Privacy: what is stored, who reads it and for how long
Exactly what Termcapsule stores about teachers and pupils, where it is kept, who can read letters and when, how long it stays, and how to delete it.
Last updated 28 October 2026
Where it is kept
Classes, seats, letters and teacher accounts are kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.
Letters and drawings
Letter text, answers to prompts and drawings are stored in that database. A sealed letter (sealed by the pupil, or by the class sealing) is never shown to anyone before release, whatever code is used. Before a pupil seals, their seat's code shows their own draft so they can keep writing; if the teacher gives that seat a new code, the new code can open the draft too, so the pupil's page says when the code was reissued. If the teacher unseals the class (possible only before its close date), every pupil's page says so. After release a letter can be read only with that pupil's code (their own letter, nobody else's) and by the teacher, who can read every letter. Letters are deleted 180 days after release (moved to the teacher's deleted classes, then deleted for good 7 days later). Nobody at Termcapsule reads or screens letters.
What is stored about a pupil
- A seat number in a class. It is the only pupil identifier in the system.
- A scrambled form (SHA-256, mixed with the class id) of the seat's code. The code itself is shown to the teacher once, for printing, and not kept.
- When the teacher gave the seat a new code, and when the teacher unsealed the class, so the pupil can be told.
- The letter: its text, the prompts as they were asked and the answers, a drawing if the class has the drawing canvas, when it was saved and sealed, and how many times it was saved.
- No name, surname, email address, birth date, photo, network address, browser or device detail is stored with a letter, and letter text never appears in logs.
The server refuses letter text with an email address, a web address or a phone number. Prompts a teacher writes are refused if they ask for a name, surname, date of birth, address, postcode, school, phone number or email address, including spaced and look-alike spellings. Surnames inside a letter cannot be detected reliably, so the pupil page asks pupils not to write their surname, address or phone number.
What is stored about a teacher
- A random account id, the account name you chose for your passkey manager, and when the account was made.
- For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
- A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
- For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
- Your email address, only if you add one, used only for the release email and the link that confirms it. It is the one place an email address is ever stored, and nothing but the confirmation is sent to it until it is confirmed.
- Your classes: name, grade band, time zone, dates, prompts, whether drawing is on, the class link in a scrambled form plus a sealed copy that only this server can open with its own secret key (so you can print its square again), and the release notices with their email state.
- A calendar link, if you make one, kept in a scrambled form.
Limits on how fast requests come
To stop guessing and flooding, the server counts requests in hourly buckets: saves per seat, wrong codes for a class from each network address (10 an hour) and from all addresses together (300 an hour), and sign in steps per network address. An address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.
How long it is kept
- A released class, its seats and letters: 180 days after release. The class then moves to the teacher's deleted classes with a notice, can be restored for 7 days, and is then deleted for good.
- A class never released: 548 days after it was made, and never before 180 days after its release date if it has one; then the same 7 days.
- A deleted class: 7 days, while it can be restored, then deleted for good.
- A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
- Sessions: until 90 days after the last visit on that device, or until you sign out. A pupil's turn: 30 minutes at most.
- Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days. Old class links (so they can say they were replaced or cleared): 1 year, without any letter.
What stays on a device
On the pupil page, words not yet saved on the server are kept in the browser's local storage under keys beginning with classletters, and the page says whether that worked. The copy is removed once the server has the same words, and when a pupil presses "Finished? Hand the device on" after saving. On the teacher's class page, a new class's codes are kept only in that browser tab until the teacher presses Printed. The secret part of a class link sits after the # sign, which browsers do not send to any server in the address.
How to see and delete it
On your account page, Download everything gives one file with your classes. It holds letters and drawings only for classes already released; before release it holds counts only, so nobody can read early that way. Delete my account removes everything after the 7 days above, and each class can be deleted on its own. Requests by email go to [email protected].
Cookies
Two cookies, neither for tracking. Teachers who sign in get a session cookie that keeps them signed in for up to 90 days. A pupil who types a code gets a cookie that ends when the browser closes, after 30 minutes without use, when the pupil seals or hands the device on, and whenever the pupil page is opened afresh; it is sent only to the pupil part of the server. Neither can be read by page scripts or is sent to another site.
Page counts
Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what was typed. There is no other analytics.
Payments
No paid plan is offered at present; if one is added, this page will describe it.
Only teachers can receive email, only at an address they added and confirmed, and only one email: when a class set to release on a date is released. Pupils and parents are never emailed. Emails carry no letter text and no tracking images.
Typefaces
Headings and the pupil page are set in Andika by SIL International, and printed letters use Noto Sans, Noto Sans Arabic and Noto Sans Hebrew, all under the SIL Open Font License 1.1 and served from this site. The licence is at /fonts/OFL.txt.
Changes and contact
If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].