Shared memory capsule
Paid Preservation Policy
Last updated: August 1, 2026
A sender uses Memory Months once when sealing an eligible Shared Capsoul for the wait until its scheduled opening date. Recipients do not pay to receive or open it. Personal Capsouls use a separate monthly allowance and remain encrypted on the sender’s device.
1. Memory Months
Memory Months are server-owned credits. Capsoul offers Consumable In-App Purchase bundles of 10, 20, or 100 Memory Months, and optional auto-renewable Memory Membership. A verified transaction adds only the fixed quantity associated with the exact App Store product. Unused purchased or granted Memory Months do not expire.
Memory Months do not represent stored cash value and cannot be withdrawn, transferred, or exchanged for money. Consumable bundles do not renew and are not restorable after they have been durably credited, although Capsoul retries unfinished StoreKit transactions. Membership billing, renewal, cancellation, and refund decisions are managed by Apple. The App Store-localized price shown before purchase is the applicable price; this policy does not promise a fixed storefront price.
Only the sender pays. The same Memory Month requirement applies regardless of recipient count: sealing one Shared Capsoul for one recipient or for five recipients uses the same time-based amount.
2. How a quote is calculated
Capsoul uses trusted server time and UTC calendar-month arithmetic from the sealing time to the scheduled opening time. Calendar end-of-month clamping applies, and any partial final calendar month rounds up to one Memory Month. Every positive waiting period uses at least one Memory Month.
A wait of up to one calendar month uses one Memory Month; three months and 17 days uses four Memory Months; exactly twelve calendar months uses 12 Memory Months. There is no separate year unit and no mixed month/year balance or quote.
The server returns the final requirement before sealing. The app shows the required Memory Months and current available balance, and paid sealing proceeds only after the sender confirms and has sufficient credits.
3. Memory Membership
Monthly Memory Membership grants 10 Memory Months after each successful verified monthly payment and sets the Personal allowance to 10 capsules for each UTC month while the verified entitlement is active.
Annual Memory Membership is paid up front for one year. It grants 15 Memory Months immediately and at 11 monthly anniversaries, for 180 Memory Months during the paid year, and sets the Personal allowance to 15 capsules for each UTC month while the verified entitlement is active. Monthly grant timing is server-owned; a delayed worker run does not create an extra grant.
Cancellation stops a later renewal but does not remove Memory Months already granted. It also does not cancel scheduled monthly grants owed during an already-paid annual period. Membership does not make Shared sealing unlimited and does not purchase permanent cloud storage.
Memory Membership is bound to the first Capsoul account verified with that Apple subscription and cannot be transferred to another Capsoul account. Deleting that Capsoul account permanently removes its remaining credits and stops future releases, but does not cancel the Apple subscription. Manage or cancel the subscription through Apple before deleting the account if needed.
4. Personal allowance and local storage
Free accounts may create up to three Personal Capsouls per UTC month. An active monthly membership permits 10 and an active annual membership permits 15. The allowance resets at the start of each UTC month, does not roll over, is account-specific, and has no cash or Memory Month value. Deleting a Personal Capsoul does not restore a used allowance.
A Personal Capsoul must be scheduled to open within 30 days and may contain at most 50,000,000 bytes (decimal 50 MB) of attachments after Capsoul’s on-device optimization. Device-wide storage and available-space safety limits may block creation even when an allowance remains.
Personal content and media are encrypted on the device with AES-256-GCM and stored in a local .capsoul package that is excluded from cloud backup. CloudBase stores quota, reservation, integrity, and wrapped-key metadata needed to enforce the allowance and release the key; it does not store the Personal payload or Personal media. Capsoul provides no cloud library, discovery, synchronization, or backup for Personal content.
Export and import keep the package encrypted. The package still belongs to the same account and requires the corresponding account-authorized key. Losing or replacing the device, deleting app data, deleting the encrypted package, losing access to the account, or losing required key material may permanently make the Personal Capsoul unavailable. Signing out removes account key material from the device; the app may retain the opaque encrypted package unless the user chooses to remove it. Successful account deletion permanently removes local Personal packages and key material after server deletion succeeds.
5. Shared-capsule limits
A paid Shared Capsoul may include up to 500 MB of actual media and up to five recipients. Recipient-count independence applies within that limit. Personal Capsouls are not charged under this Shared paid-preservation model.
6. Upload reservation
Before media upload, Capsoul may set aside the quoted credits in a 24-hour upload reservation. If the upload fails, is abandoned, or remains incomplete when the reservation expires, Capsoul releases the reserved Memory Months and schedules incomplete uploaded objects for cleanup. An expired uncommitted reservation is not a sender withdrawal.
Once a Capsoul is successfully sealed, its Memory Months are committed and are not released merely because the sender later withdraws it.
7. Opening, claim window, and local recovery
At the scheduled time, recipients may be notified that the Capsoul can be opened. Each intended recipient has an independent 90-day claim window beginning at the scheduled opening time. Paid cloud media may be deleted earlier after all intended recipients and the sender have confirmed durable local copies; otherwise eligible paid media may be deleted when the claim deadline expires.
A completed claim produces a verified local .capsoul document. After cloud cleanup, that local document or a user-managed backup becomes the recovery copy. Deleting the app or its data, losing or replacing a device, or losing the backup may permanently lose the memory, and Capsoul cannot remotely restore a cloud copy after eligible cleanup. Push notifications and their delivery times are not guaranteed.
8. Withdrawal
The sender may withdraw an eligible Shared Capsoul before a recipient completes the durable local-claim boundary, subject to any active download lease. Withdrawal blocks future claims and may schedule cloud media for deletion. Withdrawal does not return used Memory Months, including when it occurs shortly after sealing.
A local copy already delivered to another person’s device cannot be remotely revoked or deleted.
9. App Store refunds and adjustments
Apple decides App Store refund requests. When Apple reports a verified full refund, Capsoul removes the Memory Months granted by that transaction or subscription period and stops future releases from a refunded annual period. If the available balance is insufficient, the shortfall becomes a Memory Month adjustment debt. Later purchases, grants, refund reversals, and eligible reservation releases settle that adjustment before increasing the available balance. A partial or prorated subscription refund is paused for support review rather than rounded into an automatic adjustment.
A refund does not take Memory Months from an active reservation, withdraw a committed Shared Capsoul, delete a delivered local document, or rewrite the append-only ledger. A refund reversal settles any related adjustment first and restores any remainder to availability. A membership refund may also change future Personal allowance eligibility, but it does not remotely delete an already-created encrypted Personal package.
10. Existing users and grants
Capsouls created under the legacy policy remain permanently free; migration does not make existing users pay to keep or open those Capsouls. This treatment attaches to eligible legacy Capsouls and is not a temporary subscription benefit.
Eligible Day 1 users receive a one-time server-owned grant of exactly 180 Memory Months. The owner reviews eligibility before the grant stage is run, and an account cannot receive both the superseded full grant and the replacement full grant. An administrative grant is a separate adjustment made by authorized Capsoul operations. This release does not configure an Apple Offer Code. Neither membership nor an administrative grant changes the treatment of legacy-free Capsouls.
11. Payment methods, records, changes, and help
Digital Memory Months and Membership offered inside the iOS app use Apple In-App Purchase. Capsoul does not offer a separate direct WeChat Pay checkout for these digital products in the iOS app.
We maintain transaction and balance-ledger records needed to prevent duplicate credit, reconcile Apple notifications, explain consumption, handle refunds, and investigate disputes. Material policy changes will be communicated as appropriate and do not retroactively convert eligible legacy-free Capsouls into paid ones.
For quote or balance questions, contact support@capsoul.chat and include the account email and a Capsoul or App Store transaction reference when available. Do not send passwords, verification codes, receipts containing sensitive account data, JWS payloads, or Apple credentials.