Privacy Policy

The data controller is Adrien Pennetier, sole trader (“PENRA”), whose details appear in the legal notice. For any question about your data: contact@capsul.chat.

No data protection officer has been appointed: the controller is not a public body, its core activities do not consist of regular and systematic large-scale monitoring of individuals, and it does not process sensitive data or data relating to convictions on a large scale (article 37(1) GDPR). Requests that would be addressed to an officer should therefore go to the address above.

capsul saves tokens on every prompt. Your code is never stored. Your prompts and the contents of your files go from your machine, through your own subscription (Claude, Codex): they do not pass through capsul. What capsul writes stays on your disk, and is described below under “What capsul writes on your machine”.

What our server records on each prompt is limited to incrementing a counter on your account, for as long as you are on the free tier: no log, no timestamp, no terminal identifier, no content. Once subscribed, nothing is recorded at all: there is no longer anything to count.

Depending on your use, we process the following categories:

We process no sensitive data (article 9 GDPR) and use no profiling or automated decision-making producing legal effects or similarly significantly affecting you within the meaning of article 22 GDPR.

Providing an email address is necessary to create and manage the account: without it, the account cannot be created and the service cannot be provided. The username is derived from that address, and you may have it changed on request.

Creating an account is reserved for people aged at least fifteen (15), the threshold set by France under article 8 GDPR.

• Account, email address and username. Purpose: create and manage your account. Legal basis: performance of the contract. Any real name and profile picture sent by Google or GitHub are not kept: they are erased on registration, because nothing in the service uses them.
• Authentication, either a password (hashed, never kept in clear text) or sign-in via Google or GitHub. In the latter case only the account identifier at the provider is kept, because that alone establishes the link: access and refresh tokens are not kept. Purpose: secure access. Legal basis: performance of the contract.
• Linked terminals, the name of your machine, so that you recognise the terminal to revoke. The operating system and tool version are shown only on the approval screen and disappear with the pairing request (10 minutes). Purpose: let you identify and revoke your terminals. Legal basis: performance of the contract.
• Usage / quota, a counter of prompts used on the free tier, attached to your account. No log, no timestamp, no terminal identifier. Purpose: apply the free tier. Legal basis: performance of the contract.
• Billing, for paid plans, your email and an account identifier are sent to our payment provider (Polar). We never see your card details. Legal basis: performance of the contract, legal obligation.
• Security, on the endpoints exposed to scanning (sign-in, account creation, terminal pairing: opening, cancelling, exchanging the code, and opening a payment session), an anti-abuse counter is keyed on an irreversible fingerprint of your IP address, never on the address itself. It is neither readable nor reusable, and the counter expires in 10 minutes to 1 hour. It serves only to count attempts from one origin; it is never attached to a prompt, whose counting happens under your account identifier and without any address. Legal basis: legitimate interest in protecting the service against abuse (article 6(1)(f) GDPR).

The command-line tool keeps its state in a folder in your user profile, ~/.config/capsul. The folder is created with permission 0700, and the configuration files and the ledger described below are written 0600, readable by your account alone. Only the drafts the agent leaves in workspaces/ are an exception: they take your session's default permissions (umask), often 0644; it is the folder that keeps them away from other accounts, not the file. These files stay on your disk and are sent neither to the Publisher nor to any third party.

capsul provides no command to erase these files: they are yours, and you delete them yourself, in whole or in part, like any other file on your disk.

• ledger.jsonl (permission 0600), one line per turn: timestamp, the first characters of your request (120 at most) (recognised Anthropic API keys are masked before truncation), the absolute path of the project, token counts, the cost reported by the model, and the agent and model used. This is the file the “stats” command adds up.
• config.json (permission 0600), your API keys, OAuth tokens and account session, only when the operating system keychain is unavailable; otherwise those secrets go to the keychain and this file does not contain them.
• mcp.json (permission 0600), the configuration of your MCP servers, including the environment variables they carry, and the paths of your local plugins.
• workspaces/ (folder with permission 0700), the drafts produced by the agent, in one subfolder per project, named after that project's absolute path.
• claude-usage.json (permission 0600), a cache of consumption totals read from Claude Code's local transcripts (~/.claude/projects), so they are not re-read at every start.

The site sets only its own cookies, necessary either to operate or to remember a preference you express, plus a single local-storage marker. No analytics, advertising or tracking cookie, hence no consent banner. Site traffic is measured by Vercel Web Analytics, which sets no cookie and reads nothing on your device: it counts page views without identifying you or following you from site to site.

• capsul_theme, capsul_locale: chosen theme and language (12 months).
• capsul_cli_code, secures the pairing of a terminal (10 minutes).
• authjs.session-token (prefixed “__Secure-” in production), your sign-in session, seven (7) days.
• authjs.csrf-token and authjs.callback-url, CSRF protection and the return page after sign-in; erased when the browser closes. In production the first is prefixed “__Host-”, the second “__Secure-”.
• authjs.pkce.code_verifier, the PKCE verifier protecting the OAuth step, for the duration of a Google or GitHub sign-in (15 minutes). Prefixed “__Secure-” in production.
• capsul:intro, not a cookie but a local-storage marker, which remembers that the intro animation has already played so it is not replayed. It contains no identifier, is never sent to the server, and disappears when you clear the site's data.

Your data is neither sold nor rented. The third parties that receive it fall into two categories, whose responsibilities differ.

Processors, acting on our behalf and on our instructions alone:

Separate controllers, with whom you are in direct contact and who answer for their own processing, described in their own policies:

Transfers outside the European Union. Several of these recipients are established in the United States (Vercel, Polar, Google, GitHub, Resend, Anthropic, OpenAI), and database hosting may, depending on the region chosen for the Supabase project, be located outside the European Union. Whenever a transfer outside the Union takes place on our behalf, it is covered by appropriate safeguards within the meaning of chapter V GDPR, in particular the European Commission's standard contractual clauses. You can obtain a copy by writing to contact@capsul.chat.

• Supabase, database hosting (identity, usage).
• Vercel, site hosting and cookieless audience measurement; the IP address may appear in its technical logs.
• Resend, sending transactional emails (address confirmation, account notices).
• Polar (Polar Software Inc.), payment and invoicing for paid plans.
• Google / GitHub, sign-in, if you choose that method.
• Anthropic (Claude), OpenAI (Codex) and any other model provider you configure, through the command-line tool, under your own subscription. Your prompts and the corresponding file excerpts go from your machine to the provider you have chosen and with whom you have authenticated: capsul does not relay this data, the Publisher is not a recipient of it and has no access to it.

These periods are enforced by a daily automatic purge run by the database itself, not by a manual step.

• Account, for as long as it is active, then deleted on request.
• Confirmation links, 24 hours; pending sign-ups, 24 hours.
• Terminal tokens, until revoked from the Terminals page (they do not expire on their own).
• Terminal pairing requests, valid for 10 minutes, automatically purged within 24 hours.
• Billing, kept for as long as accounting and tax obligations require. The invoices themselves are held by Polar; we keep only a subscription identifier and the current period end.
• Anti-abuse, your IP address is never recorded as such: it is turned into an irreversible fingerprint, which serves as the counter's key and is purged automatically one hour after the window ends.
• Revoked terminals and tokens, 90 days after revocation, then deleted automatically.

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death (article 85 of French Act no. 78-17 of 6 January 1978). You can exercise them at contact@capsul.chat; we reply within one month. Signing out of all your devices and revoking a terminal are available directly from your account.

You may lodge a complaint with the CNIL (cnil.fr).

Exchanges are encrypted (HTTPS) and the database is encrypted at rest. Data access is isolated server-side (no access from the browser), passwords are hashed (bcrypt), and the tokens we issue, terminal token, confirmation link, pending sign-up, are stored only as fingerprints. Secrets are never exposed to the client.

One value is an exception, and by choice: the pairing code shown by the terminal, of low entropy by construction since it is read and retyped, is protected by its ten-minute validity, not by a fingerprint.

This policy may change along with the service. Any substantial change will be flagged on this page; the last-updated date is authoritative.

Last updated: 30 August 2026.