Trust
Security and Trust
Capsule Insights is an alpha product being prepared for beta. This page explains the current security posture and planned safeguards in conservative, practical terms.
Privacy-First Positioning
Capsule is designed to help users turn personal content into summaries, insights, topics, actions, and memory without selling user-submitted content.
No selling of user content is planned. Final production language should be reviewed before public launch.
User Controls
Users can manage preferences, billing placeholders, digest settings, local/demo data, and privacy request placeholders from Settings.
Data access, export, correction, deletion, and account deletion controls are request placeholders until verified backend workflows are implemented.
Account Security Basics
Authentication is Supabase-ready where configured. In local alpha/demo mode, the app may use mock sessions so the product remains testable without production auth.
Production account security should rely on provider-supported authentication, secure session handling, protected routes, and reviewed database row-level security policies.
Third-Party Processors
Where configured, Capsule may use OpenAI for AI processing, Supabase for auth/database, Resend for email delivery, Stripe for billing, and Vercel for hosting/deployment.
Each provider may process data according to its own terms, security controls, subprocessors, and retention periods. Production processor documentation should be reviewed before launch.
Encryption
Data should be encrypted in transit using HTTPS/TLS in production deployments.
Database, storage, backup, and email encryption depend on the configured providers and their supported controls. Capsule should document provider-supported encryption before public launch.
AI Processing Disclosure
When AI is configured, user-submitted content and related context may be sent to AI providers to generate summaries, insights, actions, briefs, and personalised interpretation.
If AI credentials are missing, Capsule can run in mock mode so the alpha remains usable without sending content to an AI provider.
Data Export and Deletion
Users can request data export or deletion through Settings placeholders or by contacting privacy@yourdomain.com.
A production deletion/export workflow should define verification, response timing, provider follow-up, backup retention, logs, and legal exceptions before launch.
Security Contact
For security reports, contact security@yourdomain.com. Replace this placeholder with the production security contact before public launch.
A responsible disclosure and incident response process should be documented before beta or public release.