Covering BurnPony.
Everything needed to write about the app accurately, plus a developer who answers his own email.
One-liner
BurnPony is self-destructing encrypted notes for iPhone: sealed on the device with AES-256-GCM, shared as one link that opens in any browser, and burned after the last allowed view.
Boilerplate
BurnPony creates burn-after-reading notes with client-side encryption. A note is sealed on the sender's iPhone with AES-256-GCM before upload; the decryption key travels only in the link's #fragment, which browsers never send to servers, so the relay stores ciphertext it cannot read. Recipients need no app — a single self-contained viewer page decrypts the note in any modern browser. Notes carry a view allowance (1–100) and an expiry (1 hour–30 days); the last view deletes the ciphertext in the same database transaction, and burned, expired, and never-existed notes are indistinguishable from outside. Optional extras include a PBKDF2-stretched passphrase second factor, disclosed read receipts, an encrypted auto-hide timer, QR handoff, and early burn with live status. BurnPony is developed by NorseHorse, the solo indie developer behind the Pony family of privacy apps (PGPony, CarrierPony, AgePony, QuorumPony, RelayPony). It is free.
Key facts
- Platform: iOS (iPhone), with recipients on any modern browser. In development; App Store submission is being prepared. Android is planned.
- Price: free.
- Encryption: AES-256-GCM, keys via HKDF-SHA256, optional passphrase via PBKDF2-HMAC-SHA256 (600,000 iterations) — all client-side.
- The link: burnpony.app/n/<id>#<key> — the key lives in the fragment and never reaches the server.
- Lifecycle: 1–100 views, 1 hour–30 days expiry, early burn from the Sent tab; identical responses for burned, expired, and nonexistent notes.
- Accounts: none, for senders or recipients. No analytics, no trackers.
- Developer: NorseHorse, solo independent developer.
What makes it different
- The "server can't read it" claim is structural, not contractual: the key rides in the URL fragment, which browsers never transmit.
- The recipient's code is auditable on every note: the viewer is one self-contained page, readable with View Source.
- Read receipts without surveillance: the recipient is told before revealing, and the push notification is content-free.
- Indie scale as a feature: one developer, no growth team, no incentive to collect anything.
Imagery
Please don't recolor or restyle the icon.
Contact
NorseHorse@norsehor.se — goes straight to the developer. Encrypted mail welcome via the PGP key.