Privacy Policy.

Last updated: July 7, 2026

Who this covers

This policy covers the BurnPony iOS app, the note-viewing pages at burnpony.app, and this website — all developed and operated by NorseHorse, an independent developer. Contact: NorseHorse@norsehor.se.

What the app collects

Nothing about you. There is no account, no sign-up, and the app never asks for your name, email address, or contacts. The Sent tab keeps a local record of notes you've created — the note ID, a management token, and your chosen settings, never the note text — and it exists only on your device.

What the server stores

Notes are stored on a relay so recipients can fetch them. For each live note the relay holds:

• The sealed envelope — your note, encrypted on your device with AES-256-GCM. The decryption key travels only in the link's #fragment, which browsers do not send to servers, so the relay cannot read the note. Even the auto-hide setting travels encrypted inside it.
• Bookkeeping — a random note ID, created and expiry timestamps, the view allowance and count, whether a read receipt was requested, and a hash of the management token used for early burn.
• Receipt times — if and only if you enabled receipts for that note, the times it was opened.
• Push registrations — device push tokens (up to five per note) so your phone can receive the generic "A note was opened." notification. They are removed with the note.

Ciphertext is deleted in the same database transaction as the last allowed view, at expiry (a sweep runs every five minutes), or when you burn the note early. Burned, expired, and never-existed notes return identical responses.

Rate limiting and network data

To keep the relay healthy, note creation and abuse reports are rate-limited using IP addresses hashed with a server-side secret; those hash records expire after roughly two hours. Like any internet server, the relay sees connecting IP addresses at the network level while handling a request; it does not build profiles from them, and the web server in front of it is configured with access logging disabled.

Abuse reports

The viewer includes a report function. A report stores the note ID, the reason text the reporter enters (up to 500 characters), and the reporting time, for operator review. Reports are purged after 30 days, and submitting one never reveals whether a note exists.

Push notifications

Read receipts use Apple's push service to wake your app. The notification is deliberately generic — "A note was opened." with only the note ID attached — so no note content or settings transit Apple's servers.

What this website collects

Nothing. No analytics, no trackers, no advertising scripts, no third-party fonts, no tracking cookies. The note-viewer page additionally makes no requests to anyone except this server for the sealed note itself. If you use the launch-notify form, your email address is stored solely to send you a single launch announcement and is never shared or sold.

Third parties

The only third party in the system is Apple's push infrastructure, which carries content-free wake-up signals. No data is sold or shared with anyone.

Data retention and deletion

Note ciphertext lives exactly as long as its view allowance and expiry allow, and not a sweep-cycle longer. Receipt records and push registrations are removed with their note. Rate-limit hashes expire in about two hours; abuse reports in 30 days. Deleting the app deletes your local Sent records; because there is no account, there is no server-side profile to delete.

Children

BurnPony is not directed at children under 13 and does not knowingly collect information from anyone, children included.

Changes

If this policy changes, the update appears on this page with a new date. There is no dark-pattern re-consent flow because there is no data collection to consent to.

Contact

Questions about privacy: NorseHorse@norsehor.se.