Return home

This policy is designed to be accessible, understandable, and easy to read without legal and other jargon. If you have any comments, questions, or concerns about this policy, please get in touch with us by emailing hello@capsule.town.

This document will have slight changes made to it occasionally. Please refer back to it from time to time.

**Important: this policy refers specifically to the version of Capsule Town running at capsule.town (and subdomains). We refer to this as "the service" or often simply just "Capsule Town", "us", "we", etc.** Capsule Town is open-source software and can be run by anyone and be called anything. Other "instances" of "Capsule Town" should have their own privacy policy in place that is suitable to that instance.

This policy governs the use and protection of personal data of people (‘users’, ‘you’, etc.) using Capsule Town.

Data protection refers to the responsible security of personal data and transparency in the way we handle and process such data. Personal data is information that - on its own or in conjunction with other data - can be used to identify an individual person. With respect to the UK General Data Protection Regulation (GDPR), Capsule Town acts as data controller for the data you provide through using our services.

Complaints

If you would like to complain about this policy, or how we may have treated a request from you with respect to data protection, then please get in touch with us in the first case so that we can help rectify the problem. In other cases, you may also want to get in touch with the Information Commissioners Office (ICO), who may be able to provide you with more information and support. Their website is at [https://ico.org.uk](https://ico.org.uk).

When does Capsule Town collect data, and what data does it collect?

When visiting our main capsule

When you navigate to our main capsule using a Gemini browser, your visit is logged by the server but we don't collect any data about you or your device.

When sending us an email

Sometimes you may wish to send an email to us or reply to an email we have sent you. Any emails received will be treated in confidence and kept securely. Strong passwords and multi-factor authentication is implemented on all email accounts that can receive such emails.

In these cases, we will process:

- Your email address

- Any other information you include in your email headers or body (e.g. your name)

When registering a new capsule

Capsule Town allows its users to register a new capsule, which is achieved either via the HTTP API directly or by using the Capsule Town CLI tool. At this stage, we ask you for the name of the capsule being created (which forms part of its address when published) and optional contact details, which can be used to help recover your access credentials if you lose them.

In these cases, we will process:

- The name of your capsule

- Any supplied contact details you optionally provide (e.g. an email address or Telegram handle)

When publishing your capsule

Once you've registered a capsule, you may wish to publish your Gemini files to it, such that they can then be viewed by other people browsing your capsule. If you do so, we process the Gemini files you supply as part of the request or CLI command.

In these cases, we may process:

- Any Gemini content present in your capsule files

Who has access to your data?

Staff operating Capsule Town can view capsules and their data.

Other users and visitors to your capsule (including the public) will have access to the Gemini files you uploaded when publishing your capsule.

In order to provide access to our services to users, we also sometimes need to pass pieces of your personal data to third-party services (known as ' data processors' or 'subprocessors' for the purposes of the GDPR). We only ever do this when this is directly related to providing the service to you, and we only send the minimum amount of information required. We ensure that the processors' own privacy policies follow suitable data protection practices. Our current data processors are:

- Backblaze (for backing-up all Capsule Town data)

- All data is encrypted by Capsule Town before being sent to Backblaze.

Capsule Town runs on Linode servers.

How long do we keep your data for?

We keep your capsule data for as long as it is active. You can remove the data at any time by publishing your capsule with empty file contents. To fully delete or rename the capsule itself, please reach out to us by email.

Please note that data held in backup systems may be stored for up to an additional 30 days after content or capsules is deleted.

Where is your data stored?

Our databases and servers are based in the UK, and so your data will primarily be stored and processed within the UK. We use Backblaze's EU servers for our backups.

How do we protect your data?

All data is encrypted during transmission (e.g. between your device and our servers, and between our servers), and when stored ("encrypted at rest"). Our servers are well-protected with industry standard security measures.

Cookies

Capsule Town runs on Gemini and therefore does not use or store cookies on your computer. Using the CLI tool will automatically create a small file in your computer's home directory in order to store the credentials that allow you to publish your capsule.

Child safety

Children under the age of 16 are not allowed to use Capsule Town or to provide us with personal data. As such, we do not knowingly store or process personal data relating to children under the age of 16.

If a user account or content is created and suspected to be originated from a child, it may be removed.

Your rights

We take the handling of personal data very seriously, and we want to make sure that you are aware of your rights under this policy. If your wish to invoke your rights requires us to complete some action on your behalf (for example, to stop processing your data), then we will always deal with your request in total confidence, at no cost, and as soon as we can (within 30 days of receiving your request).

Right to be informed

You have a right to know about how we handle and process your personal data. This Privacy Policy aims to fulfil this Right, but please email us if you have further questions or concerns.

Right of access

You have a right to know if we store or process your personal data and to obtain access to the personal data about you that we, or any data processors that process data on our behalf, have about you. To obtain this information, please email us.

Right to rectification

You have a right to have personal data we keep or process about you rectified. If data we have about you is incorrect or incomplete, then please email us with details of any corrections to be made.

Right to erasure

You have the right to have all of your personal data erased, which will prevent any further storage or processing any of your personal data on our behalf, and will sometimes result in a necessary deletion of any accounts you hold with us. Please email us with details of your request.

Right to restrict processing

You have the right to halt the processing of your personal data in the way that you choose. For example, you may wish to maintain a capsule with us but no longer want us to use one of our data processors to process your data. To restrict the processing of your personal data, please email us with details of your request.

Please note that in some cases it may not be possible to restrict processing whilst still providing services to you.

Right to data portability

You have the right to obtain personal data we have or process about you in a format that is useful to you for the purposes of portability. We can provide data to you in the following formats:

- CSV

- JSON

Please email us with details of your request.

Right to object

You have a right to object to the processing of your personal data in particular ways. For example, for marketing or profiling purposes. If you would like to object to our processing of your data, then please email us.

Rights related to automated decision making including profiling

We do not use personal data for automated decision making, and do not use such data for profiling users. Additionally, any processing done for analytics and reporting is done on an entirely anonymous basis. For more information or if you have any concerns, please email us.

Return home