Core Protections

Built-in security for every conversation

Every security feature listed below is enabled by default. You do not need to configure anything — your protection begins the moment you create an account.

End-to-End Encryption

Every message, photo, voice note, and file is encrypted on your device before it is transmitted. Only you and the intended recipient possess the keys required to decrypt and read the content. BongoChat servers relay encrypted ciphertext but cannot decrypt it — this is guaranteed by the cryptographic design, not by policy alone.

Signal Protocol Curve25519 AES-256-CBC

Biometric App Lock

Add an extra layer of physical security to BongoChat. Lock the entire app with your fingerprint, Face ID, or a custom PIN — so even if someone gains physical access to your unlocked phone, they cannot open your chats, view your contacts, or access any of your data. The biometric lock activates automatically after a configurable inactivity period.

Disappearing Messages

Enable auto-delete for sensitive conversations by setting a timer — choose from 5 seconds to 1 week. Once a message is read and the timer expires, it is cryptographically erased from both your device and the recipient's device. Deleted messages are overwritten at the storage level and cannot be recovered by anyone, including BongoChat.

Encrypted Voice & Video Calls

Every voice and video call on BongoChat is protected with the same end-to-end encryption as your text messages. Audio and video streams are encrypted in real time using SRTP (Secure Real-Time Transport Protocol). Call metadata (who you called, when, and for how long) is temporarily logged but is not linked to the content of your conversation. Group calls support up to 50 participants with full E2EE.

Verified Identity & Safety Numbers

Every account is verified via SMS or phone call to ensure authenticity and reduce spam. Additionally, each conversation has a unique "Safety Number" — a fingerprint that you and your contact can verify out-of-band (in person or via another channel) to confirm that no man-in-the-middle attack has occurred. If a Safety Number changes, BongoChat will notify you immediately.

Data Minimization

We collect only what is strictly necessary to operate the service. Your chat messages, voice calls, video calls, and shared files are never stored on our servers — they exist only on the sender's and recipient's devices. We do not build advertising profiles, do not serve targeted ads, and do not sell your data to any third party, ever. IP addresses are temporarily logged and purged within 90 days.

Your Device

Encrypted on device

Plaintext → AES-256-CBC → Ciphertext

BongoChat Server (relay only)

a7#k9$z1...xQ2! — unreadable

Decrypted on recipient

"Hello!" — readable only here

Recipient's Device

How it works

What End-to-End Encryption really means

When you send a message on BongoChat, it is encrypted into an unreadable format on your device using the recipient's public key. It travels through our servers as ciphertext and is only decrypted when it arrives on the intended recipient's device using their private key — which never leaves their device.

Keys never leave your device

Your private encryption key is generated on your device and is never transmitted to our servers. BongoChat does not possess a copy of your keys, making it mathematically impossible for us to decrypt your communications — even if compelled by any authority.
Protection from server breaches

Even if BongoChat's servers were compromised, the attacker would only find encrypted ciphertext — the data would remain unreadable without the private keys that exist only on users' personal devices.
Forward secrecy

BongoChat uses the Double Ratchet Algorithm, which generates a new encryption key for every message. If a single key is compromised, only that specific message — not past or future messages — can be decrypted.
Applies to everything

Text messages, group chats, voice notes, file transfers, voice calls, and video calls are all protected by default. There is no way to disable end-to-end encryption on BongoChat.

Account Security

Multi-layered protection for your account

Beyond encryption, BongoChat provides multiple layers of account security to ensure that only you have access to your profile, contacts, and conversations.

Two-Step Verification (2FA)

Add a custom 6-digit PIN to your account registration process. After verifying your phone number via SMS, you will be asked for this PIN before you can access your account on a new device. This means that even if someone obtains your SIM card, they cannot register your BongoChat account without the PIN.

Optional but strongly recommended

Linked Device Management

View and manage all devices currently linked to your BongoChat account. You can see the device model, last active time, and IP address of each linked session. If you notice any unrecognized device, you can instantly log it out with a single tap. BongoChat supports linking up to 4 companion devices (desktop, tablet, etc.) simultaneously.

Real-time session visibility

Remote Logout

Lost your phone? Had your device stolen? You can remotely log out of BongoChat on any device by contacting our support team with your registered phone number and verifying your identity. Once confirmed, all active sessions will be terminated immediately, and the device will be deregistered from our system.

Contact support or email [email protected]

Login Notifications

BongoChat notifies you immediately whenever your account is registered or accessed on a new device. This alert includes the device model, location (when available), and timestamp. If you receive a login notification for a device you do not recognize, you should change your 2FA PIN and contact support immediately.

Push notification + in-app alert

Block, Report & Restrict

You have full control over who can contact you. Block any user to prevent them from sending you messages, calling you, or seeing your profile. You can also report accounts that violate our community guidelines. Our trust and safety team reviews all reports and takes appropriate action, which may include warnings, temporary suspension, or permanent removal.

Instant blocking, no notification sent to the blocked user

Safety Number Verification

Every one-on-one chat has a unique 60-digit Safety Number (or QR code) derived from the public keys of both participants. You can verify this number by comparing it with your contact in person or through a trusted out-of-band channel. If a Safety Number changes at any point — for example, if a contact reinstalls BongoChat — you will receive an immediate in-chat warning.

Detects man-in-the-middle attacks

Technical Architecture

How we protect your data at every layer

Security at BongoChat is not a single feature — it is a multi-layered system designed to protect your data at the application, transport, and infrastructure levels.

Application Layer

End-to-end encryption via Signal Protocol (X3DH key exchange + Double Ratchet)
Curve25519 for key agreement, AES-256-CBC for message encryption
HMAC-SHA256 for message authentication and integrity
Secure random number generation using system-level CSPRNG
Local database encrypted with SQLCipher on Android and iOS Keychain / Data Protection on iOS

Transport Layer

TLS 1.3 for all client-server communications
Certificate pinning to prevent man-in-the-middle attacks on the transport layer
HSTS (HTTP Strict Transport Security) enforced on all web endpoints
SRTP for encrypted voice and video call media streams
Perfect Forward Secrecy (PFS) via Diffie-Hellman ephemeral key exchange

Infrastructure Layer

Servers hosted in Bangladesh-based or approved data centers with 24/7 physical security
AES-256 encryption for all data at rest on servers
Role-based access control (RBAC) — only authorized engineers with business need can access production systems
Automated security scanning, vulnerability patching, and dependency updates
DDoS mitigation, WAF (Web Application Firewall), and rate limiting

Encryption at a Glance

Data Type	In Transit	At Rest (Device)	At Rest (Server)
Chat Messages	E2EE (Signal)	SQLCipher / Keychain	Not stored
Voice & Video Calls	E2EE (SRTP)	Not stored	Not stored
Shared Files & Media	E2EE (Signal)	SQLCipher / Keychain	Not stored
Moments & Stories	TLS 1.3	SQLCipher / Keychain	AES-256
Account Profile Data	TLS 1.3	SQLCipher / Keychain	AES-256

Responsible Disclosure

Help us keep BongoChat secure

We believe in transparency and actively encourage the security research community to help us identify and resolve vulnerabilities before they can be exploited. If you discover a security issue in BongoChat, we ask that you report it responsibly so that we can address it promptly and protect our users.

Report the vulnerability to [email protected] with a detailed description, steps to reproduce, and potential impact.

Do not publicly disclose the vulnerability until we have resolved it and notified affected users. We commit to responding within 3 business days and resolving critical issues within 7 days.

Eligible researchers who follow our guidelines may receive public acknowledgment on our security page and BongoChat-branded merchandise as a token of our appreciation.

Our Security Commitments

3-Day Response

We acknowledge all vulnerability reports within 3 business days.

7-Day Critical Fix

Critical vulnerabilities are patched and deployed within 7 days.

Researcher Recognition

Qualifying researchers receive public credit and BongoChat merchandise.

No Legal Action

We will not pursue legal action against researchers who follow our responsible disclosure guidelines in good faith.

Regular Audits

We conduct periodic third-party penetration testing and code audits to proactively identify weaknesses.

Transparency

Common security questions

Can BongoChat read my messages?

No. With end-to-end encryption, messages are encrypted on your device using the recipient's public key and can only be decrypted using the recipient's private key, which never leaves their device. BongoChat does not hold a copy of any private keys. This means it is technically impossible — not just against our policy, but mathematically impossible — for BongoChat to read your messages, even if we wanted to or were legally compelled to do so.

Does BongoChat share my data with third parties?

We do not sell, trade, or rent your personal information to anyone, ever. We share limited data only with carefully vetted service providers who help us operate the app (such as push notification services and cloud hosting), and only under strict contractual obligations that prohibit them from using your data for their own purposes. We do not use third-party advertising platforms, tracking networks, or analytics providers that share data externally.

What happens if I lose my phone?

If you have Biometric App Lock enabled, no one can open BongoChat on your phone without your fingerprint, Face ID, or PIN. To protect your account remotely, contact our support team at [email protected] or [email protected] with your registered phone number. After verifying your identity, we will immediately terminate all active sessions on all devices. When you get a new phone, you can reinstall BongoChat and register with the same phone number to restore your contacts (your chat history will only be available if you had enabled backups, which are also encrypted).

Are my Moments and Stories also end-to-end encrypted?

Moments and Stories are social features designed for public or follower-based sharing, so they require server-side hosting to be visible to your audience. They are protected with TLS 1.3 in transit and AES-256 encryption at rest on our servers, but they are not end-to-end encrypted because the content must be accessible to your followers. Only your private one-on-one chats, group chats, and calls are protected with end-to-end encryption. You have full control over who can see your Moments and Stories through your privacy settings.

What encryption protocol does BongoChat use?

BongoChat uses the Signal Protocol for end-to-end encrypted messaging — the same cryptographic protocol used by Signal, WhatsApp, and other security-focused platforms. Specifically, we use X3DH (Extended Triple Diffie-Hellman) for key exchange, the Double Ratchet Algorithm for forward secrecy, Curve25519 for elliptic curve key agreement, AES-256-CBC for message encryption, and HMAC-SHA256 for message authentication. Voice and video calls use SRTP (Secure Real-Time Transport Protocol) for real-time media encryption.

Can the government or law enforcement access my messages?

Because of end-to-end encryption, BongoChat cannot provide the content of your encrypted communications to any government, law enforcement agency, or third party — we simply do not possess the decryption keys and the data is not stored on our servers. In the event of a lawful data request, we can only provide the limited metadata described in our Privacy Policy (such as account registration date and last login time). We challenge overbroad or vague requests, notify users when legally permissible, and publish an annual transparency report detailing the number and nature of government requests we receive.

How do I verify that my conversation is secure?

Every one-on-one conversation on BongoChat has a unique Safety Number (a 60-digit fingerprint derived from the public encryption keys of both participants). To verify, go to the chat → tap the contact's name → view the Safety Number. You and your contact can compare this number in person, or scan each other's QR codes. If the numbers match, the conversation is secure and no man-in-the-middle attack has occurred. BongoChat will also notify you if a contact's Safety Number changes for any reason.

Does BongoChat have access to my contacts?

BongoChat needs access to your phone contacts to help you find friends who are already on the platform. When you grant contact permission, your contacts are processed entirely on your device. We upload cryptographic hashes (one-way hashed phone numbers), not the actual phone numbers or names, to our servers to match against other registered users. Your contact list is never uploaded in plain text, and we do not store your contacts' names or email addresses. You can revoke this permission at any time in your device settings.

What is forward secrecy and why does it matter?

Forward secrecy (also called perfect forward secrecy) is a property of the Double Ratchet Algorithm used by BongoChat. It means that a new encryption key is generated for every single message you send. If an encryption key is somehow compromised at any point, only the specific message encrypted with that key can be decrypted — all previous and future messages remain secure because they were encrypted with different keys. This ensures that even if your device is compromised today, your past conversations cannot be retroactively decrypted.

How does BongoChat handle security vulnerabilities?

We take a proactive approach to security. BongoChat conducts regular third-party penetration testing and code audits, runs automated vulnerability scanning in our CI/CD pipeline, and maintains a bug bounty program for responsible disclosure. Critical vulnerabilities are patched and deployed within 7 days of confirmation. We also maintain a comprehensive data breach response plan and will notify affected users and the relevant authority without undue delay as required by the Personal Data Protection Act 2023 of Bangladesh.

Can I completely delete my data from BongoChat?

Yes. You can delete your account at any time via Settings → Account → Delete Account, or by submitting a formal request through our Data Deletion Form. Upon deletion, your account is immediately deactivated. Within 30 days, all your personal data — including your profile, contacts, and all account information — is permanently and irreversibly erased from our active systems and backups. Your chat messages were never on our servers to begin with, so there is nothing to delete there. This process complies with your right to erasure under the Personal Data Protection Act 2023 of Bangladesh.

Your privacy is non-negotiable