Privacy Policy
Effective date: 17 July 2026 · WA Backup ("the app", "we", "us")
The short version: WA Backup is a zero-knowledge backup service. Your backups are encrypted on your phone before they ever reach us, and your 64-digit encryption key never leaves your device. We cannot read your messages or media, we show no ads, we run no third-party analytics, and we never sell your data.
1. Who we are
WA Backup is operated by Dot3 Solutions. For anything related to this policy or your data, contact us at [email protected].
2. Information we collect
| Data | Why we collect it |
|---|---|
| Email address and (optional) name | To create and secure your account, sign you in, and send password-reset codes. |
| Password | Stored only as a salted cryptographic hash. We never store or see your plain-text password. |
| WhatsApp phone number you register | To label your backup source so you can tell your backups apart. |
| Encrypted backup files | Your WhatsApp chat database is uploaded exactly as WhatsApp encrypted it
(.crypt15), and your media files are additionally encrypted on your
device with AES-256-GCM before upload. We store ciphertext only and have no
ability to decrypt it. |
| Basic technical data | Standard server logs (timestamps, request paths, IP addresses) kept briefly for security and troubleshooting, and a session token so you stay signed in. |
3. Your encryption key is never stored in the cloud
Your 64-digit WhatsApp encryption key is saved only on your device, in Android's hardware-backed secure storage (Keystore). It is never transmitted to our servers, never included in any backup, and never visible to us — not even in encrypted form. Media encryption keys are derived from it on your device.
Because of this design, we cannot recover your data if you lose your key. There is no reset, no backdoor, and no way for us — or anyone else — to decrypt your backups without the key you hold.
4. How we use your information
- To operate the backup service: store your encrypted backups and let you list, download, and delete them.
- To authenticate you and keep your account secure.
- To email you a password-reset code when you request one.
- To diagnose service problems from basic server logs.
We do not use your data for advertising, profiling, or marketing, and we do not run third-party analytics or tracking SDKs in the app.
5. Where your data is stored and how it is protected
- Encrypted backups are stored on Amazon Web Services (S3), in the Asia-Pacific (Mumbai) region.
- All transfers between your device, our servers, and storage use TLS (HTTPS).
- Backup content is stored exclusively as ciphertext we cannot decrypt.
- Account passwords are stored as salted hashes.
6. Sharing of information
We do not sell, rent, or trade your personal information. We share data only with the infrastructure providers required to run the service — cloud storage (AWS) and email delivery for password-reset messages — and only to the minimum extent needed. These providers process data on our behalf and cannot decrypt your backups. We may disclose information if required by law, but the encrypted content of your backups remains unreadable without your key, which we do not have.
7. Device permissions the app requests
| Permission | What it is used for |
|---|---|
| Storage / "All files access" | To read WhatsApp's local backup and media folders on your phone so they can be backed up, and to save files you choose to download into your Downloads folder. We never scan or upload unrelated files. |
| Contacts (optional) | Only to display saved contact names next to chats in the built-in viewer. Contacts are read on your device and are never uploaded to our servers. |
| Notifications | To show backup progress and completion status. |
| Alarms & battery optimization exemption | To run your scheduled daily backup at the time you choose, even when the phone is idle. |
You can revoke any permission in Android settings; the related feature simply stops working.
8. Data retention and deletion
- Your encrypted backups remain stored until you delete them. You can delete any backup snapshot directly in the app; deletion removes both the stored file and its record.
- To delete your entire account and all associated data, email [email protected] from your registered address. We will complete the deletion within 30 days and confirm.
- Server logs are retained only for a short operational window.
9. Children
WA Backup is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.
10. Relationship to WhatsApp
WA Backup is an independent application. It is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. "WhatsApp" is a trademark of WhatsApp LLC, used here only to describe compatibility. The app reads only the encrypted backup files WhatsApp itself stores on your device, using the key WhatsApp shows you in its own settings.
11. Changes to this policy
If we make material changes to this policy, we will update this page and its effective date. Continued use of the app after a change means you accept the updated policy.
12. Contact
Questions, data requests, or complaints: [email protected]