Is It Safe to Upload Your WhatsApp Chat? Exactly What Happens to Your Data

You are about to hand a private conversation to a website. That deserves a straight answer, not a privacy policy written by lawyers for other lawyers.

So here is the whole thing, step by step: what leaves your phone, what reaches our servers, what the AI models see, and what we could not find out about you even if we decided to try.

The short version

Names are replaced on your device, before anything is uploaded. There are no accounts, so there is no email, phone number or password to connect an analysis to a person. And because there is no account, there is nothing linking one analysis to another — two conversations you analyse a week apart are, to us, two unrelated rows in a database with no owner.

That last point is the one people miss. Most privacy promises are about what a company chooses not to do with data it holds. This one is structural: we do not have the identifiers that would make the data personal in the first place.

Step 1: names are replaced before the upload, not after

When you drop a chat export into the page, nothing is sent anywhere yet. Your browser parses the file locally, finds the participant names, and shows them to you in a box asking what to call each person instead.

Whatever you type there is applied in your browser. The file that gets uploaded is a rewritten copy in which "Marina" has already become "Person A" and "Diego" has already become "Person B". The mapping between the real names and the pseudonyms never leaves your device — it is not sent with the file, and it is not stored anywhere. When you close the tab, it is gone, and there is no copy of it in the world.

This is the single most important thing on this page. Everything downstream — our servers, the database, the AI models — only ever sees the pseudonymised version. Not because we delete the real names later, but because we never receive them.

One thing to know: this replaces the participant names. If someone typed a phone number, an address or a full name inside a message, that text is part of the conversation and travels with it. If that matters for your chat, edit the export before uploading — it is a plain text file that opens in any editor.

Step 2: what actually arrives on our servers

What arrives is the rewritten conversation, and nothing else. Not even the name of your export file: WhatsApp names exports after the person you were talking to, so that filename is discarded on arrival and never written to our database.

From that text we store:

• The conversation statistics — message counts, response times, activity patterns, sentiment scores. Numbers computed from the pseudonymised text.
• A search index of the conversation, so the assistant can answer questions about it. The conversation is split into chunks and converted into embeddings stored in a per-analysis index that belongs to that analysis alone.
• The messages you send to the assistant, so the conversation you are having with it survives a page refresh.

What we do not store: your name, your email, your phone number, your WhatsApp account, the real names of anyone in the chat, or the name of your export file. Not because we purge them — because they are never sent.

Step 3: what the AI models see

The semantic analysis and the assistant run on large language models from OpenAI and Anthropic. Being direct about this: yes, the text of your conversation is sent to those APIs. That is what produces the analysis.

What gets sent is the pseudonymised text — "Person A" and "Person B" — with no account, no email, no name, and no identifier that ties it back to you. A model reading it can tell you that Person A initiates most conversations and takes longer to reply on weekends. It has no way to know who Person A is, because that information does not exist on our side to send.

Under the standard API terms both providers operate on, content sent through the API is not used to train their models, and is retained only briefly for abuse monitoring before being deleted. We do not train any model of our own on your conversations.

Step 4: why the combination is the point

Any one of these measures on its own would be thin. Pseudonyms alone are weak if a service knows your email — "Person A" is trivially re-identified the moment it sits next to an account. No-account access alone is weak if the raw names are uploaded, because the conversation identifies its own participants.

The combination is what makes it hold:

• The names are gone before the upload, so the content is de-identified at the source.
• There is no account, so there is no identity to attach the content to.
• There is no link between separate analyses, so nothing accumulates into a profile.

The result is a conversation with its identifying information removed, sitting in a system that has no idea who submitted it. That is a genuinely different situation from "we promise not to look."

Step 5: it deletes itself, on a clock we do not control

Each analysis has a lifespan: one hour on the free tier, twenty-four hours on Pro. When it runs out, the conversation with the assistant, the analysis, the statistics and the search index are all deleted. What survives is a row noting that an analysis existed and was deleted — no content, no participants, nothing about the chat.

There is also a delete button on the analysis page if you would rather not wait. It does exactly the same thing, immediately.

The part worth knowing is how the expiry runs. It is not a timer inside the website. It is a separate scheduled process, in separate infrastructure, that connects to the database every hour and deletes everything past its lifespan. It does not ask the website for permission and does not need the website to be working.

That distinction is the whole point. If the site is down, mid-deploy, broken, or if we simply stopped maintaining it tomorrow, your analysis still gets deleted on schedule. Deletion does not depend on the part of the system most likely to fail. Most "we delete your data" promises quietly assume the application is alive and behaving; this one does not.

This is not a product built to keep your history. There is no history to come back to, by design.

What we collect that is not your chat

Being complete about this, because a privacy page that only lists the flattering parts is not worth reading:

• Website analytics. We use Google Analytics to count things like how many people uploaded a file today, on what kind of device, in what language. Standard aggregate web analytics. It is not connected to the contents of any conversation.
• Anti-abuse checks. Uploads pass through Cloudflare Turnstile — a bot check that is not a tracking cookie — and your IP address is used to rate-limit requests. That IP lives in memory for the rate-limit window and is never written to our database.
• The chatbot on the home page. The little assistant that answers questions about the product keeps a transcript of those conversations so we can see what people ask and improve the answers. Those transcripts are deleted after seven days by the same scheduled process described above. It is a product-questions bot: it has no access to any conversation, any analysis, or any session. Even so, do not paste anything private into it.
• Payments. Payments run through PayPal. Card details go to PayPal, never to us; we receive an order ID and whether it succeeded.

What we do not do

We do not sell data, run ad networks, build advertising profiles, or share conversations with anyone beyond the AI providers described above. We do not read your conversations for our own purposes. We are not affiliated with WhatsApp or Meta in any way — this tool works with the export file WhatsApp gives you, and that is the entire relationship.

And a boundary worth stating plainly: this is built to analyse conversations you are part of. It is not a monitoring tool, and it is not designed to help anyone read someone else's messages.

The honest summary

Privacy claims are cheap. The ones on this page are specific: names are replaced in your browser before the upload, no account exists to link anything to you, separate analyses have nothing joining them, the AI providers receive de-identified text, and everything is deleted on a schedule that runs whether or not this website is working.

And the first of those is the one you can check yourself, without trusting us at all. Open your browser's developer tools on the network tab before you drop in a chat. Nothing is sent while you are choosing pseudonyms — and when you confirm, the request that finally goes out carries "Person A", not the name you replaced.