Skip to main content
Back

PRIVACY POLICY

Last updated: October 12, 2026

Overview

Capsule ("we", "our", or "the app") is a voice-first personal assistant that helps you capture and organize your thoughts. This Privacy Policy explains how we collect, use, and protect your information in compliance with GDPR, CCPA, and other privacy regulations.

Information We Collect

When you use Capsule, we may collect:

  • Voice recordings: Audio captured when you tap Record. Whether it is kept depends on your plan. See Data Retention.
  • Transcriptions: Text versions of your voice recordings, stored securely to enable search and organization features.
  • Photos: Images you capture or upload for AI analysis and organization.
  • Account information: Email address and authentication data when you create an account. Upon signup, we send a welcome email to the address you provide via our transactional email provider (Resend). You may opt out of non-essential communications at any time by contacting us at privacy@capsl.life.
  • Subscription and payment status: Subscription tier (free, Capsule+, or Pro), payment status (active, failed, or canceled), and billing identifiers from our payment processor (Stripe). We do not store full card numbers; payment method details are held by Stripe under their own privacy policy. If you subscribe in the iPhone app, Apple processes the payment. We receive the product, the transaction identifier and the subscription dates, and never your payment details.
  • Usage data: On the website only, and only if you opt in, usage analytics (PostHog) linked to your account ID, never your email. The iPhone app sends no usage analytics.

AI Processing Services

Capsule uses third-party AI services to provide transcription and classification features. By using Cloud AI mode, you consent to your data being processed by these services:

  • OpenAI Whisper: Voice recordings are sent to OpenAI's servers for speech-to-text transcription. OpenAI processes the audio and returns the transcribed text. Every Apple Watch recording is sent this way on every plan, while Cloud AI is on. Phone recordings are sent this way only on Capsule+ and Pro, and only while Cloud AI is on; on the free plan, your phone's speech recognition transcribes them. OpenAI does not use the audio to train its models, and under its API terms may keep it for a limited time for abuse monitoring. OpenAI's privacy policy: openai.com/privacy
  • Anthropic Claude: Your words (transcripts and typed text), photos and Ask questions are sent to Anthropic's servers to sort captures into life lenses (Self, Home, Work, Health, Future), describe photos and answer Ask questions. Ask sends your question and the captures it searches. Anthropic does not use your data to train models. Anthropic's privacy policy: anthropic.com/privacy

Biometric Data Disclosure: Voice recordings may constitute biometric data under certain jurisdictions (e.g., Illinois BIPA, Texas CUBI, Washington state biometric law). When you use Cloud AI mode, your raw voice audio is transmitted to OpenAI's servers for transcription. Voice characteristics (pitch, cadence, accent) are inherent in audio data. OpenAI processes the audio solely to return the transcript, does not use it to train its models, and may keep it for a limited time for abuse monitoring as its API terms allow. By enabling Cloud AI transcription, you explicitly consent to this transmission and processing of your voice data. You may withdraw consent at any time by turning Cloud AI off in Settings.

Local only: Turn Cloud AI off in Settings. Then nothing is sent to OpenAI or Anthropic: no words, recordings, photos or Ask questions. Your phone's built-in speech recognition still transcribes what you say, which may be less accurate, and AI classification and Ask are off. Apple Watch recordings are not sent: they wait on the watch until Cloud AI is back on.

Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on the following legal bases:

  • Consent (Article 6(1)(a)): For AI processing via third-party providers, optional product analytics (website only), and marketing communications.
  • Contract Performance (Article 6(1)(b)): To provide the Capsule service features you've signed up for.
  • Legitimate Interest (Article 6(1)(f)): For security, fraud prevention, and service improvement.

How We Use Your Information

Your information is used to:

  • Transcribe voice recordings into searchable text
  • Categorize and organize your captures using AI
  • Sync your data across devices (when signed in)
  • Improve the app from usage analytics on the website (PostHog), linked to your account ID, with consent
  • Send service-related notifications
  • Marketing communications: If you opted in during waitlist signup or account creation, we may send product updates, feature announcements, and newsletter content. Every marketing email includes a one-click unsubscribe link at the bottom. You may also unsubscribe at any time by emailing privacy@capsl.life with the subject "Unsubscribe". We process unsubscribe requests within 10 business days. Unsubscribing from marketing does not affect transactional emails (e.g., account verification, billing receipts, security alerts).

Data Retention

We retain your data according to the following schedule:

  • Voice recordings: On the free plan, a recording with words is deleted from your phone once it is transcribed, and only the words are kept. A recording with no words is kept on your phone, not uploaded, so that what you said is not lost. On Capsule+ and Pro, recordings are kept with their captures, on your phone and in Capsule's storage, until you delete the capture or your account. Recordings too large to upload in one go stay on your phone. Health-lens recordings and photos stay on your phone, encrypted, and Apple Watch Health recordings are not uploaded (see Health Information). Other Apple Watch recordings are kept in Capsule's storage on Capsule+ and Pro, and are not kept on the free plan.
  • Transcriptions and captures: Stored until you delete them or delete your account.
  • Account data: Retained while your account is active. When you request deletion, the account is scheduled for deletion 7 days later, and the nightly run after that date deletes its live data. You can cancel within those 7 days.
  • Analytics data: Website only, and only if you opt in. Linked to your account ID, not anonymized. Individual session data retained for 90 days.
  • AI processing logs: OpenAI and Anthropic process your data to return a result and do not use it to train their models. Under their API terms, they may keep it for a limited time for abuse monitoring.
  • Trial accounts: When a trial ends, your account moves to the free plan. Nothing is deleted.
  • Failed payment recovery: If a payment fails, your account is downgraded to the free tier. Your captures remain accessible. Stripe may retry the charge for up to 7 days per our billing settings. Account data is not deleted due to payment failure.
  • Orphaned media: Apple Watch audio in cloud storage that no capture refers to is removed by the daily retention run once it is more than 7 days old. Other audio and image files that a capture no longer refers to (for example after a sync error) are not removed automatically yet; they are listed for review by an administrator.
  • Privacy preference audit logs: When you change cookie or AI processing preferences, we record a hashed (one-way) version of your IP address for security and audit purposes. Hashed IPs cannot be reversed to identify you. These audit records are retained for 90 days.
  • Database backups: Our database provider (Supabase) maintains automated backups for disaster recovery. When you delete your account, your live data is deleted within 30 days; however, encrypted backup copies may persist for up to an additional 30 days before expiring automatically. We cannot selectively remove data from backups, but backups expire on a rolling schedule and are subject to the same access controls as live data.

Data Processors & DPA Status (GDPR Art. 28)

Under GDPR Article 28, we have Data Processing Agreements (DPAs) in place with all third-party processors who handle your personal data. The following processors are engaged in providing the Capsule service:

  • Anthropic (Claude AI): With Cloud AI on, processes your words, photos and Ask questions to file captures into life lenses, describe photos and answer Ask questions. DPA executed under Anthropic's standard data processing terms (available at anthropic.com/legal/privacy). Anthropic is certified under the EU-US Data Privacy Framework.
  • OpenAI (Whisper): Processes voice audio for speech-to-text transcription: every Apple Watch recording on every plan while Cloud AI is on, and phone recordings on Capsule+ and Pro while Cloud AI is on. DPA executed under OpenAI's data processing addendum (available at openai.com/policies/data-processing-addendum). OpenAI is certified under the EU-US Data Privacy Framework.
  • OpenAI (embeddings): For operator and admin accounts only, the text of captures and search keywords is sent to OpenAI to build and query semantic search. Ordinary accounts are not sent to OpenAI for this.
  • Supabase: Primary database and file storage provider. DPA available under Supabase's enterprise data processing terms. Supabase offers EU data residency and is GDPR-compliant.
  • Stripe: Payment processing and subscription management. Stripe is certified under the EU-US Data Privacy Framework and maintains a comprehensive DPA available at stripe.com/legal/dpa. Payment card data is processed by Stripe and never stored by Capsule.
  • Vercel: Application hosting and edge delivery. DPA available under Vercel's data processing addendum. Vercel is GDPR-compliant with EU data transfer safeguards.
  • PostHog: Optional product analytics on the capsl.life website only, with your consent, linked to your account ID and never your email or name. On the website, with your consent, PostHog may record how you use pages (session replays), linked to your account ID, with all page text and anything you type masked. It never runs in the Capsule iOS app. PostHog is GDPR-compliant and offers EU cloud hosting.To withdraw analytics consent at any time, open Profile → Manage Cookies on the website and turn off Analytics. PostHog will immediately stop collecting new events, and you may request deletion of historical analytics data by contacting us at privacy@capsl.life.
  • Resend: Transactional email delivery (account notifications, verification emails). Resend is GDPR-compliant. Only your email address is shared for the purpose of delivering service emails.
  • Sentry: Error monitoring and crash reporting. Personal data in error reports is masked before transmission (user IDs are hashed, PII is scrubbed).
  • GitHub: Issue tracking for feedback you send from the app. Before anything is sent, email addresses, phone numbers and card-like numbers in the feedback text are removed. GitHub's privacy statement applies, at docs.github.com/site-policy/privacy-policies.
  • Upstash (Redis): In-memory rate limiting and short-term invite code attempt tracking. Only anonymized IP addresses and attempt counts are stored; no personal data is persisted beyond the rate-limit window. Upstash is GDPR-compliant with EU-region hosting available. DPA available at upstash.com/trust/dpa.pdf.
  • Cloudflare (Turnstile): Bot protection on signup and waitlist forms. Turnstile collects limited browser signals to verify real-user interactions without traditional CAPTCHAs; it does not track users across sites. Cloudflare is GDPR-compliant and certified under the EU-US Data Privacy Framework. DPA available at cloudflare.com/cloudflare-customer-dpa.

You may request a copy of any DPA by contacting us at privacy@capsl.life.

International Data Transfers (GDPR Chapter 5)

Your data may be transferred to and processed in the United States and other countries where our service providers operate. Post-Schrems II, EU→US transfers require an approved transfer mechanism. We rely on the following:

  • EU-US Data Privacy Framework (DPF): Anthropic, OpenAI, Stripe, and Vercel are certified under the EU-US DPF (successors to Privacy Shield), which the European Commission recognized as providing an adequate level of data protection in its July 2023 adequacy decision.
  • UK International Data Transfers: For users in the United Kingdom, we rely on the UK-US Data Bridge (the UK's equivalent of the EU-US DPF, effective October 2023) for transfers to US processors that are certified under the Bridge. For processors not covered by the UK-US Data Bridge, we use the UK International Data Transfer Agreement (IDTA) or the EU SCCs with the UK Addendum as the lawful transfer mechanism under the UK GDPR.
  • Standard Contractual Clauses (SCCs): For processors not covered by the EU-US DPF, we rely on the European Commission's Standard Contractual Clauses (2021/914) as the transfer mechanism. SCCs are incorporated into our DPAs with all relevant processors.
  • Technical safeguards: All data is encrypted in transit (TLS 1.3) and at rest (AES-256) regardless of transfer mechanism.

Our primary data storage is provided by Supabase, which offers data residency options and complies with GDPR requirements. For EU users, data is stored in Supabase's EU region where technically feasible.

Data Storage & Security

Your data is stored securely using industry-standard encryption. We use Supabase for storage, with row-level security. Your captures are encrypted in transit (TLS 1.3). Health-lens recordings and photos are encrypted on your phone with AES-256-GCM. The words of a capture are not encrypted on the phone. Recordings are kept only where the Data Retention section says.

Health Information (PHI)

Captures classified under the "Health" lens may contain Protected Health Information (PHI). We treat this data with additional care:

  • Recordings and photos in Health stay on your phone, encrypted with AES-256-GCM. Apple Watch Health recordings are not uploaded to Capsule's storage. Their words sync to Capsule's servers like other captures. When a capture moves into Health after it was saved to your account, Capsule removes its recording and photo from Capsule's storage the next time your phone is online.
  • With Cloud AI on, the words and photos of Health captures are sent to Anthropic (Claude) to file them and describe the photos. Their recordings go to OpenAI to transcribe, on the plans and in the cases described under AI Processing Services. Anthropic does not use your data to train models. The descriptions and text read from a Health photo stay on your phone. With Cloud AI off, nothing is sent.
  • We do not share health data with advertisers. Apart from the processors named in this policy, we do not share it with third parties.
  • Health data is processed by AI only to transcribe, describe and file it (not diagnosis or medical advice)
  • Warning: Capsule is not a medical device and should not be used for medical diagnosis or treatment decisions

HIPAA Disclaimer: Capsule is not a HIPAA-covered entity and does not claim HIPAA compliance. We do not provide healthcare services or act as a business associate to any covered entity. While we apply additional safeguards to health-classified captures (encryption, consent gating, audit logging), users should not store protected health information (PHI) that requires HIPAA-level protections. If you need HIPAA-compliant storage, please use a dedicated healthcare platform.

Non-Medical Device Notice: Capsule is not a medical device and should not be used for diagnosis, treatment, or medical advice. Nothing in the app or its AI-generated output constitutes medical guidance. Always consult a qualified healthcare professional for any health-related decisions.

Microphone Access

Capsule requires microphone access to record voice notes. Recording starts when you tap Record and stops when you tap Stop or reach your plan's recording limit. If you turn on the optional "Oh Capsule" wake word in Settings, Capsule also listens on Today while the app is open and in front, to hear the wake word. The phone's speech recognition turns what it hears into text, and Capsule checks that text on the phone for the wake word. Capsule does not save or send that text. Nothing is recorded until the wake word is heard, and then only after you tap Record in the feedback box that opens. We never record audio in the background.

Third-Party Services

We use the following third-party services:

  • OpenAI Whisper: For speech-to-text transcription (Cloud AI mode only)
  • Anthropic Claude: For AI classification and image analysis (Cloud AI mode only)
  • Supabase: For secure data storage and authentication
  • Vercel Inc.: For hosting and deployment. Vercel processes request metadata (IP addresses, headers) as part of serving the application. See Vercel's Privacy Policy.
  • PostHog: For analytics (with your consent)
  • Stripe: For payment processing (subscription plans)
  • Resend: For transactional email delivery (account notifications, subscription updates, parental consent verification). Resend processes recipient email addresses and message content solely for delivery. See Resend's Privacy Policy.
  • Cloudflare Turnstile: For bot protection on forms (signup, waitlist). Turnstile verifies that interactions come from real users without traditional CAPTCHAs. It collects limited browser signals but does not track users across sites. See Cloudflare's Privacy Policy.
  • Sentry: For error tracking and performance monitoring. When errors occur, Sentry collects technical information (error messages, stack traces, browser type, and anonymized session data) to help us fix issues. Session replays are anonymized with all text masked and media blocked. User IDs may be included for debugging but emails and PII are never sent. Data is retained for 90 days. Sentry operates in the US; data transfers are protected by Standard Contractual Clauses (SCCs). See Sentry's Privacy Policy.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You can request information about the categories and specific pieces of personal information we collect, use, and disclose.
  • Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale or Sharing: We do not sell your personal information, and we do not share it for targeted advertising. Capsule shows no ads.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at privacy@capsl.life. We will respond within 45 days.

Do Not Sell or Share My Personal Information

Capsule does not sell your personal information. We do not sell, rent, or trade your data to third parties for monetary or other valuable consideration.

Capsule does no advertising and does not share your personal information for targeted advertising. We also respect the Global Privacy Control (GPC) browser signal: if your browser sends it, we treat it as a valid opt-out request and keep optional product analytics off.

To submit a Do Not Sell or Share request manually, you may contact us at privacy@capsl.life with the subject line "Do Not Sell Request." We will process your request within 15 business days and will not discriminate against you for exercising this right.

Your Rights (GDPR)

Under GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate personal data. To exercise your right to rectification, please contact us at support@capsl.life or update your captures directly in the app.
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Export your data in a machine-readable format
  • Restriction: Limit how we process your data
  • Object: Object to processing based on legitimate interest
  • Withdraw Consent: Withdraw consent at any time for consent-based processing

To exercise these rights, visit your Account Settings (Settings → Account → Delete account) or contact privacy@capsl.life.

U.S. State Privacy Rights

In addition to CCPA rights for California residents, users in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have similar privacy rights under their respective state laws. These rights include the right to access your personal data, the right to correct inaccurate data, the right to request deletion, the right to data portability, and the right to opt out of the sale of your personal data and targeted advertising.

Capsule does not sell personal data or use it for targeted advertising. To exercise any of these rights, contact us at privacy@capsl.life. We will respond within the timeframe required by your state's law (typically 45 days, with an optional 45-day extension where permitted).

Children's Privacy (COPPA)

Capsule is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@capsl.life and we will delete that information promptly.

Birth Year Collection: During signup, we collect the user's birth year solely for age verification as required by COPPA (16 C.F.R. § 312 et seq.) and the other age checks in this policy. Capsule works out your age from your birth year: this year minus the year you were born. Under 13 cannot sign up: if that gives 13 or less, sign-up is refused, because you may not have had your birthday yet. If it shows you are under 18, a parent or guardian must agree before you can use Capsule. In the EEA and the UK, sign-up needs an age of over 16, worked out the same way, so a birth year 16 years ago is refused. Parental consent is checked on that same worked-out age, so someone whose birth year gives 18 is not asked for consent, even if their birthday has not come yet. We do not use birth year for advertising, profiling, or any purpose other than age verification. Birth year is stored in our Supabase database and is protected by row-level security (RLS) policies that prevent access by other users.

Parental Rights: If you are the parent or guardian of a minor who has created an account on Capsule, you have the right to:

  • Review any personal information we have collected about your child
  • Request deletion of your child's account and all associated personal data
  • Refuse further collection or use of your child's personal information

To exercise any of these rights, contact us at privacy@capsl.life with the subject line "COPPA — Parental Request". We will respond within 5 business days. We may need to verify your identity and your relationship to the minor before processing the request.

Age Enforcement (COPPA safe-harbor strategy): Capsule complies with COPPA by refusing to create accounts for users under 13, rather than by implementing a Verifiable Parental Consent (VPC) mechanism. Sign-up refuses a birth year that makes you 13 or younger, on the form and again on our server, and no account is created. If your birth year passes that check but you answer "No, I'm under 13" to the age question, you are sent to a page that ends sign-up, and no account is created. No personal information is collected from users under 13. If you believe a child under 13 has created an account, contact privacy@capsl.life with subject "COPPA — Parental Request" and we will delete the account immediately.

GDPR / EEA and UK Age of Consent: A sign-up from the European Economic Area or the United Kingdom, as the country reported for the request, for someone under 16 is refused, and no account is created. Because only the birth year is collected, anyone born 16 or fewer years ago is refused, since they could still be 15. Sign-ups from those countries for someone aged 17 go through the parental consent step below.

Parental Consent If Your Birth Year Shows You May Be Under 18: Anyone whose age, worked out from their birth year, is 14 to 17 by our calculation (that is, over 13; this year minus birth year) can create an account, but cannot use Capsule's services until a parent or guardian consents. The app asks for a parent's email address and sends that parent a verification link, which expires after 24 hours. Until the link is verified, Capsule's servers refuse the account's requests (PARENTAL_CONSENT_REQUIRED). For questions about EEA data rights, contact our Data Protection Officer at privacy@capsl.life.

If we discover that we have collected personal information from a child under 13 without appropriate parental consent, we will delete that information immediately.

Cookies

Capsule does not track you. We use only essential, first-party cookies for sign-in and account security, and no analytics or advertising cookies. The Capsule iOS app sets no analytics or advertising cookies. Optional product analytics are available on the website only, with your consent, and are stored in your browser rather than in cookies. For details, see our Cookie Policy.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and sending you an email notification if you have an account. Your continued use of Capsule after changes constitutes acceptance of the updated policy.

Data Protection Officer

We have designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with GDPR and other applicable privacy regulations.

DPO Contact: dpo@capsl.life

You may contact our DPO directly for any questions regarding the processing of your personal data, to exercise your data protection rights, or to file a complaint about how we handle your information. We will respond within 30 days of receipt.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed unlawfully.

Contact Us

If you have any questions about this Privacy Policy or want to exercise your privacy rights, please contact us at: