Terms & acceptable use
We've kept these short and in plain language. They cover what's not allowed, how we handle reports, and what happens when something goes wrong. Last updated June 2026.
Time Capsule lets you encrypt a message in your browser, lock it with a future date, and have it open automatically when that date arrives. Capsules are encrypted before they reach our servers — we can't read them, even if asked. You can find the full durability commitment on our pledge page.
The encryption that protects honest users protects abusers identically — which is why we draw a hard line in our policy even when we can't see content directly.
Even though we can't see file contents (they're inside the encrypted capsule), we can see filenames in the manifest. Files with executable, archive, or script-carrying extensions are refused at upload time on every tier — .exe .msi .bat .cmd .ps1 .scr .vbs .jar .deb .rpm .apk .iso .zip .rar .7z .html .htm .svg .swf and similar. Photos, audio, video, PDFs, and standard documents go through.
Free-tier capsules are capped at 2 MB; paid tiers go up to 10 MB. Smaller cap on the free tier exists primarily to keep the free tier from being usable as a covert file-distribution channel.
Anyone with a capsule link can submit an abuse report from the opened-capsule page (or by emailing the address at the bottom of this page). Reports queue for human review. The capsule remains encrypted to us throughout — we evaluate based on the reporter's context, not by opening the message.
If a report is credible we may:
Important nuance: a quarantined or deleted capsule cannot be "un-decrypted" by us — the cryptographic property still holds. What we hand to law enforcement is the ciphertext + metadata, not plaintext. The lawful authority follows their own process from there.
When a capsule is opened for the first time, we send the creator a single email with the opener's country and city (via Cloudflare's edge metadata) and timestamp. We do not log the opener's raw IP for normal opens. We log IPs only at capsule creation (for abuse response and rate limiting) and on submitted abuse reports (same reason).
You authenticate by magic link. We don't hold passwords. You can request a full export of your capsules at any time from your dashboard — including the encrypted blobs and the drand round numbers needed to decrypt them independently of us. You can delete any individual capsule from the dashboard; deletion is immediate and irreversible.
If you stop paying for a subscription, capsules created during the paid period stay permanent (you bought permanence, you keep permanence). Future new capsules from the same email default to free-tier retention.
It won't — at least not without warning. Our pledge commits to a 12-month notice period plus automatic exports plus open-source decryption tooling. The capsule should outlive the company. If you ever read a notice that Time Capsule is winding down, your data is already on its way to you.
We may update these terms when policy or law requires it. We'll keep the last-updated date current and post material changes in the project changelog. Continued use of the service after a change means you accept the updated terms.