Burner
Trust

Security at Burner

How we protect your messages, your account and your mail — what we can promise, what we can’t, and how to tell us if you find a problem.

Last updated: 25 September 2026

Messages

  • End-to-end encryption. When you sign up, your phone creates an encryption key pair (RSA-2048). Your private key stays on your phone, in the phone’s secure storage. Each message is encrypted on your phone with a fresh random AES-256 key, and that key is locked separately for each recipient with their public key (RSA-OAEP). Only their phones can unlock it.
  • Relay, not archive. Our server holds each encrypted message only until every recipient’s phone has it, then deletes its content (a content-free record of id, sender and time is kept up to 30 days to enforce the rules, then deleted). Undelivered messages are deleted after 30 days. Less stored means less that can ever leak.
  • Secured messages are the exception: kept on our server, still encrypted, so you don’t lose them with your phone.
  • Files follow their messages. Attachments are deleted from our file storage when their message, story or post goes. Stories and their files are deleted after 24 hours.
  • AI and translation on the device. Burner AI (developed by Arc IO) and message translation run entirely on your phone, so decrypted text is never sent to a server to be processed.

Your account

  • Passwords are stored only as argon2id hashes.
  • Your 12-word recovery phrase is generated on your phone. We store only a proof derived from it and a backup of your encryption keys that is encrypted with it (AES-256-GCM) — we cannot open that backup.
  • You can turn on biometric unlock, and delete your account from the app at any time.
  • Every connection between the app and our servers uses HTTPS/TLS.

Our servers

  • Burner runs on servers we operate ourselves, not on an advertising platform.
  • Administrative access is by SSH key only; password logins are disabled, and repeated failed attempts are blocked automatically.
  • A firewall allows only the ports the service needs. Security updates are installed automatically.
  • Services run in isolated containers. Internal databases are not reachable from the internet.
  • Secrets — such as each Burner Mail mailbox password — are stored encrypted (AES-256-GCM), and storage keys for our file provider never reach users’ phones.
  • Nightly backups are kept for 14 days, and restoring them is tested.

Burner Mail

  • Every mail, in and out, is scanned for viruses (ClamAV) and spam (Rspamd).
  • Mail with dangerous attachment types — executables, scripts, macro-enabled Office files, disk images, shortcuts and similar, including inside archives — is rejected before it reaches you.
  • The app never opens an attachment by itself and warns you before opening any file that isn’t an image or PDF.
  • The app never sees your mailbox password; the API talks to the mail server on your behalf.

Sharing and leaks

  • Watermarks: photos, videos, stories and video calls show the viewer’s own username, so a screenshot or recording can be traced back.
  • Forward approval: media you send can’t be forwarded on without your approval.
  • Secure messages: the other person can’t delete a message you secured without your approval.

What encryption doesn’t cover

We’d rather you know the limits than assume more than we offer:

  • Metadata: to deliver a message, our server needs to know who it’s from, who it’s for and when it was sent.
  • Attachments are uploaded over encrypted connections, but are not yet end-to-end encrypted in every case.
  • Channels are public and not end-to-end encrypted.
  • Email to and from other providers is ordinary email and is not end-to-end encrypted.
  • Calls are carried by our calling provider’s real-time network.
  • Your phone: anyone who can unlock your phone can read your chats. Watermarks discourage screenshots but can’t prevent them.

We follow at least industry-standard security practices, but no system is perfectly secure and we can’t guarantee absolute security. See the Terms of Service.

What you can do

  • Write down your recovery phrase and keep it offline and private.
  • Use a strong, unique password and a screen lock on your phone; turn on biometric unlock.
  • Secure the messages you can’t afford to lose, and keep your own backups of anything important.
  • Keep the app and your phone’s system up to date.
  • Be wary of links and files from people you don’t know — and report them.

Report a vulnerability

If you believe you’ve found a security problem in Burner, please tell us privately at security@burnerchat.ai. Our security.txt has the same details.

Please include

  • a description of the issue and its impact;
  • steps to reproduce it (app version, device, requests or a short video help);
  • how we can contact you, and whether you’d like to be credited.

Our promise

  • We’ll acknowledge your report within 3 business days and keep you updated.
  • We won’t take legal action against research carried out in good faith under this policy.
  • With your permission, we’ll credit you once the issue is fixed.

Please don’t

  • access, change or delete other people’s data — use your own test accounts;
  • run denial-of-service, spam or social-engineering tests, or test physical security;
  • disclose the issue publicly before we’ve had a reasonable time to fix it (we suggest 90 days).

We don’t currently run a paid bug bounty programme.

Back to top ↑