Security & Privacy
These are your most precious memories. Here's exactly how we protect them — and what backs up every promise we make.
Access-controlled storage
Every capsule is protected by row-level security (RLS) — a database-level access-control layer that enforces, on every query, that only the account that created a capsule can read, edit, or delete it. No other customer can access your capsules, and your data is isolated from every other user on the platform at the database layer.
Encryption in transit and at rest
All data sent between your browser and our servers is encrypted using TLS 1.2 or higher. Your capsule content is stored in a managed database with AES-256 encryption at rest. Media attachments (photos, videos, audio) are stored in private object storage with server-side encryption, and are only made accessible to your recipient when the capsule is delivered.
Automated delivery
On the delivery date you choose, a scheduled system automatically sends your capsule to your recipient by email. Your message is never opened or reviewed by a person as part of the delivery process — it stays sealed until the system triggers delivery on the exact date you set.
Delivery reliability
If you provide a backup contact, they receive a copy of the capsule too, so it still reaches its destination if the primary email has changed. If delivery fails for any reason, the capsule stays scheduled and the system retries on the next hourly cycle. You can update the recipient email any time before the capsule is locked.
How encryption works
Your message and media are encrypted in your browser using AES-256-GCM before they reach our servers, and we store only the encrypted ciphertext. To enable automated delivery on your chosen date, the decryption key is stored alongside your capsule and included in the delivery link sent to your recipient. When your recipient opens the link, their browser decrypts the content locally. Your content is never displayed on our servers as part of normal operations. This protects your content at rest and in transit, though it is not a zero-knowledge system — the key must be available to the server so it can construct the delivery link. If you prefer true zero-knowledge delivery, share the link with your recipient yourself instead of relying on automated email.
Admin access is limited
Our admin team can view capsule metadata — delivery status, recipient email, and delivery date — to help with support requests. Viewing encrypted message or media content requires the decryption key and deliberate action; it is not part of normal operations. Admin actions are limited to resolving delivery issues and keeping the service running.
The shutdown promise
If Time Capsule ever shuts down, our commitment is to deliver every remaining capsule early, before the service closes, and provide a full export of your data. The pay-once model means an individual capsule is funded for its entire hold period, not tied to a subscription that could lapse. As with any online service, we recommend keeping a local copy of anything irreplaceable.
Your account, your control
You can edit or delete any capsule before it's locked for delivery. Once locked, a capsule can't be changed — that's what guarantees your recipient gets exactly what you wrote. You can delete your account at any time, which removes your capsules and personal data.