WaChatPrivacy & security
The key on your phone, data in your Drive, the web reading directly. No server of ours sees a single message.
The full data path
1) WhatsApp's local backup is decrypted on your device with your key, inside the app. 2) Messages go to a local database; media to files named by their hash. 3) Backups are uploaded to the hidden app folder (appDataFolder) of your Google Drive with the drive.appdata scope. 4) The web reads the same files from Drive directly in the browser with your own token.
What our server holds
Your account id (Firebase Auth), subscription state (Firestore), and a Drive refresh token encrypted with Cloud KMS per linked web device — revocable from the app. No chat file, no media, no WhatsApp key.
Linking with a code
The browser generates a key pair and an 8-character single-use code valid for 3 minutes. The app approves with your account token, and the server encrypts the sign-in token to the browser's public key — so even someone who reads the document can't use it.
Optional passphrase encryption
AES-256-GCM with a key derived by PBKDF2 (200,000 iterations) from a passphrase you choose. The salt is stored with the backup; the passphrase is not. If you forget it there is no recovery — not even by us.
Permissions
Drive (appdata only), media and the WhatsApp folder (SAF) to read the local backup, optional contacts for names, and notifications. No "all files" permission.
Open to review
Everything is explained here and in the privacy policy, and the Google Play disclosures match. If you find something, write to security@wachatplus.com.