Privacy policy
Last updated October 19, 2026
Short version: this server reads one person's WhatsApp messages and shows them only to that person's own AI agent. Nothing is sold, shared or used for advertising.
Who runs this
This is a personal server. It is open source (source), and each copy is run by one person, the owner, in their own Cloudflare account. Only the owner can sign in.
What it reads
WhatsApp messages. The owner links their phone to the server as a linked device, the way WhatsApp Web works. The server then receives the owner's messages and chat names.
Names. The owner's AI agent can save a name for a phone number, for example after finding it in the owner's contacts. The server stores the name and number the agent gives it, next to the messages. It never connects to a contacts service itself.
What it keeps
Message text (photos, voice notes and documents are kept only as labels like [image], never as files), chat and contact names, names the owner or their agent saved for phone numbers, and the WhatsApp session credentials. All of it lives in a database inside the owner's own Cloudflare account. This software stores nothing anywhere else.
Encryption. Messages, chat and contact names and the WhatsApp session keys are encrypted before they are stored, with a key that is made from your password. The key itself is never stored; only a copy locked by your password is. Timestamps, message types, which side sent each message, roughly how long it is, and scrambled stand-ins for chat and contact ids stay readable, so the database can sort and group. Someone with database access could see how many chats you have, how active they are and when, but not who they were with or what they said.
This is encryption at rest, not end-to-end. While you or an agent you connected is making a request, the server holds your key in memory and works with your messages in plain text. Someone who controls the server's code could change it to capture passwords. The code is open source so it can be checked.
If you lose your password, your stored messages cannot be recovered by anyone. You can start again by linking WhatsApp again, and you get whatever history WhatsApp sends.
Who can see it
Only the owner, and the AI agents the owner chooses to connect. When an agent searches or reads messages, the text it reads goes to whoever runs that agent, for example the company behind the AI model, under the owner's own agreement with them. Cloudflare hosts the data as infrastructure.
The server does not sell data, does not use it for advertising, does not use it to train models, and does not share it with anyone else. No person other than the owner reads it.
Anyone else who tries to sign in
If anyone other than the owner tries to sign in, they are turned away, and nothing about them is kept.
Deleting your data
Sign in and choose "Delete my data" on the dashboard. It unlinks WhatsApp and erases the stored messages, names and keys. "Unlink and scan again" removes the server's access to WhatsApp but keeps the messages already stored. You can also delete the Worker and its Durable Object storage in the Cloudflare dashboard.
Questions and changes
Questions go in an issue on GitHub. If this policy changes, the new version replaces this page and the date above changes with it.