Privacy Policy
Effective date: 25 September 2026 · WA Backup ("the app", "we", "us")
The short version: WA Backup is a zero-knowledge backup service. Your backups are encrypted on your phone before they ever reach us, and your 64-digit encryption key never leaves your device. We cannot read your messages or media, and we never sell your data. Chat-database snapshots are kept for 7 days and then deleted automatically (your latest one is always kept). The free app shows ads and uses Google Firebase for anonymous usage statistics and notifications; neither can see your chats or your key.
1. Who we are
WA Backup is operated by Dot3 Solutions. For anything related to this policy or your data, contact us at [email protected].
2. Information we collect
| Data | Why we collect it |
|---|---|
| Email address and (optional) name | To create and secure your account, sign you in, and send password-reset codes. |
| Password | Stored only as a salted cryptographic hash. We never store or see your plain-text password. |
| WhatsApp phone number you register | To label your backup source so you can tell your backups apart. |
| Encrypted backup files | Your WhatsApp chat database is uploaded exactly as WhatsApp encrypted it
(.crypt15), and your media files are additionally encrypted on your
device with AES-256-GCM before upload. We store ciphertext only and have no
ability to decrypt it. |
| App usage statistics (Google Firebase Analytics) | Anonymous events such as which screens are opened, whether a backup succeeded, and how many files it uploaded, plus device model, Android version, country and app version. Linked only to an internal account ID, never to your email, name, phone number, chats, contacts or file names. |
| Advertising ID and ad interactions (Google AdMob) | To show banner ads and an ad before a Status Saver download, and to measure and limit them. Where the law requires it (for example in the EEA and UK) you are asked for consent first, and you can change your choice later in the app under Backup settings › Ad privacy options. |
| Notification token (Firebase Cloud Messaging) | A device token so we can send service notices and announcements. It is removed from your account when you sign out. |
| Basic technical data | Standard server logs (timestamps, request paths, IP addresses) kept briefly for security and troubleshooting, and a session token so you stay signed in. |
3. Your encryption key is never stored in the cloud
Your 64-digit WhatsApp encryption key is saved only on your device, in Android's hardware-backed secure storage (Keystore). It is never transmitted to our servers, never included in any backup, and never visible to us — not even in encrypted form. Media encryption keys are derived from it on your device.
Because of this design, we cannot recover your data if you lose your key. There is no reset, no backdoor, and no way for us — or anyone else — to decrypt your backups without the key you hold.
4. How we use your information
- To operate the backup service: store your encrypted backups and let you list, download, and delete them.
- To authenticate you and keep your account secure.
- To email you a password-reset code when you request one.
- To diagnose service problems from basic server logs.
- To understand how the app is used and fix problems, from the anonymous statistics described above.
- To show ads, which keep the app free.
- To send notifications about the service.
The contents of your backups (chats, media, contacts) are never used for advertising, analytics, profiling or marketing. They are ciphertext to us and to every provider we use.
5. Where your data is stored and how it is protected
- Encrypted backups are stored on Amazon Web Services (S3), in the Asia-Pacific (Mumbai) region.
- All transfers between your device, our servers, and storage use TLS (HTTPS).
- Backup content is stored exclusively as ciphertext we cannot decrypt.
- Account passwords are stored as salted hashes.
6. Sharing of information
We do not sell, rent, or trade your personal information. We share data only with the providers required to run and fund the service: cloud storage (AWS), email delivery for password-reset messages, and Google (Firebase Analytics, Firebase Cloud Messaging and AdMob) for the app statistics, notifications and ads described above, each under Google's own privacy policy (policies.google.com/privacy). These providers receive only the minimum needed and cannot decrypt your backups. We may disclose information if required by law, but the encrypted content of your backups remains unreadable without your key, which we do not have.
7. Device permissions the app requests
| Permission | What it is used for |
|---|---|
| Access to one folder you choose | You pick WhatsApp's own folder once in Android's folder picker. The app can read only that folder, to back up WhatsApp's chat database and media and to show statuses. Files you save (statuses, profile photos, downloads) are added to your gallery or Downloads without any storage permission. The app does not request "All files access" and never scans other folders. |
| Contacts (optional) | Only to display saved contact names next to chats in the built-in viewer. Contacts are read on your device and are never uploaded to our servers. |
| Notifications | To show backup progress and completion status, and service announcements. |
| Alarms & battery optimization exemption | To run your scheduled daily backup at the time you choose, even when the phone is idle. |
You can revoke any permission in Android settings; the related feature simply stops working.
8. Data retention and deletion
- Chat-database snapshots are kept for 7 days. Each backup uploads a snapshot of your encrypted chat database. Snapshots older than 7 days are deleted automatically, both the stored file and its record. The most recent snapshot of each device is always kept, however old, so you never lose your only backup.
- Media is not deleted automatically. Encrypted photos, videos, voice notes and documents stay until you delete them or your account.
- You can delete any snapshot yourself at any time in the app's Backups tab.
- To delete your entire account and all associated data, email [email protected] from your registered address. We will complete the deletion within 30 days and confirm.
- Server logs are retained only for a short operational window.
9. Children
WA Backup is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.
10. Relationship to WhatsApp
WA Backup is an independent application. It is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. "WhatsApp" is a trademark of WhatsApp LLC, used here only to describe compatibility. The app reads only the encrypted backup files WhatsApp itself stores on your device, using the key WhatsApp shows you in its own settings.
11. Changes to this policy
If we make material changes to this policy, we will update this page and its effective date. Continued use of the app after a change means you accept the updated policy.
12. Contact
Questions, data requests, or complaints: [email protected]