Privacy

Privacy

Short version: what you write when sealing a capsule is never shown to anyone, ever. Only the one line you write afterwards can become public, only if you choose that, and only after a human reads it.

What is collected

• Your account. Email address, a display name if you give one, and a password stored only as a scrypt hash. Nobody, including staff, can read your password.
• Your capsules. Everything you type into them, plus the dates and confidence numbers.
• Sessions. IP address and browser user-agent for each sign-in, so you can spot a session you don't recognise and end it.
• Who follows whom, if you use profiles.
• Some visits — see below. This is the part worth reading carefully.
• Analytics, only if you agree. See Cookies. Nothing loads before you choose.

What is never public

The real reason, the fear, and your own test — the private half of every capsule — are not shown to other members, are not shown to your followers, are not used in any public statistic beyond the anonymous verdict, and are not readable by staff browsing the archive. The only free text that can ever appear publicly is the single line you write after a capsule opens, and only when you have chosen to share it.

Visits: what is recorded, and what deliberately is not

Profiles record who looked at them, the way a professional network does. Members can see the names; free accounts see only a count. That is a real piece of tracking and we would rather state it plainly than bury it.

Browsing the archive is not recorded. Reading a constellation page, opening a star, or wandering the sky leaves no visitor record of any kind, for anybody. This is deliberate and it is not a limitation we intend to remove. People come here while deciding whether to end a marriage or whether to say something before it is too late, and a log of who read what would be both a betrayal and a way of ruining the data — nobody browses honestly while being watched.

A capsule records its readers only if its author has explicitly attributed it to their profile. That setting is off by default, it is chosen per capsule, and nothing sealed before the setting existed was changed. Turn attribution off again and the visitor records for that capsule are deleted.

You can browse privately. One switch in your account makes every visit you make anonymous — counted, never named. In exchange, you stop being shown who viewed you. The trade runs both ways on purpose; being able to watch without being watched is not a setting we are willing to sell.

Visits are recorded once per person per day, not per page load, so the record cannot show how many times somebody came back.

Blocking

Blocking someone severs the follow in both directions, removes your journey from their view, and deletes any record of them having viewed you.

Legal basis and retention

Your account and capsules are processed to provide the service you asked for (contract). Analytics is processed only on consent, which you can withdraw at any time. Data is kept while your account exists. Delete your account and your capsules go with it.

Your rights

You can export everything you have written, correct it, or have it erased permanently. Erasure is real: the row is deleted, not flagged. Ask from your account page or by replying to any email we send you.

Who else sees it

Analytics providers you have consented to (Microsoft Clarity, Google Analytics) and, if you become a paying member, Stripe for payment processing. We never sell anything to anyone.