Sealtrove

Sealed guest letters

How it works

How a sealed letter capsule works

A host starts one capsule for an event. Guests write letters on their phones, each sealed on the server as it is sent, and the capsule opens on the date the host chose. The rules below are the ones the server enforces, in the order you meet them.

Last updated 28 October 2026

The rules, in the order you meet them

  1. Starting a capsule. You give it a name of up to 60 characters, the kind of event and the event date, and choose when it opens. The name cannot hold an email address, a web address or 7 digits in a row, so a capsule never carries anyone's contact details, and a baby shower capsule never needs the baby's name.
  2. Signing in. You make an account with a passkey: your phone or computer keeps a key behind your fingerprint, face or screen lock, and the server keeps only the public half. There is no password and no username. You also get a recovery code, shown once. Up to 10 passkeys, so a partner can add one on their own phone.
  3. The dates. Every date belongs to the capsule's time zone. Guests can write until 23:59 on the last day for letters: 7 days after the event unless you change it, and at most 90. The capsule opens at 09:00 on the open date, at least a day after the last day for letters and at most 10 years after the event (21 for a baby shower, so a child can open it at 18). An anniversary of 29 February falls on 28 February in a year without one. The server's clock decides, never a phone's.
  4. Changing the dates. Before the first letter arrives, the open date can move either way and the time zone can change. After it, the open date can only move later, because guests were told a date, and the time zone stays. Once letters have stopped, the last day for letters is fixed, so a capsule never takes letters again. Once the capsule opens, every date is fixed. Every date change is shown to guests on their page, with the day it was made.
  5. Guests writing. A guest scans the QR code or opens the link, writes who the letter is from (up to 40 characters, no email address, web address or phone number) and a letter of up to 3,000 characters, in any language. You can add a question of up to 140 characters for them. What they type stays on their phone until the server confirms the letter, so a lost signal loses nothing, and pressing Send twice still makes one letter.
  6. The seal. Sealed means the server will not show a letter to anyone, the host included, before the date. Before the open date, every page and every download, the account export included, shows only how many letters there are. A guest cannot read or change a letter after sending it, their own included.
  7. How many letters. Each capsule holds 50 letters, and you can have 2 capsules waiting to open at one time. When two guests send the last place at the same moment, one is sealed and the other is told the capsule is full. A capsule takes at most 300 letters an hour, which a whole wedding on one venue Wi-Fi stays under.
  8. Replacing the link. If the guest link reaches someone it should not, replace it. The old QR code and link stop at once and tell anyone who opens them to ask you for the new one. The new link tells guests the day it was replaced; letters already sent stay sealed, and replacing the link never lets anyone read them early.
  9. The open date. At 09:00 the capsule becomes a keepsake page: one letter to a card, in the order they were sealed. You can hide a letter, print the page, and download the letters. If you added and confirmed an email address, you get one email that day with a link to sign in; the letters are never in the email. Either way, your dashboard shows Open now.
  10. Printing. The A5 QR sign and the calendar file are free. Table cards (4 to a sheet) and the envelope pack (one letter a page, folded into a DL envelope) are on for every capsule. Every PDF is made on your device; the letters are drawn in their own script, and emoji are drawn by your browser, so no letter prints as empty boxes.
  11. Deleting. A deleted capsule stops taking letters at once and can be restored for 7 days; after that it and its letters are deleted for good. Deleting your account does the same for everything, after you type DELETE.
  12. When the server is busy. The site runs on a hosting allowance with daily limits. When one is reached the page says "Saving is paused for now" and what you typed stays on your device to send later.

Worked example

A couple marries on 12 June 2027 in London and starts a capsule that opens on their 1st anniversary. Guests can write until 23:59 on 19 June 2027, London time, which is 22:59:59 UTC because of summer time. A table card QR at the reception collects 46 letters that evening; the couple's dashboard shows "46 letters sealed" and nothing more. A week later an aunt abroad writes from the link in a message. On 12 June 2028 at 09:00 London time (08:00 UTC) the capsule opens on both their phones, because the second passkey is on the other phone. They hide one letter, print the page, and download the letters to keep.

We plan to keep your capsule until it opens. No website can promise 18 years, so a long seal carries that risk. After it opens, download the letters and keep your own copy.

What it is not