The answers, including
the awkward ones.

No — and not in the sense that we have a policy against it. Your vault key is derived from your passphrase with Argon2id inside your own session, and it only wraps a separate key for each conversation, document and project. Prompts leave your machine already encrypted to a key published inside the inference enclave's attestation quote, which your app verifies before it sends anything. There is no point in the path where we hold a key that opens your data.

There is nothing to train on. We hold ciphertext we cannot open, and inference runs inside an enclave that does not retain what it sees. No corpus, no fine-tune, no “to improve our services” clause doing quiet work in the background.

You lose everything, permanently, and we cannot help you. That is not a gap in the product — it is the product. A recovery path is by definition a way in that does not need your passphrase, and anything that works for you works for anyone who can compel us. Write it down and keep the paper somewhere sensible.

No email, no phone number, no username. Your identity is a keypair generated on your machine. If you buy a plan our payment processor will have an email address to send a receipt to, and that address is never linked to a vault, a conversation or a key — it cannot be, because we do not know which vault is yours.

Your vault is on your own disk, encrypted with your own key, and the app opens it offline. Sync and the relay are conveniences, not dependencies. The relay itself is one docker compose command you can run yourself, and its build reproduces from source byte for byte so you can check the image is the code. The receipt verifier is a client-side signature check that works from a saved copy of the page.

Because you are not the other product. Confidential hardware is scarcer and slower to schedule than commodity GPUs, so an attested turn costs materially more to serve. And there is no second revenue line — no ads, no training data, no partnerships — so the subscription has to cover the whole thing. A cheaper subscription elsewhere is being subsidised by something; it is worth knowing by what.

No, deliberately. Your own key means the model runs somewhere we cannot attest, with no enclave signature and no receipt — which removes the only reason to be here. It also re-introduces the identity anchor we spent the architecture removing, because a billing account is a real name. Bring-your-own keys are supported for data providers — markets, weather, news — since those are tool traffic, already itemised in the egress ledger, and never attested.

No, and it is not on the roadmap. Single sign-on makes your identity provider the thing that knows who uses burnbox and when. Half the point of this product is that no such thing exists anywhere.

Fourteen days, no questions, no exit interview. Cancel inside the app. Your vault stays readable offline forever — it is your disk and your key — and only attested inference stops.

Only if you paid us, and then only because the payment processor needs somewhere to send an invoice. It is not linked to a vault, a conversation, a key or a device, and it is not used to identify you inside the product, because inside the product there is nothing to identify you against.

macOS today. iOS is in active development and is a first-class target rather than an afterthought port — the Rust core and the React front end were built to move. Windows and Linux are honest maybes; we would rather ship two platforms properly than four badly.

Attested open-weight models inside Intel TDX enclaves, offered as Fast, Thinking and Auto tiers. The roster is chosen on what will actually attest and sign: we have removed models that turned out not to be what the roster claimed, and quarantined one that leaked. A menu entry here has to survive a signature check, not a marketing check.

The parts that have to be verifiable are. The relay builds reproducibly from source and is meant to be self-hosted; the receipt verifier runs entirely in your browser where you can read it; the receipt format is documented so a third party can check one without our code. The desktop app is not public yet.

Two doors. Buy a plan, or take an invite from someone already inside. Invites are unlimited and registered nowhere — enforcing a cap would mean the relay counting redemptions, which means the relay learning who invited whom, which is a social graph. So an invite is a capability, not a record: it cannot be counted and it cannot be revoked, because the mechanism that would allow either is the mechanism we refuse.

Yes — that is what the Scorched Earth tier is for: pooled allowance, group threads and shared drops, and your own relay, which we will either help you run or run dedicated for you. Talk to us at hello@burnbox.ai.