Privacy: what is stored, where and for how long
Exactly what Sealtrove stores on its server, where it is kept, for how long, what never leaves your device, and how to delete all of it.
Last updated 28 October 2026
Where it is kept
Sealtrove stores capsule details and letters on Cloudflare D1: one database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.
What is stored for an owner
- A random account id, the account name you chose for your passkey manager (or Sealtrove owner), and when the account was made.
- For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
- A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
- For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use, counted a day at a time).
- Your email address, only if you add one, with when you confirmed it, and for 24 hours a scrambled form of the confirmation link. It is used only to say a capsule has opened. It is the one place an email address is ever stored.
- Each capsule: its name, the kind of event, the event date, the last day for letters, the open date, the time zone, the question for guests, the number of letters, whether it was upgraded, whether the opening email went, and when it was made and changed. If you move the open date or the last day for letters, or replace the guest link, the day you did it and the date it replaced are kept, and guests see them on their page.
- For each capsule's guest link: a scrambled form (SHA-256) of its secret, plus a sealed copy that only this server can open with its own secret key, so you can see the QR code again. A replaced link keeps only its scrambled form, so it can say it was replaced.
- A record of each email sent, kept 30 days, to keep within a daily number.
What is stored for a guest
- Each letter: who it is from as the guest typed it, the letter, and when it was sealed. No account, no email address, no phone number.
- A random key the guest's browser makes for each letter, so pressing Send twice stores one letter.
- Nothing that ties a letter to a device or a network address.
Limits on how fast requests come
To stop a capsule being flooded, the server counts letters per capsule and per network address in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.
How long it is kept
- Your account, capsules and letters: until you delete them. A letter you hide on the keepsake page stays until you delete the capsule.
- A deleted capsule and its letters: 7 days, while it can be restored, then deleted for good.
- A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
- Sessions: until 90 days after the last visit on that device, or until you sign out.
- Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days.
What stays on your device
A letter or a capsule form you are typing is kept in your browser's local storage under keys beginning with guestletters until the server confirms it, so a dropped connection loses nothing. The secret part of a guest link sits after the # sign, which browsers do not send to any server in the address. PDFs and calendar files are made on your device.
How to export and delete it
On the Settings page, Download everything gives one file with your account and capsules. Letters are in it only for capsules that have opened; before that the file lists each capsule's dates and how many letters it holds, never their words. On the keepsake page you can download one capsule's letters. Delete my account removes everything after the 7 days above, once you type DELETE; a single capsule can be deleted from its own page. Requests by email go to [email protected].
Cookies
One cookie, and only for owners who sign in: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. Guests get no cookie.
Page counts
Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.
Payments
No paid plan is offered at present; if one is added, this page will describe it.
Only owners can receive email, only at an address they added and confirmed, and only to say a capsule has opened, plus the one confirmation email. Guests are never emailed. Emails carry no tracking images and never contain a letter.
Typeface
Headings are set in Instrument Serif by the Instrument Serif Project Authors, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt. PDFs embed parts of Noto Sans, Noto Sans Arabic and Noto Sans Hebrew, under the same licence.
Changes and contact
If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].