Privacy policy

The app stores on your phone:

• your capsules and drafts: name, letter text, the date written, the opening date, the seal colour, whether it has been opened, and which earlier letter it answers;
• copies of the photos and videos you add (photos made smaller), and the voice messages you record;
• “this moment”: your mood, a song, the city and the weather if you add them and, in letters to yourself, the phone’s name (the one you gave it, or else its maker and model) and the battery level;
• capsules that friends send you and, for a group capsule you organize, the letters collected so far;
• your settings (language, theme, your birthday if you use it for a capsule, the connected Google account’s e-mail).

Photos and videos are chosen through Android’s own photo picker, so the app sees only the ones you pick, never your whole gallery. The microphone is used only while you are recording a voice message. All of this is kept in the app’s private storage, which other apps cannot read, but the files themselves are not encrypted. The app turns off Android’s automatic backup. Photos and videos you take in Kolys are taken by your phone’s camera app; Kolys itself has no camera permission.

A sealed letter is locked by the app: Kolys does not open or show it before its day, and the date is checked online. This is a lock in the app, not encryption.

On your phone, letters, photos and recordings are ordinary files and database entries in the app’s private storage. Someone who gets past Android’s app protection, for example on a phone that is rooted or opened with special tools, could read them. The zip in your Google Drive is not encrypted either, so Google could read it, as it can anything stored on Drive.

Gift files and group capsules work differently, see “Capsules as gifts” below. Do not put into a capsule anything that must stay unreadable to others.

If you sign in with Google, Kolys asks for one permission: drive.appdata. It lets the app create, read and delete only its own files in a hidden app folder on your Google Drive. The app cannot see or change any other files in your Drive.

Each sealed capsule is saved there as one ordinary zip file named with the capsule’s random id (the letter, its photos, videos, voice messages and “this moment”), not encrypted. The opening date and the date it was opened are also kept as properties of the file. Drafts are not uploaded. A sync starts a few seconds after a change when there is internet, and about twice a day. This is what brings your sealed capsules back on a new phone. The app also reads your account’s e-mail address only to show you which account is connected.

Data travels directly between your phone and Google over an encrypted connection. There is no other server in between. Google’s own privacy policy applies to what is stored in your Drive.

In Settings you can save all your capsules and drafts into one file, in the place you choose, without Google. The app doesn’t send this file anywhere. If you save it to a cloud folder, that service stores it.

Without a secret word the file is not encrypted: whoever has it can read every letter, sealed ones too. With a word it is encrypted, and it is as safe as the word is hard to guess. If you forget the word, nobody can open the file.

Restoring puts back the capsules that aren’t on the phone, and sealed ones stay sealed. Letters still being collected for a group and the words of gifts you sent are not in the file.

Kolys’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Data from your Google Drive is used only to keep your capsules and bring them back to your phones.
• It is never sold, never used for ads and never shared with anyone.
• No person reads it: the developer has no access to your Drive or your letters.

So that a capsule can’t be opened early by moving the phone’s clock, the app asks a web server for the current time (www.google.com or www.cloudflare.com) and reads the date from the reply. It asks again when a capsule’s day comes, before it tells you. Nothing about you or your capsules is sent. As with any web request, these services see your IP address.

Only when you tap “Add the city and the weather” while writing, the app asks Android for your approximate location (never the precise one) once. Android’s location service, usually Google’s, turns it into a city name, and the app asks MET Norway (Norwegian Meteorological Institute, api.met.no) for the current weather, sending the location rounded to about a kilometre. Only the city name and the weather are kept in the capsule; the location itself is not stored. You can always leave this out.

When you look for the song of the moment, the words you type are sent to MusicBrainz (musicbrainz.org), an open music database, to find matching song names. Only the song’s name, artist and year are kept in the capsule, never covers or recordings. “Listen” passes the song’s name to the music app on your phone (or opens a YouTube Music search), and that app works under its own rules. You can also just type a song yourself without searching.

A capsule for someone else becomes one file that you send yourself, in the app you choose (a messenger, e-mail, Google Drive). The developer never receives it. The file holds the letter with its photos, videos, voice messages and “this moment” (without the phone’s name or the battery level), and your name if you give it. The file’s name contains the name you typed for the recipient or the group, which the messenger or mail service can see. Videos are sent as they are, which can include where they were filmed.

Without a secret word the file is encrypted, but the key is stored inside the file. This stops a friend from unpacking it early by accident, not anyone who has the file and some skill. If you lock it with a secret word, the key is made from the word and is in no file, so the file is as safe as the word is hard to guess. The word stays only on your phone, so you can look it up again, and never goes into the file, your Google Drive or to the developer. Only the hint you write can be read before unlocking.

A capsule for a group also carries the group’s name and the names you list. When a group writes a capsule together, the invite file holds the group’s key unencrypted, so anyone who has the invite can read the letters sent back. Each person’s letter goes as a file to the one collecting them, encrypted with that key. Until the capsule is sealed, the collected letters sit as ordinary files in the organizer’s app storage; the app shows only who has written, not what, and they are not copied to Drive.

Once the recipient opens the file in Kolys, their copy lives in their app, unencrypted like any capsule, and, if they use it, in their own Google Drive. Files you have sent stay with the recipients and in the messenger or mail service; deleting a capsule in Kolys cannot take them back.

The notification on the opening day is scheduled on your phone and waits for an internet connection, because the date is checked first; nothing about it is sent anywhere. “Add to calendar” opens your phone’s calendar app with a ready event (the capsule’s name and opening date). You decide whether to save it, and it is then kept by your calendar app. Kolys cannot read your calendar. The home-screen widget shows your nearest capsule’s name and the days left; the large one shows up to three capsules with a progress bar and the opening dates.

If automatic checks are on (they are by default), the version of Kolys from this website checks the Kolys website (pegasohlib.github.io) for a new version when you open the app, at most once every 30 minutes. There is no check in the background. It downloads the update from GitHub only when you tap Update, and checks the file’s SHA-256 before installing. Like any website, GitHub sees the IP address of your device; nothing else is sent, and no data from the app.

You can turn automatic checks off in Settings. When the app comes from Google Play, Google Play updates it instead.

GitHub also counts how many times each file has been downloaded. It is only a number, with nothing about who downloaded it; the website shows it as an approximate number of downloads.

• no accounts with the developer and no servers of its own;
• no analytics, no ads, no tracking, no crash reports sent anywhere;
• no selling of data, and nothing sent to the developer;
• no access to your contacts, files or gallery, and no location in the background.

Internet

to check the date and the weather, use Google Drive, search for songs and check for updates.

Network state

to wait for a connection before checking the date or syncing.

Notifications

the opening day and the reminders along the way.

Microphone (optional)

only for voice messages, while you record.

Approximate location (optional)

only for the city and the weather, when you ask.

Vibration

when a capsule opens.

Install apps

to install its own updates (only in the version from this website).

• Deleting a capsule in the app removes the letter, its files, “this moment”, its reminders and the saved gift word from your phone at once, whether or not you are signed in. Only a blank row with the capsule’s random id stays until the next sync. Leftovers of older versions are blanked when the new version starts.
• On Google Drive the capsule’s zip is deleted, and a small file with the capsule’s id and the ending .gone stays. It holds only the word “gone” and tells your other phones to delete the capsule too. A capsule you changed on another phone since then stays. A reply keeps its own copy of the letters it answers, so they survive deleting the original.
• Uninstalling the app removes everything it stored on the phone, but not the copy in your Google Drive, not the copy files you saved and not the files you sent to others.
• To remove the Drive copy without the app: open Google Drive on the web → Settings → Manage apps → Kolys → Options → Delete hidden app data.
• You can take away the app’s access at any time at myaccount.google.com/connections.

If the app starts doing something new with data, this page will be updated first, with a new date at the top.

Who is responsible. PegasoHlib, a private individual who develops these apps, is responsible for the data described here. Contact: support@pegasohlib.com.

Why data is used, and on what legal basis.

Running the app, and the backup or sync you turn on

Contract: needed to provide what you asked for (GDPR Art. 6(1)(b))

City and weather, song search

Consent: you can turn it off at any time (Art. 6(1)(a))

Update checks and safety

Legitimate interest: keeping the app safe and up to date (Art. 6(1)(f))

An e-mail you send

Legitimate interest: answering you (Art. 6(1)(f))

Who receives it, and transfers outside the EU. Google (your Drive, Android’s address service on most phones, and the time check), Cloudflare (the time check), MET Norway (weather), MusicBrainz (song search) and GitHub (update checks and downloads). E-mail you send passes through Cloudflare and is kept in a Gmail mailbox by Google, and Anthropic may process it when an AI assistant helps read it. Some of these companies are based in the United States or other countries outside the EU. Those transfers rely on the EU–US Data Privacy Framework where the company takes part in it, or on the company’s standard contractual clauses.

How long it is kept. Data in the app stays until you delete it or remove the app. Copies in your own cloud storage stay until you delete them. E-mails you send are kept until the matter is closed, and for no more than 2 years.

Your rights. You can ask for access to your data, correction, deletion, restriction, a copy to take elsewhere (portability), and you can object to processing or withdraw consent at any time. Write to the address above. You’ll get an answer within one month. Most of the data is only on your device, so you can usually do this yourself in the app.

Complaints. You can complain to the data protection authority of your country.

Age. You need to be at least 15 to use the app on your own. If you are younger, ask a parent or guardian to agree first.

Language. Translations of this policy are made with the help of AI. If a translation differs from the English text, the version more favourable to you applies.

Questions about privacy: support@pegasohlib.com.