Tempora — your digital time capsule
Whatever you seal in Tempora is read by exactly one person: you, on the day you chose.
The app has no account, contacts no server, carries no advertising and sends nothing anywhere. Your capsules, their open dates, the countdowns, your opened collection and your settings are written into the app's own private storage on your phone, and that is the only place they exist. We hold no copy and have no way to obtain one.
What follows says exactly what is kept, what the seal really is, what the app is allowed to touch, and what you can ask of us. It covers the Android app named above, distributed through Google Play.
Tempora is made and published by Bis Invest AS, registered in Norway at Sør Kolnesvegen 112, 4055 Sola. Bjørn Inge Sanne answers for it. Despite the company's name, it is a software company and offers no financial services.
Under the data protection rules that makes Bis Invest AS the controller for this app — a title that here covers almost nothing, because the app puts no personal data in our hands. The one place the role becomes real is correspondence, which has a letter of its own further down.
Write to later@bisinvest.space.
Everything below sits in the app's private directory on your device. Android does not let other installed apps read it.
None of it is transmitted, because the app has nowhere to transmit it to and no permission to try.
This deserves an honest answer rather than a flourish. A sealed capsule is closed because Tempora keeps it closed: the app will not show you the text before the date you set, and there is no button anywhere in it that opens a capsule early. That is a promise the app keeps to you, and it is the whole point of the thing.
What it is not is a vault against someone who has your unlocked phone and knows what they are doing. The file lives in private app storage, which is out of reach of other apps and of anybody casually picking the handset up — but a determined person with full access to the device is a different problem, and no journalling app should pretend otherwise. If that possibility matters to you, the device's own screen lock is the control that counts.
The optional PIN inside Tempora is a second door on the same house: it stops the app opening at a glance. Treat it as a curtain rather than a safe, and set a proper lock screen underneath it.
The same decision that keeps your capsules private also means we cannot save them. There is no account to restore, no backup on our side, no support address that can recover a letter you sealed for 2034 if the phone is lost, broken, wiped or handed on.
If something in there matters — and in an app like this it usually does — treat the handset as the original manuscript. Android's own backup to your Google Drive, described a few letters down, is one safety net, and it is switched on or off in the phone's settings, not in ours. A factory reset with that turned off will take every sealed capsule with it, silently and permanently.
Tempora asks for no internet permission. That is worth more than a sentence of reassurance, because Android enforces it at the system level: a build without it cannot open a network connection at all, whatever anyone's code intends.
It also holds no permission for the camera, the microphone, your location, your contacts, your photo library or your wider file storage. If the app offers to remind you when a capsule is due, that uses the notification permission and nothing more; a notification is drawn on your own screen by Android and travels nowhere. Nothing in a reminder reveals what a capsule says.
There is no ad network here, no analytics library, no crash reporter, no attribution kit and no social sign-in. Nothing in the app is paid for by watching you, which is the reason the list two letters up is so short and the reason a capsule's contents are of no commercial interest to anybody.
Should a future release ever add one of those, this page is rewritten before that release goes out and the Data safety entry in Google Play is redone to match. Replacement wording for that day is already written and sits commented out in the source of this page, so nothing has to be invented under time pressure.
One thing happens outside the app's control. If Android's backup to Google Drive is switched on for your phone, the operating system may copy Tempora's data — capsules included — into your own Google account, alongside the backups of your other apps. That copy is yours, sits under Google's terms rather than ours, and never comes near us: we have no account there and nothing to look at.
It is a genuine trade. Backup is what saves your capsules when the phone dies; it is also one more place the text exists. Android's settings decide it, either for everything or for this app alone, and you can change your mind at any point.
The installation itself belongs to Google. When anything is installed from Google Play, Google records that under your own account, and we are later shown totals in the developer console: installs by country, Android versions in use, how ratings are moving. Those are sums with no rows behind them that we could read, and nothing in them touches a capsule.
Google's handling of your account is covered by Google's own privacy policy at policies.google.com/privacy.
Because everything sits in one private folder, there is a single thing to remove and no request to send us. Uninstalling Tempora takes the capsules, the opened collection, the PIN and the settings with it. Android's app settings also offer to clear the app's storage while leaving it installed, which empties the vault and returns the app to its first run.
Both are immediate and neither can be undone — which is the point of them, but it is also worth reading twice before tapping, since a sealed capsule cannot be recovered afterwards from anywhere except an Android backup you had already made.
Email is the single point at which personal data actually reaches Bis Invest AS: your address, and whatever you decided to put in the message. It is used to answer you and for nothing else — never a mailing list, never sold, never passed to anyone. A thread is kept while the matter is live and for a sensible period afterwards in case it returns, and then deleted.
Our basis for holding it is the legitimate interest in replying to someone who has written. Nothing in an email can be matched to anything in the app, since the app has no identifier to match it with. Ask us to delete an exchange and we will.
Norway gives effect to the General Data Protection Regulation through personopplysningsloven, and it grants you the familiar set: to learn what is held about you, to receive a copy, to have it corrected or erased, to have its use restricted, to object, and to have it handed over in a portable form. Applied here, those rights reach our email correspondence, because that is the only thing we have.
Ask at later@bisinvest.space and an answer follows within a month. If it leaves you unsatisfied, the supervisory authority for Norway is Datatilsynet at datatilsynet.no, and anyone resident elsewhere in the EEA may take it to their own national authority instead.
Tempora is a journal with a lock on it, nothing more. It does not assess anything about you, draws no conclusions from what you write, and has no opinion about the contents of a capsule — the text goes in, the date comes around, the text comes out.
People sometimes write to their future selves from a hard place. If that is the day you are having, a sealed envelope is a fine thing to write, but it is not help: in Norway, Mental Helse answers on 116 123 around the clock, and the emergency number is 113. Neither this app nor this company is a substitute for talking to someone.
The date under the title is the version in force. Anything that genuinely alters what happens to data — collection of any kind, a third-party component, a transfer out of the country — is published here before the release carrying it reaches Google Play, and the console's Data safety declaration is updated in the same pass.
Rewording a sentence for clarity is not a change of that kind and simply arrives with a newer date at the top.
Bis Invest AS
Sør Kolnesvegen 112, 4055 Sola, Norway
Responsible: Bjørn Inge Sanne
Du kan gjerne skrive på norsk.
MMXXVI