Privacy

Short version: your chat never leaves your device. This page explains what that means in practice and what little we do collect.

Last updated October 20, 2026

Your chat file

When you drop a WhatsApp, Telegram, Instagram or Messenger export onto this site, it is opened and converted by JavaScript running in your browser tab. There is no upload endpoint for chat files. The parsed messages, the preview and the generated PDF exist only in your browser’s memory and are discarded when you close or reload the page. The one exception is checkout: if you start it with a chat loaded, a copy of that export file is kept in your browser’s storage on this device so it is ready when you come back from Stripe. It is deleted the next time you open the tool and is never sent to us. We never see the contents, the participants, the file name or the SHA-256 fingerprint of your export.

During PDF generation the page fetches open-source Noto font files from a public CDN (jsDelivr) so that non-Latin scripts and emoji render correctly. Those requests contain no information about your chat, only which font file is being requested.

What we do collect

Usage analytics. We use Vercel Web Analytics and Google Analytics 4 to count visits and see how the tool is used. They never receive your chat, the names in it, your files or your email address. Details and your choices are under Analytics and cookies.
Payment details, handled by Stripe. If you buy a Case Pass, the checkout happens on Stripe’s pages. Stripe processes your card and gives us your email address and a payment record so we can issue refunds and support. We never see your card number.
The Case Pass token. After payment, a signed token is stored in your browser’s local storage so the site knows this browser is unlocked. It contains a Stripe session reference and an expiry date, nothing about your chats.
Certificate registry (Case Pass only). When a Case Pass PDF is generated, the browser sends the registry a certificate record so that third parties can verify the document later: the SHA-256 fingerprint of your export file, the SHA-256 of the finished PDF, the platform, message count, page count, first and last message dates, the number of participants and a one-way fingerprint of their names. It never receives message text, names, phone numbers or the files themselves. Records are public by ID or by PDF fingerprint (you need one of those to look anything up) and are kept so verification keeps working for the life of your case.
Support email. If you write to us, we keep the correspondence to help you. Please don’t send us your chat export unless we ask for a sample to fix a parsing bug — and redact it first.

Analytics and cookies

We use Vercel Web Analytics, which sets no cookies, and Google Analytics 4 to understand how people find and use Chat to Evidence and to measure our marketing.

When it runs. In the European Economic Area, the United Kingdom, Switzerland and Quebec, Google Analytics stays off until you accept it in the cookie banner. Elsewhere it is on by default, and you can switch it off at any time below.

What it sees. The pages you visit, with every query parameter except campaign tags and ad click ids removed from the address and certificate ids replaced by a placeholder; your approximate location (city level); your device and browser; how you arrived; and a few product events: choosing a chat export, creating a PDF, opening the Case Pass offer, starting checkout, buying, and clicking main buttons. These events name only the chat app (for example "whatsapp"), whether the PDF was the free preview or the Case Pass, and the price you were charged. Your chats, the names in them and your files are never sent, nor is your email address. The purchase is sent from the page you return to after paying, once our server has confirmed the payment with Stripe.

Advertising. We tell Google whether this data may be used to measure our advertising. If your browser sends a Global Privacy Control signal, we tell Google not to use it for advertising at all. In the regions where we ask first, we never allow it to be used for personalised ads.

How long. Google Analytics keeps event-level data for 14 months.

Cookies:

_ga (Google Analytics, 2 years): tells one browser's visits apart from another's. Only while analytics is on.
_ga_<ID> (Google Analytics, 2 years): keeps track of the current visit. Only while analytics is on.
_gcl_* (Google, 90 days): links ad clicks to visits so our advertising can be measured. Only while analytics is on.
ga_consent (Chat to Evidence, 180 days): remembers your analytics choice.

Your browser's storage, which is not cookies, also holds your Case Pass (above), whether the cookie banner applies where you are (this visit only), and a short list of recent order references so a purchase is not counted twice. If you go to checkout with a chat loaded, it also keeps a copy of that export file until you next open the tool (see Your chat file, above). None of it is sent to anyone for analytics. Switching analytics off deletes the list of order references.

Your privacy choices

Switching analytics off stops it in this browser and deletes the Google Analytics cookies this site set. Your choice is saved for 180 days. You can also block cookies in your browser settings.

Checking your current setting…

Server logs

Our hosting provider (Vercel) keeps standard, short-lived request logs (IP address, user agent, URL) for security and debugging. Chat content is never part of a request, so it never appears in logs.

Your rights

You can ask us to delete any support correspondence or payment-related records we hold about you by emailing hello@chattoevidence.com. Because we do not hold your chats, there is nothing to delete on that front — clearing your browser’s site data removes the Case Pass token and any cached fonts.

Changes

If we ever change how the tool handles data, we will update this page and the date above. The in-browser processing model is the whole point of the product, so it is not going to change quietly.