Question 1

Are my messages end-to-end encrypted?

Accepted Answer

Yes. 1:1 chats are end-to-end encrypted by default. Content is encrypted on your device and stored on our servers only as ciphertext. Encryption protects messages in transit and at rest on our side. It can't protect content that's already visible on an unlocked, in-use device.

Question 2

What does Boron store about me?

Accepted Answer

The minimum needed to run the service: your account, encrypted messages and attachments, and coarse security signals for abuse defense. We don't store message plaintext, ad identifiers, or precise IPs — IPs are kept only as salted hashes plus masked values, and anonymous events use hashed identifiers.

Question 3

What is Boron not designed to protect against?

Accepted Answer

Boron focuses on casual snooping, shoulder surfing, and typical network and server-side risks. It isn't a defense against a fully compromised device, a targeted forensic adversary, or someone holding your unlocked phone. It also can't hide that you use a chat app — only what's inside it.

Question 4

Do you use ads, trackers, or third-party scripts?

Accepted Answer

No ad networks and no analytics trackers inside the app. A strict Content Security Policy blocks inline and third-party scripts. This marketing site may load minimal first-party analytics to measure interest, only after you grant consent and only if your browser hasn't set Do Not Track. It never has access to your account or messages.

Question 5

Can I use multi-factor authentication?

Accepted Answer

Yes. Boron supports app-authenticator (TOTP) MFA, idle auto-lock, and short-inactivity auto-sign-out for shared or public devices. MFA and auto-lock only help if you turn them on. We strongly recommend enabling both on any shared device.

Question 6

How do I manage my signed-in devices?

Accepted Answer

The in-app Security Center lists active sessions and recent logins, flags new-device activity, and can remotely sign out this device, other devices, or all devices. Remote sign-out revokes future access; it doesn't retroactively erase content already viewed on a device before you signed it out.

Question 7

Why are some implementation details not public yet?

Accepted Answer

We're open about our digital-security posture — encryption, MFA, session control, abuse defenses, and privacy-by-design principles. Some implementation details are not public while patent protection is in progress. Certain mechanism details remain confidential during that process.

Frequently Asked Questions.

Be one of the first thousand.