The AI that forgets
on command.
Your work lives in an encrypted vault on your own machine. The model runs inside hardware that cannot keep what it sees. And every deletion hands you a signed receipt — one that anyone can check, without our servers, our app, or our permission.
No account · No email · No phone number · No telemetry
Three documents, one theme. Two of them carry an author field and a revision history in the file metadata; one photograph has GPS coordinates within 40 m of a residential address.
I have not sent any of that. Say the word and I will strip all three before anything leaves this machine.
Checked in your browser. No server, no account, no app.
Five steps, and a refusal at every one of them.
Hover to hold a step, or click one to pin it. Each stage names the thing that would go wrong there — and what happens instead.
You type. Nothing has left.
The composer writes straight into an encrypted vault on your own disk, under a key derived from your passphrase with Argon2id that never leaves the session.
If you never press send, it never existed anywhere else.
- 01You type. Nothing has left.
The composer writes straight into an encrypted vault on your own disk, under a key derived from your passphrase with Argon2id that never leaves the session.
- 02The hardware is checked before it is trusted.
Your app fetches the enclave's Intel TDX quote and verifies it here: the DCAP chain is checked to the Intel root, and report_data must bind a nonce generated for this fetch.
- 03Only then is the prompt encrypted.
Sealed on your machine to an X25519 key published inside that quote-bound keyset — so it can only be opened by the exact enclave you just verified.
- 04It comes back saying where it was served.
The response carries a signed envelope naming the host that produced it. The Signed badge opens into the raw quote, the measurement, and the model that actually answered.
- 05The key dies and the receipt is signed.
Destroying the data-encryption key turns the remaining ciphertext into noise. An Ed25519 signature over the hash of what was destroyed goes into a file you keep.
Every other AI company wrote you a promise.
We wrote a constraint.
A promise is a sentence in a policy document, and policy documents have an edit history. A constraint is a thing that stops being possible. Here is what burnbox is architecturally incapable of — the list we are proudest of.
- Cannot
Read your conversations.
Your vault key is derived from your passphrase with Argon2id, inside your own session, and it only ever wraps a separate key for each conversation, document and project. We do not hold it, cannot derive it, and cannot be made to produce it.
- Cannot
Hand over your history.
What our relay stores is ciphertext and opaque tokens. A legal request gets exactly that, along with a short letter explaining why it will not be useful. You can also just run the relay yourself and remove us from the sentence.
- Cannot
Train on you.
Inference happens inside an Intel TDX enclave whose measurement your app verifies before it encrypts anything to it. There is no corpus with your name in it, because there is no corpus.
- Cannot
Know who you are.
No email, no phone number, no account. Your identity is a keypair you generated on your own machine, and if you would rather not have one any more, you can burn it.
- Cannot
Un-burn anything.
A burn destroys the key, not the row — the ciphertext that remains is noise. There is no undo, no thirty-day grace period, and no Recently Deleted folder we forgot to mention in the marketing.
- Cannot
Change the story afterwards.
Every burn signs a receipt and every response records which enclave answered. You keep both. We cannot revise a signature that is already in your hands.
- Cannot
Leak the GPS in your photograph.
EXIF and GPS, document authors, company names, tracked changes — stripped on your machine before anything leaves it, rather than apologised for after it arrives.
- Cannot
Quietly send your prompt somewhere else.
Your prompt is sealed to a key published inside the enclave's own attestation quote. Anything that is not that enclave receives ciphertext it cannot open. A mis-route fails instead of leaking.
None of that is generosity. It is the consequence of where the keys live — and it is the only kind of privacy that survives a change of ownership, a bad quarter, or a subpoena.
Deletion should be a ceremony that leaves evidence.
Not a spinner that leaves hope.
Everywhere else, deleteis a state in a user interface. Here it is a cryptographic event. Pick any of the twelve below and run it — the panel becomes that mode’s real ceremony.
The three files are from the same handset — same author field, samerevision chain. One of the photographs still carries GPS within 40 mof a residential address in Fitzroy. I have not sent any of that anywhere. Say the word and I will stripall three before anything leaves this machine.
Panic phrase. Duress vault. Dead-man switch. Geofence burn. TOTP gate. Ghost chats. Every anti-coercion feature ships in every plan, because the moment a defence sits behind an upgrade prompt it has failed the only person who needed it.
Copies you made yourself. A screenshot, an exported file, a backup taken before the burn. burnbox destroys what it holds and cleans what it can reach; it does not claim to reach into a photograph of your screen, and it says so in the app rather than in a footnote.
They can compel a passphrase. They cannot compel what is gone.
Cross with a machine that has nothing on it. A geofence can burn the armed material as you approach; a duress passphrase opens a plausible decoy and wipes the real vault on the device, with no network call — because a round-trip under coercion is itself a signal.
Geofence burn · duress vault · device-only
Three things you can check without taking our word for any of it.
Trust is an architecture, not a disclaimer. Each of these produces an artefact you keep, and each one is checkable by someone who has never heard of us.
The receipt
An Ed25519 signature over the hash of what was destroyed, counter-signed by an attested proxy running in its own enclave. Paste one into a page that does the check in your browser and talks to nothing.
Verify one nowThe route
Every response carries a signed envelope naming the enclave that served it. The Signed badge expands into the raw Intel TDX quote, its measurement, and the model that actually answered — not the model a menu claimed.
How a prompt travelsThe egress ledger
A live, per-conversation record of every byte that left: which tool, where to, how much. It stores no plaintext and keeps its summaries location-safe, so the audit log can never become the leak it exists to prevent.
What gets recordedPrivacy that costs you the tools is not privacy. It is abstinence.
The trade everyone expects to make here is capability for confidentiality. We would rather not make it — so here are four more surfaces, at the smallest size that still tells the truth about them.
Chat
Streaming conversations that keep running while you switch surfaces. Branch, fork, retry, edit, stop.
Cowork
A long-running autonomous agent with a live plan, parallel sub-agents, budgets, checkpoints and undo.
Document vault
PDFs, Office files, images, notes — each under its own key, its own lifetime, its own burn.
Meetings
Recording and transcription entirely on device. Audio never crosses the app boundary, never touches disk.
Dictation
Speak into any field, anywhere in the app, with self-correcting streaming transcription.
Cockpit
Live widgets and dashboards — markets, weather, news, your own feeds — pinned, refreshing, burnable.
Messaging
1:1 and small-group threads, end-to-end encrypted, disappearing by default, with safety numbers.
Skills
Import, author and publish reusable skills. Skill Forge researches, drafts, evaluates and refines them for you.
Deliverables
Reports with charts, spreadsheets and decks, produced in the vault rather than in someone else's cloud.
Insurance file
A sealed file held by the relay and released only if your check-ins stop — the “if something happens to me” primitive, with the check-in schedule managed for you.
Sync
Zero-knowledge sync between your own devices, paired with a QR code. Remote burns propagate as tombstones.
Regret a conversation that no longer exists.
burnbox is in private beta on macOS. Buy a plan and you are in today; or get an invite from someone already inside — invites are unlimited, uncounted, and registered nowhere.