Privacy Policy

Information you give us

Epostora currently lets you save a draft without creating an account or a password. To do that, we collect your owner email address, sender name, message, chosen opening date, and whether you want the capsule to be private or public. On the Create page, you can optionally provide a backup phone number, choose a preset security question, and provide an answer stored as plain text. These optional details are collected only to support manual ownership verification if you lose access to your owner email address. Providing them does not automatically verify ownership or guarantee recovery of access to your capsule. A title is optional. You can also upload photos and a video. This optional recovery information is never shown publicly or included in emails.

We store capsule and upload details such as identifiers, status, timestamps, file names, file types, sizes, and storage paths. For payment records, we store the quoted amount, payment provider, payment reference, and status. We store a hash of the private owner-access token rather than the token itself in the capsule record. Operational records include email delivery attempts and provider message IDs. The service may process request information, including IP addresses, for rate limiting and security.

How we use it

We use this information to save and manage drafts, send or recover owner access links, store and serve permitted media, apply the visibility choice you make, record manually verified Wise payments, run cleanup, and—if a capsule is eligible to open—process its opening and send an email notification. If you use the contact form, we send your name, reply email, and message to our support inbox to handle your request. Choosing a date for an unpaid draft does not schedule it to open; only a paid and sealed capsule is eligible to open.

Public capsules are not simply published when a draft is saved. Public-archive access depends on a capsule reaching its opening date and meeting the applicable status and review checks. A private choice is not an invitation to share your owner link: anyone with that link may be able to access the capsule as its owner.

Photos, videos, and access

Uploaded photo and video files are stored using Supabase Storage; their associated details are kept in the service database. The application uses access checks before serving media. We do not claim that files are end-to-end encrypted or that a copy cannot remain in a provider backup.

You can remove an attachment from an eligible unpaid draft through the available owner controls. A failed file removal may be retried through the cleanup system; removing a database record alone is not presented as proof that every stored copy has disappeared.

Abandoned unpaid drafts and their media

An unpaid capsule remains pending for seven days, then the hourly cleanup job marks it expired. The capsule and its associated photos and videos are retained for 30 days after expiration; after that, the job attempts to permanently delete the capsule record and its stored media. The job runs periodically, and failures or retries can delay deletion. An expired capsule may still be paid during that 30-day period if its opening date has not passed. This retention rule applies only to expired capsules that have never been paid.

Before deleting an eligible expired capsule record, the cleanup process attempts to remove its associated stored photos and videos. Paid, sealed, opened, and cancelled capsules are not eligible for this cleanup. A file can remain if a storage operation fails, and provider backups or logs may follow separate retention practices.

Other capsule data and retention

The 30-day period above applies only to expired, never-paid capsules. It is not a deletion period for paid, sealed, opened, or cancelled capsules. We cannot promise that all copies, backups, or provider records are removed on a particular date.

Emails and service providers

We send owner-access and recovery links, payment instructions, payment confirmations, and opening notifications by email. A payment administrator also receives an alert when a capsule first enters pending payment. Payments are confirmed manually, usually within 24 hours; provider acceptance is not a guarantee that a message reaches an inbox. We do not currently promise reminder emails.

The current service is hosted on Replit, uses Supabase for its database and uploaded-file storage, and uses Resend to send transactional email (which receives the destination email address and message content needed to send it). The website also loads fonts from Google Fonts. These providers may process information needed to deliver their services.

Your choices and requests

If you have a question about your information, want to request access or correction, or want to ask about deletion, contact contact@epostora.com. We may need to confirm that you control the relevant owner email or access link before acting. A request is not an assurance of immediate or complete deletion, including from backups or third-party records.