Privacy Policy

Last updated: 2025

1. Introduction

Reen Tech LLC (“Company”, “we”, “us”, “our”) operates the Time-Capsule.io service (the “Service”). We are committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, store, and share your personal data when you use our Service. It applies to all users globally, with specific provisions for users in the European Economic Area (EEA), United Kingdom (UK), and United States (California).

2. Controller and Contact

Data Controller: Reen Tech LLC (located in California, USA).

For any privacy-related inquiries, please contact our Data Protection Officer (DPO) at: Email: legal@time-capsule.io

3. Data We Collect

We collect the minimal data necessary to provide the Service.

3.1. Information You Provide

Account Data: When you sign up via a social provider (e.g., Google), we collect your email address, display name, and avatar. We do not store passwords.
User Content: The photos, videos, texts, and documents you upload to your Capsules.
Capsule Metadata: Unlock dates, expiration dates, recipient email addresses, and optional passphrases (hashed).
Payment Data: Transaction history and billing details (handled securely by Stripe; we do not store full credit card numbers).

3.2. Automated Information

Usage Data: IP address, browser type, device information, operating system, and interaction logs.
Analytics: Anonymous usage statistics via Plausible Analytics (cookie-less, privacy-first).
Safety & Moderation Data: The outcome of our automated safety checks, the reasons returned by them, and short excerpts, machine-generated descriptions, or machine-generated transcripts of the content analysed. We keep this as an audit record of the decision so that it can be reviewed if you contest it.

3.3. Guest and Event Information

When you contribute a Capsule to an Event as a Guest:

Guest Identity: The name or signature you enter ("From"), which is stored as part of the Capsule title, and any optional email address you provide to receive a copy upon unlock ("CC me").
Guest Media & Message: The text, photos, video, audio recordings, or documents you submit.
Audit & Legal Acceptance: Your IP address, browser User-Agent, and the timestamp of your agreement to our terms, recorded as an immutable audit record (legalAcceptanceMeta).

4. Legal Basis for Processing (GDPR/UK GDPR)

If you are in the EEA or UK, we process your data based on the following legal grounds:

Purpose	Legal Basis
Providing the Service (account management, capsule delivery)	Performance of Contract (Art. 6(1)(b))
Event Guest Capsule storage and delivery	Legitimate Interest (Art. 6(1)(f)) and Consent (Art. 6(1)(a))
Payment Processing	Performance of Contract (Art. 6(1)(b))
Security, Fraud Prevention, & Platform Maintenance	Legitimate Interest (Art. 6(1)(f))
Automated trust & safety screening of Capsule content	Legitimate Interest (Art. 6(1)(f))
Analytics (Plausible)	Legitimate Interest (Art. 6(1)(f))
Compliance with Law (e.g., CSAM reporting)	Legal Obligation (Art. 6(1)(c))

5. How We Use Your Data

We strictly use your data to:

Operate the Service: Create, store, and deliver your time capsules.
Process Payments: Facilitate transactions via Stripe.
Ensure Safety: Operate automated trust and safety systems to protect our platform and our users. When you create a capsule, automated technologies — including artificial intelligence — analyse its text, text extracted from attached documents, images, sampled frames from videos, and machine-generated transcripts of attached audio recordings, together with other relevant platform activity, in order to identify content, activity, or behaviour that may present safety, abuse, security, legal, or policy concerns. Where a concern is identified, we may take enforcement action under our Terms of Service (which can include restricting an account or preventing a capsule from being delivered), and in certain serious safety situations we may send you an informational safety notice. These systems can make mistakes and are not guaranteed to identify every violation or safety concern.
Communicate: Send transactional emails (receipts, delivery notifications).
Comply with Law: Fulfill legal obligations and respond to valid law enforcement requests.

We do NOT sell your personal data.

6. Data Retention

Account Data: Retained as long as your account is active. You may delete your account at any time.
Capsule Content: Retained until the capsule’s expiration date (as defined by you or the Service limits), after which it is permanently deleted.
Event Guest Capsules: Stored encrypted until the capsule's scheduled unlock date, and retained for the duration agreed for the Event (based on the Event's retention period), after which they are permanently deleted. Deleting an Event Owner’s or Guest’s Account does not delete Event Guest Capsules or cancel their scheduled delivery. We preserve the Event records, Guest Capsules, attached files and recipient contacts needed for delivery. Guest Capsules and their files keep their agreed expiration dates. Account deletion preserves each capsule’s existing recipient contacts rather than replacing them with the event’s current recipient list; the copy linked to the deleted Guest Account is cancelled. Neither the Event Owner nor the Guest can cancel a submitted Guest Capsule through the Service, including an anonymous submission. Moderation and applicable legal obligations still apply.
Logs: Retained for a limited period (typically 90 days) for security auditing.
Deleted Data: Account deletion removes personal capsules and other account data from our live systems immediately, except for the Event data described above and other applicable retention exceptions. Deleted data may persist in secure backups for up to 30 days for disaster recovery.

7. Data Sharing & Third Parties

We share data only with trusted service providers bound by strict confidentiality data processing agreements (DPAs):

Stripe: Payment processing.
Cloudflare: Content delivery Network (CDN), DDoS protection, object storage (R2), and the AI models used for our automated content-safety checks.
Plausible: Anonymous analytics.
Law Enforcement: We may disclose data if compelled by a subpoena, court order, or search warrant, or to prevent imminent physical harm.

8. International Data Transfers

The Service is operated from the United States. If you are accessing the Service from outside the US, your information will be transferred to, stored, and processed in the US.

By using the Service, you consent to this transfer. For EEA/UK users, we rely on Standard Contractual Clauses (SCCs) or the Data Privacy Framework (DPF) (where applicable) to ensure an adequate level of protection for your data.

9. Your Rights

9.1. General Rights (GDPR/Global)

You have the right to:

Access your personal data.
Correct inaccurate data.
Delete your data (“Right to be Forgotten”).
Export your data (Data Portability).
Object to processing based on legitimate interest.

To exercise these rights, email legal@time-capsule.io.

9.2. US State Privacy Rights (California - CCPA/CPRA)

Residents of California have specific rights:

Right to Know: You may request details about the categories of personal information we collect and share.
Right to Delete: You may request the deletion of your personal information.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
”Do Not Sell My Personal Information”: We do not sell your personal information.

10. Security

We employ industry-standard security measures, including:

Encryption in Transit: TLS 1.2+ for all data.
Encryption at Rest: Capsule details on Cloudflare D1 and files on Cloudflare R2 are encrypted at rest by the storage platform.
Access Controls: Strict limitation of employee access to user data.

Capsules are not end-to-end encrypted. Encryption at rest protects stored data against someone walking off with the underlying disks; it does not place capsule contents beyond our reach. The application have to be able to read a capsule in order to deliver it on its opening date, and automated safety checks analyse its contents when it is created.

However, no method of transmission is 100% secure. You acknowledge that you use the Service at your own risk.

11. Children’s Privacy

Our Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13.

Where local law sets a higher minimum age of digital consent, that higher age applies instead. In the EEA and the UK this age is set nationally and ranges from 13 to 16 — it is 15 in France, for example. We rely on the age you confirm when you create an account.

If we become aware that we hold personal data belonging to a child below the age applicable to them, we will delete it immediately. Parents and guardians may contact us at legal@time-capsule.io to request removal.

12. Changes to Policy

We may update this Privacy Policy. Significant changes will be communicated via email or a prominent notice on the Service. Your continued use of the Service constitutes acceptance of the changes.

13. Contact Us

Email: legal@time-capsule.io