Sealed SealedLast updated: September 4, 2026
Sealed (the "app") is published by the studio Ivryn (Victor Laybats). Contact: contact@victorlaybats.com. Sealed is built to keep your moments private. We collect the bare minimum needed to run the app. No ads. No data resale. No account required.
By design, Sealed is local-first. A capsule you run on a single phone is never uploaded to our servers. A shared capsule is the exception, because every member has to see the same reveal from their own phone; section 3 states exactly what it stores. The following are kept in the app, on the phone that created the capsule:
Sealed asks for camera permission to capture moments in the app. Every capsule moment is shot live: Sealed does not browse or import existing photos from your photo library or camera roll. The camera is only active while you are on the capture screen.
After a capsule opens, you can choose Save or Save all. When you do, Sealed writes the selected image copies to your photo library and may ask for the operating system's Photos permission. Sealed does not read your existing library for this purpose. Saved copies are outside the capsule and remain in your photo library until you remove them there.
A capsule you create alone stays on your phone. Guests pass that phone around during capture and gather around the same phone for the reveal. Nothing about it reaches our servers.
Shared capsules are different, and they are optional. Creating or joining one does not require an account. The host creates a capsule and receives a six-character code plus a sealedreveal.com/j/CODE link. Up to 30 members can join with the code and a first name from their own phones. If you choose to sign in with Apple, Google, or a code sent to your email address, we store the first name you choose, the email address used to sign in, a friend code, and a session token that is only ever kept hashed. For a shared capsule we store its title, its join code, its opening time, the first names of its members, and the photos its members add.
The server never serves a photo before the capsule opens, not even to the person who sent it. Photos are held by our object storage provider, Cloudflare R2, never in a public web root and never behind a public or shareable link: the Sealed server is the only reader, and it only reads once the capsule has opened. Everything belonging to a shared capsule is deleted 30 days after it opens. You can delete your account and its data at any time from the app or from sealedreveal.com/delete; a capsule that still has other members survives, without the photos of the person who left.
You may attach an HTTPS link from a supported music service to a capsule. Sealed stores that link locally and can open it in the corresponding service. You start playback there before returning to Sealed. Sealed has no integrated commercial-music catalogue and does not download, stream, synchronise or control the commercial track. The external music service processes your activity under its own terms and privacy policy.
Sealed offers optional auto-renewing monthly and annual subscriptions through the Apple App Store and Google Play. The annual subscription may include a three-day free trial for eligible new subscribers when the Store presents that offer. The localized price, trial availability and renewal terms shown before purchase come from the Store and may vary by country, currency, tax and eligibility.
Apple or Google processes the payment. RevenueCat acts as Sealed's subscription-processing provider. It receives the transaction and subscription-status information supplied by the Store, together with an app-specific anonymous identifier and the product and entitlement identifiers needed to present offers, validate purchases, restore access and keep subscription access current. Sealed does not send capsule photos, captions, crew names or other capsule content to RevenueCat for subscription processing.
You can manage or cancel a subscription in your Apple App Store or Google Play account settings. The applicable Store controls trial eligibility, billing, refunds, the effective time of cancellation and any remaining access period.
You can access and delete your data in the app at any time. Deleting a capsule removes its app-local moments. Uninstalling the app normally removes its app-local data from that phone. Neither action removes copies that you saved to Photos, shared elsewhere or retained through your phone's system backup. For any request, or to exercise your rights under the GDPR (access, correction, deletion), email contact@victorlaybats.com.
One-phone capsules. Opening or viewing a capsule does not automatically delete it. Opened capsules and their photos remain stored locally in the app until you manually delete the capsule or uninstall the app. Your phone's operating-system backup settings may back up or restore app data. Ivryn never holds a server copy of a one-phone capsule.
Shared capsules. A shared capsule is stored on the Sealed server so that up to 30 members can add photos from their own phones and open it together, with its photos held by our object storage provider, Cloudflare R2 (section 3). A capsule can stay sealed for at most 30 days after it is created, and everything that belongs to it, including its photos, its member list and its join code, is deleted from our server 30 days after it opens. Photos you save to your own phone after the reveal stay there under the one-phone rules above. Deleting your account removes your own photos from any capsule you were part of.
Copies you save to Photos or share outside Sealed follow the retention and backup rules of those destinations.
Cápsulas en un solo teléfono. Abrir o consultar una cápsula no la elimina automáticamente. Las cápsulas abiertas y sus fotos permanecen guardadas de forma local en la aplicación hasta que elimines la cápsula manualmente o desinstales la aplicación. Los ajustes de copia de seguridad del sistema operativo del teléfono pueden guardar o restaurar los datos de la aplicación. Ivryn nunca conserva una copia en el servidor de una cápsula de un solo teléfono.
Cápsulas compartidas. Una cápsula compartida se guarda en el servidor de Sealed para que hasta 30 miembros puedan añadir fotos desde sus propios teléfonos y abrirla juntos. Las fotos se conservan en Cloudflare R2, nuestro proveedor de almacenamiento de objetos. Una cápsula puede permanecer sellada un máximo de 30 días desde su creación. Todo su contenido, incluidas las fotos, la lista de miembros y el código de acceso, se elimina de nuestro servidor 30 días después de su apertura. Las fotos que guardes en tu teléfono después de la revelación permanecen allí según las reglas de las cápsulas de un solo teléfono. Al eliminar tu cuenta, tus propias fotos se retiran de cualquier cápsula de la que formaras parte.
Las copias que guardes en Fotos o compartas fuera de Sealed siguen las reglas de conservación y copia de seguridad de esos destinos.
Kapseln auf einem Telefon. Das Öffnen oder Ansehen einer Kapsel löscht sie nicht automatisch. Geöffnete Kapseln und ihre Fotos bleiben lokal in der App gespeichert, bis Sie die Kapsel manuell löschen oder die App deinstallieren. Die Sicherungseinstellungen des Betriebssystems können App-Daten sichern oder wiederherstellen. Ivryn besitzt niemals eine Serverkopie einer Kapsel auf einem Telefon.
Geteilte Kapseln. Eine geteilte Kapsel wird auf dem Sealed-Server gespeichert, damit bis zu 30 Mitglieder Fotos von ihren eigenen Telefonen hinzufügen und die Kapsel gemeinsam öffnen können. Die Fotos liegen bei unserem Objektspeicheranbieter Cloudflare R2. Eine Kapsel kann nach ihrer Erstellung höchstens 30 Tage versiegelt bleiben. Alles, was zu ihr gehört, einschließlich Fotos, Mitgliederliste und Zugangscode, wird 30 Tage nach dem Öffnen von unserem Server gelöscht. Fotos, die Sie nach der Enthüllung auf Ihrem Telefon speichern, bleiben dort nach den Regeln für Kapseln auf einem Telefon. Wenn Sie Ihr Konto löschen, werden Ihre eigenen Fotos aus allen Kapseln entfernt, an denen Sie beteiligt waren.
Kopien, die Sie in Fotos speichern oder außerhalb von Sealed teilen, unterliegen den Aufbewahrungs- und Sicherungsregeln des jeweiligen Ziels.
Capsule su un solo telefono. Aprire o visualizzare una capsula non la elimina automaticamente. Le capsule aperte e le relative foto restano archiviate localmente nell'app finché non elimini manualmente la capsula o disinstalli l'app. Le impostazioni di backup del sistema operativo del telefono possono salvare o ripristinare i dati dell'app. Ivryn non conserva mai una copia sul server di una capsula su un solo telefono.
Capsule condivise. Una capsula condivisa viene archiviata sul server di Sealed affinché fino a 30 membri possano aggiungere foto dai propri telefoni e aprirla insieme. Le foto sono conservate presso Cloudflare R2, il nostro fornitore di archiviazione a oggetti. Una capsula può restare sigillata per un massimo di 30 giorni dalla creazione. Tutto ciò che le appartiene, comprese le foto, l'elenco dei membri e il codice di accesso, viene eliminato dal nostro server 30 giorni dopo l'apertura. Le foto salvate sul telefono dopo la rivelazione restano lì secondo le regole delle capsule su un solo telefono. Eliminando il tuo account, le tue foto vengono rimosse da tutte le capsule di cui facevi parte.
Le copie salvate in Foto o condivise fuori da Sealed seguono le regole di conservazione e backup delle rispettive destinazioni.
Sealed is intended for users aged 13 and over (16+ where local law requires).
We may update this policy as the app evolves. Any feature that materially changes data handling will require an updated explanation before release. The "last updated" date above always reflects the current version.
In the app. Sealed counts product events so we can measure first opens, return visits and where people leave the onboarding, purchase and capsule flows. Each event carries a randomly generated anonymous installation identifier, a randomly generated session identifier, platform, app version, language and a small allowlisted set of technical properties such as step number, plan type, duration or the word solo or shared. These identifiers are not an advertising identifier or a hardware identifier and are not linked to your name, email or capsule. No photo, caption, capsule title, name, email or invitation code is ever included. Event-level records stay on our own server for up to 120 days, and your IP address is used only for rate limiting and is not written to the event record. No third-party analytics SDK is present in the app.
On the public website. Sealed’s public website counts aggregate page views and conversion actions without a tracking cookie, fingerprint or persistent visitor identifier. Query strings, email addresses and IP addresses are not written to the measurement store. After validation, PostHog US Cloud processes a sanitised server-side copy for 12 months under the current project setting, with a fresh anonymous event identifier, a zeroed IP property, person-profile processing disabled and no session replay. Do Not Track or Global Privacy Control disables the script. See the IVRYN portfolio measurement notice.