Security

Buzzio does not require a phone number or email to create an account. There is no SMS OTP. Your account is a random 12-digit Buzzio ID plus a 12-word recovery phrase generated on your device.

• Buzzio ID is a random address (shown with dashes, for example 123-456-789-012). It is not derived from your recovery phrase.
• Optional @username is 5–32 characters (a–z, 0–9, underscore only). It is not a phone number.
• Sealed 1-to-1 delivery uses sealed-sender style envelopes so the durable outer envelope does not carry a plaintext sender field for operators to browse.
• Delivery systems may still learn a sender when checking certificates for blocks, rate limits, or freemium rules — this is not Tor-style anonymity.

Protect who can see your Buzzio ID, username, photo, bio, and last seen in Privacy check before you share your ID widely.

What the 12-word phrase protects

Messaging keys are derived on-device from your 12-word recovery phrase. Buzzio never receives that phrase or your private messaging keys.

• New device sign-in needs Buzzio ID + the 12-word phrase. That restores identity and keys.
• The phrase is not the same as the backup recovery key. The backup key unlocks an encrypted history blob you chose to save.
• If you lose every device and the phrase, and you have no unlockable backup, private keys and sealed history cannot be rebuilt. That is intentional.
• An optional non-custodial wallet may share the same phrase on another derivation path — treat the phrase as messaging and funds master key.
• App lock PIN or biometrics is extra device protection. Forgetting a PIN does not recover the phrase.

How to protect your seed

• Write the phrase offline. Store it somewhere only you control.
• Never email it, message it, or paste it into a website that claims to be Buzzio.
• Never enter the phrase on web.buzzio.dev — the web companion does not accept recovery phrases and does not hold messaging keys.
• Do not share screenshots of the phrase or backup recovery key.

Encrypted backup (optional)

Default is no Buzzio-readable private cloud inbox. If you enable backup, blobs are encrypted and unlock with a recovery key you control.

• Free backup is limited (text-focused, about 100 MB lifetime).
• Premium backup is larger (about 100 GB/year). After Premium ends, blobs are kept about 60 days, then removed.
• Temporary groups and Whisper private sessions are not in private backup scope.

Privacy section surfaces are sealed: 1-to-1 chat, E2E groups, Whisper private chat, and private calls. Feature mode shared rooms (open-history groups, Communities, Broadcast) are useful with honest lower privacy.

• On sealed surfaces, Buzzio is designed so staff cannot read message or call contents as plaintext.
• Private readable history lives in an encrypted local database on your phones (SQLCipher). Uninstall removes that local copy.
• Delete-on-delivery for private 1-to-1: the relay copy is removed when the recipient takes delivery. Undelivered envelopes are purged on a short schedule (about 3 days).
• “Zero metadata” is scoped: when nothing remains undelivered on a private 1-to-1 chat, Buzzio aims not to keep a durable who-talked-to-whom archive for that chat. It does not mean Buzzio stores zero data overall.
• Account identity, push tokens, blocks/reports, and shared-room history still exist where the product needs them.

“We can’t read sealed chats” is not the same as “shared rooms store nothing.”

Block someone

Blocking stops ongoing private contact, delivery, and calling on that relationship. It is separate from reporting — you can do both when the app offers both.

1. Open Privacy → Block contacts / Blocked users.
2. Add the person you want to block, or block from their profile or chat actions when available.
3. Unblock later from the same blocked list if you change your mind.

Report a person

Use Report from a chat, profile, or space when someone breaks the rules. Choose a reason such as:

• Spam
• Harassment or bullying
• Hate speech
• Inappropriate content
• Impersonation
• Scam or fraud
• Other

The report flow may attach about the last 5 local messages as evidence. Use report for abuse — not ordinary disagreements.

Report shared spaces

• You can report a community, community channel, group, or broadcast channel.
• On Whisper Questions web answer pages, open Report if a question link is abusive.
• Community admins can ban members, delete messages where allowed, pin messages, lock or password-protect channels, manage roles, and review an Audit Log.

Bug reports vs abuse vs security vulns

• Report a Bug (Help & Feedback) is for app problems.
• Report on people or spaces is for safety and rule breaking.
• Security vulnerabilities: email security@buzzio.dev with subject Security Report. Never send recovery phrases, backup keys, session tokens, or private keys. Do not post findings on the public Forum.

What web can do

web.buzzio.dev is a linked web companion for shared rooms only. It is not a full web client for sealed private messaging.

• Permanent open-history groups
• Communities
• Broadcast channels
• Service bot DMs (bot scope)

What web never does

• Sealed 1-to-1 chat
• E2E groups
• Whisper private chat
• Encrypted calls
• Private Vault
• Recovery phrase entry or messaging keys in the browser
• Any claim of browser end-to-end encryption for sealed chat

How linking works

1. The browser starts a link challenge and shows a QR code.
2. You scan with the phone, choose a session duration, and approve.
3. A confirm QR binds the same browser.
4. You get an opaque session token once; the server stores a hash, not the raw token.
5. Revoke anytime from the phone. A new link replaces the previous one — one active web session.

• Freemium durations are typically 1h, 6h, 12h, 1d, 3d, 7d. Premium may unlock 14d.
• Shared rooms on web use TLS in transit. Content in those rooms is readable by Buzzio — not E2E.
• Linking does not log out the phone or replace exclusive device login for sealed chat.

Treat web.buzzio.dev like a shared-room desk: useful, phone-approved, time-boxed, and revocable — never a place for your seed phrase.

• Install only from Google Play or the official Buzzio APK links on this site. Account and wallet security depend on a genuine build.
• Protect the 12-word phrase first. Everything else is secondary.
• Use Privacy check to tighten who can see your ID, username, photo, bio, and last seen.
• Use app lock (PIN or biometrics) if other people can unlock your phone.
• Mute or leave shared rooms you do not trust — shared history is readable by design.
• Age: 13+ for the app. Wallet features: 18+.
• Buzzio does not sell your messages, metadata, or IDs.
• No third-party security audit has been published yet. Bug bounty is not offered yet.
• If you are in immediate danger offline, contact local emergency services — the app is not a substitute.

Email security@buzzio.dev with subject Security Report. Include steps to reproduce and impact.

• Never send recovery phrases, backup keys, session tokens, or private keys.
• Do not post security findings on the public Forum.
• Product bugs and ideas (non-security): forum.buzzio.dev.
• General or privacy contact: founder@buzzio.dev.

Educational open crypto is published for review. It is not a completed formal audit report. When an audit is published, we will link it here and in the docs.