You choose
what continues.

No. Capsulene is for continuity — storing context, instructions, or access shards that point to where your real assets live. You can also encrypt whole files with a key capsule, but they stay on your device — we never receive them.

Yes. A key capsule can encrypt files — documents, a keystore, photos, a video message — with the same 2-of-3 shares that protect your secret. It happens entirely in your browser, and the encrypted files never reach us, not even as ciphertext: you store them wherever you like, and only your shares can open them. Because they stay on your device, the 32 KiB limit on capsule text doesn't apply. Seal files while you create the capsule, or add more later from the Utilities page; your recipient decrypts them on the delivery page with no account needed.

Yes. From the Utilities page you can download a self-contained offline decryptor: a single HTML file that opens your encrypted files and shares with no internet and no Capsulene. Its format is published and it's built from the same code as the app. Keep it beside your encrypted files and shares, and everything can be recovered even if we're long gone.

We enter a grace period, notify your backup contacts, and attempt to reach you repeatedly before releasing anything.

Yes, you can pause or delete a Capsule at any time as long as it has not been released.

Anyone. Family, friends, lawyers, or co-founders. You just need their email and ideally a phone number.

No. Capsulene provides digital continuity, not legal estate planning. Use it alongside your will or trust.

Sign-in uses one-time email codes, Google, or a passkey — there is no reusable Capsulene password to leak. A passkey lets you sign in with your device’s fingerprint, face, or PIN: phishing-resistant, and always an addition (email codes and Google keep working; add up to five under Account → Security). On top of any of these you can enable two-factor authentication with any authenticator app (Google Authenticator, Authy, 1Password, …): choose a code at every login or once a day, and keep eight single-use recovery codes as the lost-phone escape hatch — a passkey never skips the second factor.

Add a backup email under Account → Security — it is the only way back into your account, because support can never restore access, no matter who asks. Recovery through the backup address is deliberately slow and loud: without two-factor authentication it opens a 48-hour waiting window and alerts your usual address, which can cancel the attempt with one click; with two-factor on, your authenticator code still applies, so sign-in through the backup works right away. Set it up before you need it — and answer the occasional “is this still your address?” check so it stays active.

You can permanently delete your account from Account → Security. It's confirmed with a code we e-mail you (plus your two-factor code if enabled), then enters a short grace period — a few days during which nothing is erased yet. Change your mind? Just sign in again before it ends and your account is kept, exactly as it was. If the window passes, we permanently delete your account and all your capsules — including already-delivered ones, so unopened recipient links stop working — and cancel your subscription; support can't restore any of it. Deletion completes across our backups within about 35 days, and Stripe keeps your past invoices and tax records as required by law. This is separate from cancelling a subscription, which leaves your account intact.

Capsulene is free to start. Paid packages are recurring subscriptions — monthly or yearly — that raise how many text and key capsules you can keep active at the same time, and set which optional features (custom check-in timing, SMS, login-required check-ins) your capsules can use. A one-time payment can also cover a single capsule. Payments are processed by Stripe, which acts as the merchant of record and adds any applicable tax at checkout; we never see or store your card details.

Yes. From your account you can cancel anytime, update your payment method, and view or download your invoices through Stripe's secure billing portal. If you cancel, your package stays active until the end of the period you've already paid for.

A failed payment never silently disarms a capsule. If a renewal fails — which can simply mean your card expired, or that something has happened to you — we don't just stop the timer: we start a check-in and ask you to confirm you're around, with your usual grace period and reminders. Confirm and the capsule unschedules (renew your package to re-arm it); don't respond and it's delivered exactly as intended. You control this per capsule in its advanced settings — separately for a failed payment and for a cancellation — with an option that only accepts a signed-in confirmation for the most sensitive capsules. Capsules on the free tier are unaffected either way.