Privacy Policy
The short version
Your conversations, files and notes are encrypted on your own device with a key derived from your passphrase. We do not hold that passphrase and cannot recover it. We cannot read your data, and neither can anyone who copies the file off your machine.
What we can see is limited but real, and it is described precisely below rather than summarised away. If you are relying on this product for something that matters, read the section titled What still leaks — it is the part that decides whether burnbox is right for your situation.
What stays on your device
- Every conversation, document, note, meeting transcript and burn receipt, sealed in a SQLCipher-encrypted vault.
- Your master passphrase, which is never transmitted. The key is derived from it locally (Argon2id) and held only in memory while the vault is unlocked.
- Your device signing key, used to sign burn receipts. It lives in the operating system keychain.
We have no account system, no email address, no phone number and no password to reset. There is nothing on our side that identifies you as a person.
What leaves your device, and to whom
The AI model
When you send a message, its text goes to a confidential-computing enclave (Intel TDX) operated through RedPill, which runs the model. The enclave is attested: the app checks a hardware quote and can show you which enclave answered. The host running that hardware cannot read what is inside it.
We do not receive a copy. We do not log your prompts, because they do not pass through any server of ours.
The sync relay
If you turn on sync, encrypted blobs go to our relay so your other devices can collect them. The relay holds ciphertext and opaque tokens. It has no key and decrypts nothing — it cannot tell a document from a message from a receipt.
Web search and remote sources
If you use web search, the query goes to Brave Search. If the assistant fetches a page or a source you have configured, that request goes to whoever runs it. Those are ordinary internet requests to third parties and are governed by their policies, not ours.
What still leaks
These are the gaps we know about. They are listed because you should be able to decide whether they matter for what you are doing.
- The relay sees connection metadata. It cannot read your content, but it necessarily observes that some account token connected, from some IP address, at some time, and roughly how much data moved. Over time that is a pattern. We do not keep access logs, and the relay itself logs no identifiers — but we are asking you to take that on trust, which is exactly why the relay is designed so it never needs to be trusted with content.
- Anything the assistant fetches cannot be unfetched.A web search or a source request leaves a record on that third party’s systems. Burning your copy does not reach their logs. Burn receipts count these honestly so you can see how much left.
- Shredding files in place is best-effort. Destroying a vault item zeroes its encryption key, so the data is unrecoverable as a matter of mathematics. Deleting a file elsewhere on your disk is not the same: copy-on-write filesystems, snapshots and SSD wear-levelling can retain the old contents. The app labels this distinction everywhere it appears, and does not issue a receipt for it.
- This beta build contains an extractable API key. The model key is compiled into the application so it works without setup. Anyone with the app can extract it. That is acceptable for a small, invited beta with a rotatable key; it is the reason burnbox is not publicly downloadable yet.
- Your operating system is outside our reach. Swap files, crash reports, Spotlight indexes and Time Machine snapshots are managed by macOS. Turn on FileVault and power the machine off; that is what actually protects a disk at rest.
Data we hold about you
None that identifies you. Concretely, on our relay: encrypted blobs, an opaque account token derived one-way from your master key, and short-lived rate-limit counters. No names, no email addresses, no analytics, no telemetry, no crash reporting, no advertising identifiers, and no third-party trackers on this website.
Because we cannot identify you, we also cannot answer a request to export or delete “your data” — we do not know which of it is yours. The app gives you direct control instead: burn any item, or burn the vault.
Retention
Encrypted blobs stay on the relay until you burn them, at which point the copy is destroyed and a tombstone is recorded so other devices remove theirs. Burn-after- reading drops are destroyed when collected. We do not keep backups of your ciphertext, which also means we cannot restore anything for you.
Legal requests
If we are compelled to hand over what we hold, what we hold is ciphertext we cannot decrypt and an opaque token. We would still have to comply, and we would be able to confirm that a bucket exists and when it was written to. We cannot promise to notify you, because we have no way to contact you.
Children
burnbox is not intended for anyone under 16.
Changes
If this policy changes in a way that affects what we can see, the app will say so on next launch rather than relying on you to re-read this page.
Contact
This document describes the software as built. It has not yet been reviewed by a lawyer, and it is not legal advice.