Clear choices for hosts, and clear choices for everyone who contributes.
Event memories are personal. Capsemble explains who can see a contribution, where it will be stored and whether it may be retained — before a person submits it.
Plain-English principles
Private does not mean invisible to the host
In a private Memory, authorised hosts and moderators can review submissions. Contributors should know this before uploading.
Public display needs a separate choice
An organiser should not treat submission as unlimited promotional permission. The contributor notice distinguishes event display, event retention and marketing use.
Live-only should mean temporary
If a contributor selects Live-only, the temporary media expires after the stated window and does not enter the permanent organiser library.
Automation assists; people decide
Screening models can miss unsafe content and can flag harmless content. Public events need human review and a clear removal process.
Minors require conservative defaults
Capsemble is not for school events. Public cultural events and concerts may still include teenagers, so organisers should use age-aware notices, restricted public display and human moderation, and obtain appropriate consent for any retained or promotional use involving minors.
Storage destination does not replace consent
Originals landing in the organiser's own Google Drive improves control, but the organiser still needs clear access, retention and usage rules.
Contributor controls
- See the event's retention choice before uploading
- Choose Live-only when enabled
- Ask the host to remove a contribution
- Avoid adding a contribution to a public wall
- Understand whether marketing use is requested separately
Live video — what travels where
Everything Capsemble sends is encrypted in transit. The three live paths differ in who can decode it on the way, so here they are side by side.
Go live from a phone (the camera on the wall)
- The phone and the wall talk to each other directly, encrypted end to end (WebRTC, DTLS-SRTP). When two networks can't reach each other, a relay carries the packets — the relay forwards encrypted data and cannot read the picture or the sound.
- Only the wall in the room. The relay sees network addresses and how many bytes passed, nothing else.
- Nothing is recorded. When the phone stops, there is no copy anywhere.
Streaming the wall to guests far away, Facebook or YouTube
- The wall's own browser publishes an encrypted stream to our streaming provider, which forwards it to remote guests and, if the host chose it, to Facebook Live or YouTube. The provider decodes the stream to forward it, so this path is encrypted hop by hop, not end to end.
- Remote guests with the link, and the platforms the host connected. The host switches it on per event and can stop it at any moment.
- Recording is switched off on every live input we create. Facebook and YouTube keep what their own settings say.
Photos and clips on the live wall
- The wall fetches each picture over HTTPS straight from the host's own storage (Google renders the size the screen asked for). Capsemble's servers hand out the links; the pictures never pass through them.
- The screen in the room, and anyone the host gave the wall link to.
- In the host's own Drive, under the host's own retention choice. Live-only contributions expire as promised.
Questions about an event contribution? Contact the event organiser first, or contact Capsemble support. For the formal policies, see our privacy policy and terms.