Privacy Policy

1. The short version

The Capy app has no accounts, no ads, no analytics and no tracking, and no server that can read your rooms. Your messages, calls, files, transcripts and minutes stay on the devices of the people in each room and travel between them, encrypted, directly whenever the devices can reach each other. Two helpers run by the team, a blind peer and a blind relay, handle only encrypted data they can't read (sections 5 and 6). The app talks only to other peers, with one exception you control: to preview a link you type, your device fetches that page (section 5). A link you click in a message opens in your own web browser, not in Capy. We, the team that publishes Capy ("Capy", "we", "us"), don't receive your content. Beyond what the blind peer and relay see (sections 5 and 6), the only thing the app sends us is a feedback or bug report you choose to send.

This policy covers the Capy desktop app and this website. The website is the one place where visits may be counted, with Google Analytics and only if you accept (section 10).

2. What we don't collect

We don't collect or have access to:

• your 24 recovery words or your keys;
• your messages, calls, voice, video, screen shares, files, photos, recordings, transcripts, captions, minutes, tasks or canvases;
• your rooms, their members, your contacts or who you talk to;
• usage analytics or telemetry from the app, advertising identifiers, or crash reports you didn't send.

3. What stays on your device

Capy keeps its data in its own folder on your computer:

• Your identity: the 24 words, in a file only your user account can read. Logging out makes the device forget them.
• Your rooms: their messages, files, profiles, receipts, meetings, tasks, canvases, transcripts, minutes and insights, as the room's members share them.
• Message keys: each message is sealed with a key of its own, kept apart from the room so a delete can destroy it.
• Devices you met: the keys of the devices of people in your rooms that this device connected to recently (up to 8 per room and 32 in all, none unseen for 14 days), so Capy can reconnect to them directly. Secure rooms are never on it, and the list isn't sent anywhere.
• On-device AI data: the speech and language models, the search index of your rooms' transcripts and minutes, and the minutes, transcript chapters and suggestions your computer prepares after the calls you were in.
• Diagnostics: the recent errors of this version of Capy, which start over after an update, and, during a call and for 10 minutes after it, a second-by-second log of how its connection went, kept in memory only. They leave the device only in a report you send (section 9).
• Settings: theme, language, notifications, audio and video devices, privacy switches.

Logging out keeps your rooms on the device for when you log in again with the same words. To remove this computer's copy, use Log out and erase, at the bottom of Settings → Privacy & security: Capy destroys what opens your account here, then removes every room, message and file it kept for the account on this computer, its secure rooms and your 24 words. Your rooms stay with the other people in them and on your other devices. It doesn't reach copies you saved outside Capy, or what the disk keeps of removed files until it reuses the space (full-disk encryption covers that). A secure room keeps its key, its network's key pair and what it needs to open again in one file (readable only by your user account) in the room's own folder on this device, until the room is erased: when its call ends, a day after it was made if no call ended it, when its owner erases it, or when you log out. Then the folder is purged and removed.

4. What the people in your rooms receive

Everyone in a room receives what is shared there, and keeps a copy on their device:

• your profile: name, colour, optional photo and status;
• your messages, reactions, files, voice and video messages, and what you say in calls (as audio, and as the transcript your own computer makes, if transcription is on);
• whether you are online and typing, and read receipts. You can turn these off in Settings → Privacy & security.

Room members can save, copy, screenshot or record what they receive. Choose who you invite.

5. The peer-to-peer network

Capy finds other people's devices through a public distributed hash table (HyperDHT) and connects to them directly, with end-to-end encryption.

• Devices you connect to, and nodes of the network that help connect you, can see your IP address.
• When two devices can't connect directly, a blind relay run by us passes their traffic along. The traffic is end-to-end encrypted, so the relay can't read it. It can see the IP address of the devices that use it, how much data passes and when. Big files (over 25 MB, or over 100 MB when sent from Capy 1.0.9 or earlier) and the files in a room's Files tab never go through it.
• To find a room, your device announces a short code derived from the room's key. It doesn't reveal the room's name or content. Secure rooms announce nothing.
• Link previews. When you type a link with link previews on (Settings → Privacy & security), your device fetches that page and its picture once to make the preview, before you send, so that website sees your IP address, as with any visit, and that the visit comes from Capy. The preview travels inside your message: the other people in the room don't fetch the page. Secure rooms never make previews.
• Links you click. A link in a message opens in your web browser only when you click it. Your browser then visits that site as it would from any other app, with your IP address and what your browser sends; Capy adds nothing about you or the room. In a secure room links don't open.

6. The blind peer

So that rooms can still sync while their members are offline, Capy copies every room to a blind peer, a peer run by us and set in the app's own configuration. It holds only encrypted data: it can't read messages, files or names. It can see the IP address of the devices that connect to it, how much data it stores and when. Secure rooms are never copied to it, and neither are the files in a room's Files tab nor files over 25 MB (over 100 MB when sent from Capy 1.0.9 or earlier): those go only directly between members' devices.

7. On-device AI

Transcription, captions, translation, minutes, tasks and answers are produced by AI models running on your computer. Your voice and your rooms' text don't leave your device for this. The models are downloaded once from the QVAC model registry over the same peer-to-peer network, so the peers that serve them can see your IP address and which models you downloaded.

8. Updates

Capy checks for and downloads new versions over the peer-to-peer network from peers that seed them. Those peers can see your IP address and which version you download.

9. Feedback and bug reports

Only if you send one, a report reaches us, through Settings → Help & feedback. Before sending, the app shows you exactly what goes:

• what you typed;
• for a bug or an error, if you choose: a screenshot of the Capy window, and diagnostics: app and system versions, a few settings, a summary of how your device connects (the kind of network, and how many connections worked, went through the relay or failed, with no addresses), for a call that went badly a second-by-second log of up to its last 15 minutes (direct or relayed, round trip, loss, jitter, sending rate, how busy the app was and which AI tasks were running), and recent errors, each with the version of Capy it happened in.

Before a report is sealed, Capy removes your words, keys, invites, links and file paths from all of it, and from the diagnostics also the names of the people and rooms it knows (names you type yourself stay, since you wrote them to us). It is then encrypted so only our inbox can open it, and sent directly to it over the peer-to-peer network. Nothing is captured or sent while a secure room is open. We use reports only to understand and fix problems, and keep them only as long as we need them for that.

10. This website

Ciranda, which publishes Capy, runs this website. Unlike the app, the website may count visits, and only if you agree.

• Google Analytics, only if you accept. Until you choose Accept in the cookie banner, no Google script is loaded and nothing is collected. If you accept, Google Analytics, loaded through Google Tag Manager, collects the pages you view and when, your approximate location worked out from your IP address, your device, operating system and browser, the page that sent you here (the referrer) and the campaign tags in the link you followed (UTM tags). It sets the _ga and _ga_<id> cookies, which last up to 2 years.
• Clicks, counted the same way. With your consent, the site also counts a few clicks and views: a download (which system, processor type, file type and version), a visit to the downloads page, the buttons and links followed, language and theme changes, questions opened and the sections of How Capy works that are read. Each carries only short labels like these and the page's language: nothing you typed and nothing that says who you are. Without consent, none of them is recorded or sent.
• Who receives it. Google receives this data as our analytics provider, and may process it outside your country, including in the United States.
• Basis and withdrawal. The legal basis is your consent. You can withdraw it at any time with Cookie settings, at the bottom of every page: we then stop loading Google Analytics and delete the _ga cookies we can. Google's advertising features stay off: the site has no ads.
• How long. Google Analytics keeps this data for the retention period set in the site's Google Analytics settings, after which Google deletes it.
• Stored in your browser. Your consent choice (for 6 months) and, if you pick one, your theme are kept in your browser's local storage. They are not cookies and are never sent to us. The Cookie Policy has the details.
• Hosting logs. The servers that host this website may keep standard access logs, such as IP address, browser and pages requested, for security and reliability.

The Capy app uses none of this: it has no analytics and sets no cookies, and the only web page it fetches is a link you type, for its preview.

11. Children

Capy is not meant for children under 16, or under the age of digital consent where they live if it is higher. We don't knowingly receive data from children.

12. Your rights

Data protection laws such as the GDPR in Europe and the LGPD in Brazil give you rights to access, correct, delete and port your personal data, and to object to its processing. Because your content lives on your devices and not with us, you exercise most of these directly in the app: edit your profile, delete your messages, remove devices, log out, or remove a computer's copy with Log out and erase. For feedback reports you sent us, you can write to us to exercise these rights. You can also complain to your data protection authority.

13. Security

Capy encrypts connections end to end, signs every record with the author's identity and checks it on every device, seals each message with its own key, and keeps its windows from making web requests. No system is perfectly secure: keep your devices updated and locked, and your 24 words private.

14. Changes

We may update this policy. The date at the top shows when it last changed.