Note-taking apps

Capacities

Connected notes and knowledge management with offline support

GermanyEUFree plan Ownership reviewed, controller unresolvedHigh non-EU dependency
Visit website capacities.io

Scope verdict

Ownership reviewed, controller unresolved

The current imprint identifies Capacities Labs GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, HRB 735669 at Amtsgericht Freiburg, VAT DE356317955, with Steffen Bleher as managing director. Current shareholder percentages and voting or veto rights were not obtained, so ultimate control remains unresolved. Terms, privacy and the DPA still show the older St. Wendel address and Saarbrücken registration. German law applies with mandatory consumer protections; the DPA names Saarbrücken as forum where permitted.

How we classify services

Operational dependency warning

Relies heavily on non-European providers

Current public evidence shows 4 non-European infrastructure or email dependencies across 3 providers: AWS and DigitalOcean, Cloudflare, Google. The reviewed operational path is therefore not entirely European.

Review dependencies ↓

Capacities organizes notes as linked objects with custom types, daily notes, search and media. The hosted product has web and native clients, with offline editing and synchronization when you reconnect.

Offline support is not a self-hosted edition: full-text search and AI need an online service. Data is encrypted in transit and on the servers, but not end-to-end encrypted. Optional AI features send selected content and context to the chosen model provider.

Pricing

Basic is free, with unlimited spaces, objects and blocks; media uploads allow 5 GB initially and 100 MB/month afterwards. The live euro display lists Pro at EUR 10.99/month or EUR 8.99/month billed yearly; Believer starts at EUR 12.99 or EUR 10.99 respectively. The optional Plus AI add-on is EUR 10/month or EUR 8.33/month billed yearly. Paid uploads have fair-use limits. Checked 16 September 2026; terms say invoice totals include applicable VAT.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Core service hosting

AWS and DigitalOcean

Non-European provider
Observed
DPA Annex 1 names AWS for EU-region hosting and DigitalOcean for additional infrastructure. The business FAQ claims EU user-data storage; the security memo describes encrypted backups in multiple European locations. Exact region IDs and backup cities are not published in the reviewed material. Provider control and data location are distinct.

Why this matters

Reviewed evidence places AWS and DigitalOcean in the core service path, so customer data may be processed under non-European control. Check the cited source for the documented region and scope.

Public website

Cloudflare

Non-European provider
Observed
Website and app DNS on 16 September 2026 at 19:41 UTC both returned 104.26.10.47, 104.26.11.47 and 172.67.74.23. DPA names Cloudflare for CDN, DDoS protection and performance. These front-door addresses do not reveal origin region.

Why this matters

Public DNS routes website visits through Cloudflare. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 1 smtp.google.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Authorised outbound email

Amazon SES and Google

US-controlled cloud
Observed
SPF authorizes amazonses.com, _spf.google.com and eu-central-1.amazonses.com. This is sender authorization, not proof of actual message routing.

Why this matters

This domain authorises Amazon SES and Google, infrastructure under US ultimate ownership, to send email. If active, recipient details and message content can be processed there. SPF does not prove active use, the selected AWS region, or use of the separately operated AWS European Sovereign Cloud.

AWS ownership record ↗Sovereign Cloud distinction ↗

Supporting services

Optional AI providers

Provider control not verified
Observed
AI policy names Google Gemini for media analysis and image generation; chat and other models depend on in-app choices. Selected context goes to the chosen provider only when AI is used. Capacities states no training and a limited abuse-monitoring exception of up to 30 days; full current vendor/model/region details are not a static exhaustive annex.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More from Germany

AlcerisalfaviewBosch Smart HomeCalligra SuiteCodebergdeSEC