Privacy Policy

Last updated: September 6, 2026

WhatStats ("the App") is provided by Team WhatStats ("we", "the Controller"). This policy describes what data we collect, how we use it, and your rights under the GDPR (EU Regulation 2016/679).

1. Data we collect

1.1 WhatsApp chat data

When you import a WhatsApp export file, the App analyses the content locally on your device to calculate statistics (messages, emoji, times, media). This data never leaves your device during local statistics computation.

1.2 AI Analysis (requires your explicit consent)

AI features (Report, DNA, Moments, Wrapped, Ask Your Chat) require sending data to our servers and, from there, to our AI provider. This feature is disabled by default and is only activated with your explicit consent via the dedicated screen in the App, which names the AI provider before any data is sent.

When you enable AI analysis, the following is sent:

• Aggregate metrics: message distribution, activity by hour/day/month, response times, most-used emoji and words
• Message samples: up to 15 messages selected as representative of the conversation (first message, key moments, activity peaks), with personal data (phone numbers, emails, URLs) removed
• Participant labels: real names are replaced with anonymous identifiers (p1, p2, …) before sending; real names are re-applied only on your device
• Detected moments: periods of significant activity identified locally

Not sent: the entire message history, real participant names, phone numbers, photos, videos, voice notes, or other media.

Data is processed in real time and is not stored on our servers after processing is complete.

• Infrastructure: Firebase Cloud Functions, region europe-west1 (Belgium, EU)
• AI Provider: Anthropic PBC (Claude AI), United States — data sent to Anthropic is subject to their Privacy Policy. Anthropic acts as our data processor, does not use API data to train its models, and transfers rely on EU–US Standard Contractual Clauses.

1.3 Device identifier

We use the device vendor identifier (identifierForVendor) exclusively for the referral system, to prevent abuse (duplicate registration/redemption). This identifier cannot be linked to your identity and changes if you reinstall the App.

1.4 Referral system data

If you use the referral program, we store on Firebase Firestore (EU):

• The generated referral code
• The device identifier (anonymous)
• The redemption count

1.5 Purchase data

In-app purchases (Premium subscription and credits) are managed by Apple through the App Store and by RevenueCat for subscription management. We do not store payment data. See RevenueCat's Privacy Policy.

1.6 Usage analytics

We use Firebase Analytics (Google) to understand how the App is used and to improve it. This collects pseudonymous usage data — screen views, feature interactions, app version, device model, and approximate country (derived from IP address) — associated with an app-generated identifier, not with your identity. We do not use advertising identifiers (IDFA) and we do not track you across other companies' apps or websites.

1.7 Data we do NOT collect

• We do not require registration or a user account
• We do not collect your name, email address, or contacts
• We do not use advertising identifiers or cross-app/website tracking
• We do not sell data to third parties
• We do not display advertising

2. Legal basis for processing

• Performance of a contract (Art. 6.1.b GDPR): processing data to provide App functionality
• Consent (Art. 6.1.a GDPR): sending data for AI analysis only occurs upon your explicit action
• Legitimate interest (Art. 6.1.f GDPR): fraud prevention in the referral system, and pseudonymous usage analytics to improve the App

3. Data retention

• Local data: stored on the device until you delete the chat from the App or uninstall the App
• AI analysis: processed in real time, not retained on servers after the request completes
• Referral data: stored on Firestore for the duration of the referral program
• Usage analytics: retained by Firebase Analytics per Google's standard retention settings

4. Data transfers

Data for AI analysis passes through our EU servers (Firebase, Belgium) and is forwarded to Anthropic (USA) for processing. Anthropic adheres to EU-US Standard Contractual Clauses for data protection. Firebase Analytics may also process data on Google infrastructure under equivalent safeguards.

5. Your rights

Under the GDPR you have the right to:

• Access: know what data we process
• Erasure: delete your data (in the App: Profile → Privacy → Delete all data)
• Portability: export your data
• Objection: object to processing
• Complaint: file a complaint with your local data protection authority

6. Security

Local data is encrypted at rest using iOS data protection APIs (completeUntilFirstUserAuthentication). All communications with servers are exclusively via HTTPS/TLS.

7. Children

The App is not intended for children under 13. We do not knowingly collect data from children.

8. Changes

We may update this policy. The last update date is shown at the top. We encourage you to review it periodically.

9. Contact

For any privacy questions:

Team WhatStats
Email: whatstatsinfo@gmail.com