How Brrro works.

You can sign in with Google, Apple where it is available, a phone number, an email address, or an existing linked device. Phone and email sign-ins use a six-digit verification code.

A new account chooses a username, display name, profile photo, and privacy choices. A returning account restores its protected session and secure messaging identity from the device.

One Brrro account can be used on more than one approved device. The Linked Devices screen shows the current phone, other connected devices, and waiting requests, and it can create a short-lived linking code for a new device.

The account holder must approve the request before a new device joins the signed device list. An unfamiliar or retired device can be denied or removed so it no longer participates in secure delivery.

With permission, Brrro reads your phone contacts, converts their numbers to a consistent international format, and asks the service which numbers belong to Brrro accounts. Matches become easy-to-find contacts; unmatched people can be invited by text message or through Android's share sheet.

Contact names and grouping stay on the phone. The service receives only the normalized numbers needed for matching, followed by the IDs of confirmed matches for your contact snapshot.

Messages from people who are not yet bros can be held in a separate request area instead of landing in your main inbox. You can preview a request when your privacy settings allow it, accept it into the inbox, decline it, or block the sender.

A privacy switch can make Brrro accept messages only from approved bros.

Direct chats use changing session keys, so the lock keeps moving as the conversation continues. Every linked device has its own secure identity rather than sharing one plain password.

Group messages use a protected group sender key, so one encrypted message can reach the group without turning the group into a collection of plaintext copies. Brrro distributes and recovers that key through each member's secure device relationship and verifies group state before processing messages.

Photos, videos, files, stories, and profile posts are encrypted with a fresh content key. Brrro then locks that key separately for every allowed recipient device and signs the result, so a changed or fake payload can be rejected.

Encrypted files can be cached on disk, but temporary readable copies are created only when needed for viewing and are removed after use or after a failed security check.

You start a group by choosing bros, then can add a group name and photo before creating it. Brrro keeps the selected members visible during setup and does not open the new chat until the service has accepted the group.

Owners or admins can add and remove members, change the admin, edit the group name and photo, transfer control before leaving, or leave the group. Every message still follows the group's encrypted delivery path.

A reply carries a small reference to the original message, so both people see what is being answered and can tap the quote to jump back. Groups also support mentions, and the mention travels inside the encrypted message.

Messages can receive quick emoji reactions, including a fast heart action and a larger picker. Brrro stores which user chose each reaction, shows combined counts, lets people inspect the details, and lets you tap your own reaction again to remove it.

Text and supported attachments can be forwarded to another person or group and are marked as forwarded. Forwarded content is not simply exposed to the next chat. It goes through that destination's normal encryption path again. An account privacy option can remove supported forwarding actions.

Brrro can show typing, voice-recording, listening, delivery, and read activity in real time. These signals travel over the live connection and disappear when they are no longer current.

Presence sharing and read receipts have separate controls, so you can share one without being forced to share the other.

Flow Chat is an optional, more live-feeling conversation mode. It can show that someone is in the chat, typing, recording, listening, holding the shared presence control, leaving, or sending an emoji burst, and it can colour-code the chat layout.

Both the global presence setting and the individual chat's Flow setting must allow sharing before ordinary Flow activity is sent.

Chats can be searched, pinned, marked read or unread, muted, archived, unarchived, or deleted with row actions. Filters show All, Unread, or Groups, and you can create custom chat lists for chosen conversations.

Hidden tabs and secondary areas do not start heavy loading until they are opened, which keeps the main inbox responsive.

The composer can use Android's photo library, a recent-media strip, Brrro's camera, a GIF or sticker search, or the file picker. Images, videos, and files get a review screen before sending, and several visual items can be sent together as an album.

Large items use an encrypted background upload that can resume after interruption and can be cancelled from the app.

Holding the microphone records a voice note with a live waveform; sliding cancels it and locking the gesture allows hands-free recording. Playback supports seeking and faster speeds.

The recording becomes an encrypted attachment before delivery, so the service receives protected audio rather than an open recording.

Elite and Gold users can change how their voice sounds in voice notes and live calls. Choose a subtle, balanced, or strong style, move the pitch from deep to light, and record a five-second local preview.

When masking is enabled, Brrro changes the outgoing sound on the device before the voice note is saved or the call audio is sent. The altered voice is what leaves the phone.

When a message contains a web address, Brrro can create a small title, description, and image preview. The preview can be dismissed before sending, and the resulting preview information travels with the encrypted message instead of being a public chat record.

You can send a contact card, a one-time location, or a live location. Live sharing can run from five minutes up to eight hours and refreshes the coordinates while active. Location details sit inside the encrypted message, and Brrro asks for Android location permission only when a location feature needs it.

The chat gallery collects ordinary shared photos, videos, GIFs, voice notes, and files in one place, where you can preview, download, forward, or delete an eligible item. View-once media is intentionally excluded so the gallery cannot become a second permanent copy.

Android's share sheet can send text, an image, a video, a file, or several items into Brrro. The pending share is stored in encrypted local storage and marked as requiring unlock before its contents or recipients are shown.

After unlock you can search, select one or several unblocked recipients, choose whether to open the chat afterwards, and send through each chat's normal encryption path. For a multi-item share, Brrro stages up to five attachments at once and can stream larger files from the source instead of keeping a readable full copy in memory.

Each chat has a details area for notification controls, disappearing messages, shared media, search, calls, encryption information, chat lock, safety number, blocking, reporting, deletion, and purge.

You can also choose a chat colour or background, add a private nickname, and write private notes. Nicknames and notes stay on that device and are never sent to the other person.

Messages and calls can be muted separately for an individual chat. A chat can also hide its preview or even hide its entire inbox row when chat-lock privacy is enabled, while keeping the protected conversation available after unlock.

A locked or muted chat can suppress its notification, replace its preview with generic text, and stay out of share-recipient results when the person is blocked.

A direct chat or group can have its own four-digit PIN in addition to the main app lock. The PIN is salted and repeatedly processed before storage, and the settings are kept in protected local storage.

Chat Lock can require an unlock to open the conversation, hide the last-message preview, and hide the row from the normal inbox.

Blocking prevents the selected account from using the normal contact and secure-message paths to reach you, and blocked people are removed from recipient pickers and search actions that would restart contact.

Reporting sends a reason and optional details to the service for review. Blocking can later be reversed from the dedicated Blocked Contacts screen.

On Android 14 and newer, Brrro also registers for the platform's screenshot-attempt signal without weakening the secure window. If Android or the phone maker still reports an attempt, Brrro immediately covers the whole app with a black, touch-blocking warning for three and a half seconds, and when a chat is open it sends that chat a live "captured the chat" presence event.

Some Android builds suppress the attempt signal precisely because the screenshot was already blocked, so the participant alert is best-effort. The screenshot block itself remains active.

On Android 15 and newer, Brrro watches whether its window is visible to screen recording or casting and keeps the black protection overlay in place while that condition lasts. The secure-window rules also apply on older supported versions even when Android cannot provide the newer recording callback.

Brrro also prevents Android from saving a readable preview of the app for the recent-apps screen, so swiping through recent apps should not reveal the last open chat, story, profile, or emergency setup page.

Release builds check for warning signs such as a rooted device, an unlocked bootloader, test system keys, a debug system build, or a missing secure-window flag before allowing the trusted app runtime to continue. If the environment looks compromised, Brrro blocks access rather than quietly opening sensitive content. A build can also use Google Play Integrity as an additional remote check.

Sessions, cryptographic identities, app-lock secrets, chat-lock settings, safety verifications, trusted contacts, emergency drafts, and other sensitive preferences are encrypted with keys held by Android Keystore. Each saved value has its own random protection and an authenticity check, so changed or unreadable protected data raises a security failure instead of being accepted. Ordinary visual preferences are stored separately from secrets.

The Android configuration excludes Brrro's files, databases, preferences, and external app data from cloud backup and device-to-device transfer, and network configuration refuses unencrypted web traffic. A private local session is never copied into general phone backups, and the app cannot silently fall back to an open connection.

Brrro supports direct and group audio or video calls. You can mute the microphone, turn the camera on or off, upgrade an audio call by enabling the camera, flip cameras, choose earpiece, speaker, or Bluetooth, inspect participants, minimise the call, and return through a floating overlay.

Group video uses a participant grid, while a direct video call can swap the main and small video views.

Call invitations, answers, declines, and coordination signals travel through the direct encrypted messaging relationship. A direct call creates a fresh media key and delivers it inside that protected signal; a group-call creator distributes the room key separately to the allowed members.

The live media layer uses that key for end-to-end protection and short-lived room credentials, so joining the media server alone is not enough to decode a call.

Android's call and foreground-service systems keep an active call alive when Brrro is in the background. Incoming calls can use a full-screen or high-priority notification with Accept and Decline actions, and the app connects the media only after the required microphone or camera permission is available.

If a connection drops, the call screen shows reconnecting or a clear retry state rather than pretending the call is still healthy.

The Calls area keeps a searchable history with All and Missed filters, direction, time, duration, and call-back actions. A new call can be started from a bro, by username or phone lookup, or from imported phone contacts, and people not on Brrro can be invited.

Call-history rows can be removed locally without deleting another person's history.

A story is an encrypted photo or video shared for twenty-four hours with selected bros. Brrro creates a protected copy for the chosen audience devices, shows active authors in the story tray, and restores a local snapshot quickly while fresh story information loads. Stories receive the same always-on screenshot and recording protection as the rest of the app.

A story can start from Brrro's camera or the Android gallery and can be a photo or a video of up to sixty seconds, with trimming when needed.

The editor supports crop and positioning, filters, brightness and exposure adjustments, drawing with several brushes, text styles, GIF stickers, location stickers, bro mentions, links, music, background choices, and movable, resizable elements. Brrro renders those edits into the protected media and keeps interactive link, mention, location, and music information inside the encrypted story payload.

A story can go to all bros or a hand-picked subset, and selected people can be excluded through "Hide Stories From." The same composer can route the finished item as a story or as an encrypted message, so you can make the audience decision at the end without recreating the media.

The viewer advances through an author's stories with tap and gesture controls, records a view, allows a like, and lets the viewer reply directly into an encrypted chat with a reference to the story. An owner can see viewers and which viewers liked the story, delete an active story, and open older stories from the private Story Archive.

The post composer creates photo and video posts with a caption and optional location. It can crop or trim the media and reuse the rich editor for filters, text, drawing, stickers, links, mentions, and music before queuing an encrypted upload. Posts appear on the author's profile and in the private bro feed, and the author can delete them.

Bros can like a post, double-tap media for a heart, or reply by sending an encrypted direct message that includes a reference to the post.

Story views, story likes, post likes, bro requests, and accepted requests appear in the social activity screen. Opening an activity item takes you to the related story, post, or profile, and activity rows can be marked read or deleted.

A profile owner can collect existing media posts into named Highlights that stay easy to find at the top of the profile. Highlights can be created, edited, reordered through their selected post order, or removed without deleting the original posts. Allowed viewers open the same encrypted post media they are already permitted to access.

You can hide your own stories from selected bros, mute another author's incoming stories, and mute another author's posts. These choices filter the feed and story tray on your account without blocking the person completely, and dedicated settings screens make hidden or muted authors visible again whenever you want to reverse the choice.

A message push primarily acts as a wake-up signal. Brrro restores the protected session, fetches the encrypted inbox, decrypts the new message on the phone, and only then builds the notification.

If previews are disabled, the chat is locked, or the lock screen needs a public version, the notification uses generic wording instead of exposing plaintext. Brrro also suppresses duplicate alerts and avoids notifying for the chat already open on screen.

Incoming calls have Accept and Decline actions, and message notifications can offer a reply action that hands the reply back to Brrro's normal encrypted sender before delivery.

Settings separately control message and activity alerts, call alerts, readable previews, the default or Brrro notification sound, the sound after sending, and the shake-to-report gesture.

A live authenticated connection carries new-message, receipt, typing, presence, and call events while the app is running. Local encrypted snapshots let chats and feeds appear quickly, while missed data is refreshed from the service.

Pending encrypted media uploads and eligible game scores are kept in queues, so an interrupted connection can continue later instead of silently losing the action.

A read-only Brrro conversation shows dated product messages explaining how Brrro works. New entries receive a New marker, opening the area marks the latest update seen, and the row can be hidden locally. You cannot accidentally reply to this system-only channel.

The Privacy and Security screen controls profile-photo sharing, search visibility, phone and email hiding, read receipts, presence, bro-only messages, and supported forwarding prevention.

It also shows that end-to-end encryption, secure display, and app-switcher hiding are active, rather than presenting them as optional switches that could be turned off accidentally.

Brrro includes launcher icons ranging from its regular hand and text designs to QR, calculator, weather, file-manager, finance, chess, and warning styles. Selecting one makes Android enable that launcher appearance and disable the previous one without reinstalling or restarting the private session.

It changes only the icon. It does not turn Brrro into the utility pictured by the icon.

Brrro ships with English and fifty-four bundled translation packs, and can follow the phone's language or use a language selected inside the app. The translations are stored with the app, so ordinary interface text never needs to be sent to a translation service.

Basic includes the core private messaging, calls, stories, and account privacy tools. Elite adds advanced safety and identity tools such as voice masking, Emergency Switch, Red Button, conversation purge, and decoy PINs. Gold includes everything in Elite and adds a visible supporter badge.

Android purchases and renewals are handled through Google Play, with restore-purchase support and a coupon path for eligible plans.

Organisations can request a dedicated Brrro service in their own cloud or on-site environment, and the same app can be pointed at that separate service for tighter infrastructure control.

People on a private server can communicate only with users who have access to that server, not the normal public Brrro network.

The About area shows the installed version, a feature walkthrough, Terms of Service, Privacy Policy, and Help and Support links. The service can require an important app update by placing a blocking update notice over an obsolete version and directing you to the approved update page.

Two intentional shakes open a "Found a bug?" prompt with a path to Brrro support. Requiring a double shake reduces accidental prompts from a single bump, and the gesture can be disabled in notification and in-app-sound settings.