BurnPony

Releases

• Nov 3, 2026 2.0.1
  # BurnPony 2.0.1 - UI improvements. - New store screenshots and store listings in all nine languages. 2.0.1 is the version going to Google Play and F-Droid, so users there get everything from 2.0.0 with it: double bottom and split key notes, scheduled opening, open immediately, defaults for new notes, and optional saved copies locked by the phone's secure hardware. The full notes are on the [2.0.0 release](https://github.com/norsehorse-dev/BurnPonyAndroid/releases/tag/v2.0.0). ## Verify this build Whole-file SHA-256 (is this download the published file):

  More…

  ``` 92a406f59c5a54bc6d08445ae432fe13ee6aecd0d7313189e30cadf77ade0672 ``` Content hash (for rebuilders; excludes signature, see REPRODUCIBLE_BUILDS_PLAYBOOK.md): ``` bbfb08c3f73d5d8f600f544501a1edf7f3d48df2fd360591fcb1b30c4fd66468 ``` The APK is signed with the NorseHorse release key (certificate SHA-256 `054eefe6e5d8fd7eb05825e68eea33b0a2c2d58f1b80af05f7562534c8183866`); the detached signature is attached to this release.
• Nov 2, 2026 2.0.0
  # BurnPony 2.0.0 ## Two new kinds of note **Double bottom.** One link, up to three compartments, each opened by its own passphrase. Whoever gets one passphrase sees only that compartment. The envelope is a fixed size with random fill, so nothing in it shows how many compartments are real. These notes always allow at least two views, so one compartment can be opened under pressure and another later. **Split key.** The note opens only when enough key links are combined in the viewer, for example any 2 of 3. The key is split on your device with Shamir's secret sharing, and each key link can carry its own passphrase. The recipient's browser rebuilds the key; the server never sees it. ## Scheduled opening

  More…

  A note can be set to become available at a later time. Until then the server answers exactly as it does for a note that never existed, and no view is used. ## Open immediately A new per-note option skips the confirmation screen, so the note opens on the first visit to the link. It is off on every note by default, and the option explains why: some email scanners and link previews visit links automatically and can burn a note before the recipient sees it. With a passphrase or a double-bottom note, the view is used as soon as the link opens. It cannot be combined with a read receipt, because the recipient has to be told about the receipt before the note opens. ## Defaults for new notes Settings has a new section for the options new notes start with: views, expiry, auto-hide, discourage copying, and read receipt. Changing an option on one note no longer changes these defaults. Passphrases are never saved. ## Saved copies Off by default. Turn it on in Settings, then switch on "Keep a copy on this device" for each note you want to keep. The switch starts off on every note. Each copy is encrypted to an RSA key held in the Android Keystore (StrongBox where the phone has it), wrapping a fresh AES-256-GCM key per copy. Saving uses only the public key and never prompts. Opening needs the private key, and the Keystore only uses it after your fingerprint, face or screen lock, so a copy cannot be read without unlocking, even by the app itself. The key never leaves the phone and the app does not allow backups. While a copy is on screen, screenshots are blocked. Double bottom notes are never saved: a copy on your phone would prove the hidden compartment exists. Copies can be deleted one at a time, all at once when you turn the setting off, or automatically after 7, 30 or 90 days. Clear Inactive keeps notes that have a copy. The privacy policy has a new Saved copies section describing this. ## Also in this release - The Tor and proxy settings from 1.4.0 are now translated into all eight languages. - Instant open, saved copies and default send options were suggested by a user. ## For self-hosters Double bottom and split notes need the 2.0 viewer and composer from the server repository. Open immediately also needs the current viewer; an older viewer ignores the flag and shows the normal confirmation screen. Scheduled opening needs the `note_schedules` table, created as the admin database user before the new code goes live. ## Verify this build Whole-file SHA-256 (is this download the published file): ``` c13d216ad68e91157ea3e102d01cd57b57f0bf244d07b1cd4efaf1047d639dd2 ``` Content hash (for rebuilders; excludes signature, see REPRODUCIBLE_BUILDS_PLAYBOOK.md): ``` 9807c5a48b26b2246b29de5e11a1cff84259fec8f1ddeb64cddd040e1b8cf0cc ``` The APK is signed with the NorseHorse release key (certificate SHA-256 `054eefe6e5d8fd7eb05825e68eea33b0a2c2d58f1b80af05f7562534c8183866`); the detached signature is attached to this release.
• Aug 25, 2026 1.4.0
  # BurnPony 1.4.0 ## Route BurnPony through Tor or a SOCKS5 proxy Settings has a new Proxy section. Choose Off, Orbot for one-tap Tor, or a custom SOCKS5 host and port. When a proxy is on, every relay request goes through it: creating a note, checking status, burning, changing expiry, and push registration. The destination is resolved by the proxy rather than on the device, so the relay hostname does not reach your local resolver while a proxy is active. When a proxy is enabled and unreachable, requests fail instead of quietly falling back to a direct connection. There is no silent direct path. ## Stream isolation

  More…

  The Proxy section takes an optional username and password. With Tor, any pair puts BurnPony on its own circuit, separate from other apps sharing Orbot (Tor's IsolateSOCKSAuth). For a SOCKS5 proxy that requires a login, use its credentials. The SOCKS5 client is BurnPony's own, so it offers exactly the method in use and sends the destination as a domain name for proxy-side resolution. The username and password path is verified against Tor. It has not been exercised against a third-party authenticated SOCKS5 proxy, which uses the same handshake. ## For F-Droid This is the first release published to F-Droid since 1.0.1. It also carries the accessibility, language, and reliability work from the versions in between. ## Verify this build Whole-file SHA-256 (is this download the published file): ``` 2995fe5109326478d54a20a6dc603c77e2ed6833dcac4cde53aa4221767d3852 ``` Content hash (for rebuilders; excludes signature, see REPRODUCIBLE_BUILDS_PLAYBOOK.md): ``` 7b046211a530d87e46cc0701633dc898f528a0ccac9cb04bdf4c45295f33d180 ``` The APK is signed with the NorseHorse release key; the detached signature is attached to this release.
• Aug 1, 2026 1.0.1