services in your country. We don't knowingly collect data from children below that age; if you believe we have, contact us and we'll delete it.

Changes

If we make material changes to this policy we'll post the new version here, update the date above, and tell signed-in users in the app before the changes take effect.