Privacy Policy

Effective date: 14 October 2026

Applies to WASecret — Privacy & Organisation for WhatsApp Web, Store Edition and direct-download Full Edition 3.50.1 and later.

Contact: [email protected]

WASecret is independent and is not made by, affiliated with, or endorsed by WhatsApp LLC or Meta.

Information used and why

WASecret operates in your own WhatsApp Web session. It accesses message text and media, contact names and identifiers, profile photos and timestamps to provide the privacy and organisation features you choose: blur, screen locking, private chats, reminders, quick replies, translation, local recovery and export. It does not give access to another person's account or to messages your browser never received.

Settings, mode profiles, reminders, quick replies, private-chat selections and enabled recovery records are stored in your Chrome profile. Your PIN is stored as a salted hash, not as the original PIN. A random installation identifier and rotating WASecret license/service tokens are stored locally; the entered license key is exchanged with the WASecret server and is not saved by the extension. Chrome creates a non-extractable P-256 device private key in IndexedDB. The private key stays in that Chrome profile and signs protected requests; WASecret receives the matching public key and a general device label. The server stores a one-way hash of each license key, the customer email, plan and subscription status, masked key hint, installation identifier, extension version, activation timestamps, token-family generation and security events such as refresh-token replay. A screen PIN does not itself encrypt every file on the computer; the optional encrypted vault protects its supported local records using AES-GCM.

The publisher receives license activation/status requests and only the text you request to translate through the managed service. In the direct-download Full Edition, it also receives only a recorded voice note you explicitly request to transcribe or convert in WASecret Cloud. Local recorded conversion and all real-time call voice processing stay on your laptop. Entire chat histories and contacts are not automatically uploaded. The extension has no publisher analytics, advertising, sale of personal data or advertising tracking.

Recovery, retention and deletion

On a new Store installation, message recovery and automatic media saving are OFF. You can choose to enable them. Recovery keeps local copies of messages your session receives while enabled, so a later deletion can be displayed from that saved copy. It cannot retrieve messages that were not captured.

Ordinary contacts' received and deleted records expire after one hour according to the corresponding receipt or deletion timestamp. For people you explicitly select, that retention is 24 hours. Removing a person from that selection returns them to the one-hour policy. Expired records are pruned when the extension runs; it cannot run cleanup while Chrome is closed. Recovery contact selections are excluded from portable settings and Chrome settings sync.

Other settings and records remain until you delete them in the extension, clear extension storage or uninstall. Exported or automatically downloaded files remain in the chosen folder until you delete them yourself; disabling a feature or uninstalling does not remove those files. Text and recorded audio sent to WASecret are held only in request memory and provider request bodies. Source audio, converted audio, transcripts and message content are not written to application storage or logs and are released immediately after success, failure, timeout or cancellation. WASecret retains only necessary license, installation, request, operation, duration/size, status, latency, quota/cost and security-incident metadata.

Optional third-party processing

• WASecret licensing, OpenAI and recorded audio: The extension connects over HTTPS to app.wasecret.com to activate and periodically validate the license. The Stripe buyer must approve the laptop through a one-use email link. Device proofs bind rotating tokens to the approved Chrome profile; replaying a consumed token revokes that activation. Text you explicitly request to translate and recorded voice notes you explicitly request to transcribe are sent through WASecret to OpenAI. A recorded clip you explicitly submit for Cloud voice conversion is processed by WASecret with the pinned OpenVoice model. WASecret holds provider credentials on its server. Submitted content is not stored in application logs or the usage database. Usage records contain license and installation identifiers, request and operation IDs, time, character/audio units, model, token count, duration, latency, cost estimate, outcome and error code for limits, billing and abuse prevention. OpenAI processes submitted data under its API terms and privacy policy; Responses requests use store: false.
• Free trial: Requesting a Pro trial sends the email address you enter to WASecret, which keeps it with the trial license to email the key and to allow one trial per address. No payment details are collected for a trial.
• Stripe: Choosing to buy a license opens Stripe-hosted Checkout. Stripe receives and processes the email and payment details under its own terms. WASecret receives the email plus Stripe customer, subscription, invoice and payment-status identifiers needed to issue, renew, cancel, refund or revoke access. The extension and WASecret application do not receive raw card details.
• Resend: WASecret sends the license email and one-use laptop approval links through Resend. Resend receives the destination email address and email contents. A license key is encrypted in WASecret's delivery queue until accepted by the email provider, after which the queued ciphertext is removed; WASecret retains only the one-way key hash and a short masked hint.
• Cloudflare: wasecret.com is hosted on Cloudflare Pages and requests to app.wasecret.com pass through Cloudflare's network. Cloudflare processes connection metadata such as IP address, request time and security signals to deliver and protect the service. It does not receive the contents of your WhatsApp chats.
• Chrome settings sync: If you enable it, selected privacy, appearance, translation and related preferences are saved through Chrome Sync under your Google account. This record excludes messages, contacts, private-chat lists, PIN credentials, API keys and personal wallpapers. Google manages sync transport and retention.
• WhatsApp: The extension interacts with your own WhatsApp Web session and WhatsApp services for the chat data and actions you request. It does not send this information to the publisher.

Opening the public website or a policy/support link also creates a normal browser request to that website and its hosting provider. This is separate from extension analytics; no chat content is appended to those links.

Permissions

The Store Edition does not request access to all websites, optional tabs access, localhost integrations or Google Sheets identity access. It does not include voice transcription, recorded voice conversion, an external Google Translate action or local translation models. Executable extension code is bundled in the ZIP. The direct-download Full Edition can optionally request model-host access only after the user selects Local recorded conversion; it downloads data-only, SHA-256-pinned OpenVoice weights and caches them locally. It never downloads executable JavaScript or WebAssembly. Local model data, local reference samples and real-time microphone frames are not sent to WASecret.

Messages and Limited Use

The Store Edition does not dispatch WhatsApp messages automatically. Reminders produce alerts. Quick replies insert a draft; you send it yourself in WhatsApp. Blur, lock and screen privacy work without a license. Pro features need an active license: a free 3-day trial key requested by email, or a paid subscription. Purchase and refund terms are shown before Stripe Checkout at https://app.wasecret.com/license-terms.

The use of information received from Chrome and the pages you open adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the disclosed user-facing purpose. It is not sold, used for personalised advertising or credit/lending decisions, or read by people except with your explicit permission or where legally required. Transfers are limited to the services and actions described above.

Children and changes

The extension is not directed to children under 13. Changes to this policy will be published with an updated effective date and corresponding Store disclosures. Contact [email protected] for questions.