diff --git a/app/src/main/java/com/greenart7c3/nostrsigner/service/BunkerRequestUtils.kt b/app/src/main/java/com/greenart7c3/nostrsigner/service/BunkerRequestUtils.kt
index 482a82cc..b329f01e 100644
--- a/app/src/main/java/com/greenart7c3/nostrsigner/service/BunkerRequestUtils.kt
+++ b/app/src/main/java/com/greenart7c3/nostrsigner/service/BunkerRequestUtils.kt
@@ -105,13 +105,16 @@ object BunkerRequestUtils {
         }
 
         Amber.instance.applicationIOScope.launch {
+            // Never persist the response result — for a decrypt request it is the
+            // plaintext. Record only non-sensitive metadata (id + error status).
+            val sanitizedResponse = "id=${bunkerResponse.id} ${bunkerResponse.error?.let { "error=$it" } ?: "ok"}"
             relays.forEach { relay ->
                 Amber.instance.getLogDatabase(account.npub).dao().insertLog(
                     LogEntity(
                         id = 0,
                         url = relay.url,
                         type = "bunker response",
-                        message = JacksonMapper.mapper.writeValueAsString(bunkerResponse),
+                        message = sanitizedResponse,
                         time = System.currentTimeMillis(),
                     ),
                 )
diff --git a/app/src/main/java/com/greenart7c3/nostrsigner/service/EventNotificationConsumer.kt b/app/src/main/java/com/greenart7c3/nostrsigner/service/EventNotificationConsumer.kt
index e6dfd072..e0f02029 100644
--- a/app/src/main/java/com/greenart7c3/nostrsigner/service/EventNotificationConsumer.kt
+++ b/app/src/main/java/com/greenart7c3/nostrsigner/service/EventNotificationConsumer.kt
@@ -219,10 +219,13 @@ class EventNotificationConsumer(private val applicationContext: Context) {
         if (notification != null) return
         Amber.instance.notificationCache.put(event.id, event.createdAt)
 
-        saveLog("Decrypted request: $requestStr", relay.url, acc.npub)
-
         val bunkerRequest = JacksonMapper.mapper.readValue(requestStr, BunkerRequest::class.java)
 
+        // Never persist the decrypted request body — it can contain plaintext
+        // (e.g. the message to encrypt, or the event to sign). The encrypted event
+        // is already logged above; here we record only non-sensitive metadata.
+        saveLog("Decrypted request ${bunkerRequest.id} method ${bunkerRequest.method}", relay.url, acc.npub)
+
         val signedEvent = if (bunkerRequest is BunkerRequestSign) {
             acc.sign(bunkerRequest.event)
         } else {