Privacy

Your chat file

When you drop a WhatsApp, Telegram, Instagram or Messenger export onto this site, it is opened and converted by JavaScript running in your browser tab. There is no upload endpoint for chat files. The parsed messages, the preview and the generated PDF exist only in your browser’s memory and are discarded when you close or reload the page. We never see the contents, the participants, the file name or the SHA-256 fingerprint of your export.

During PDF generation the page fetches open-source Noto font files from a public CDN (jsDelivr) so that non-Latin scripts and emoji render correctly. Those requests contain no information about your chat, only which font file is being requested.

What we do collect

• Privacy-friendly analytics. We use Vercel Web Analytics and Google Analytics 4 in cookieless mode (Consent Mode with all storage denied) to count page views and referring sites. Neither uses cookies or tracks you across sites. It sets no cookies and receives only the page path, never query strings, and never your chat content, files or Case Pass. Google processes your IP address to estimate a rough location; Google Analytics 4 does not log or store IP addresses.
• Payment details, handled by Stripe. If you buy a Case Pass, the checkout happens on Stripe’s pages. Stripe processes your card and gives us your email address and a payment record so we can issue refunds and support. We never see your card number.
• The Case Pass token. After payment, a signed token is stored in your browser’s local storage so the site knows this browser is unlocked. It contains a Stripe session reference and an expiry date, nothing about your chats.
• Certificate registry (Case Pass only). When a Case Pass PDF is generated, the browser sends the registry a certificate record so that third parties can verify the document later: the SHA-256 fingerprint of your export file, the SHA-256 of the finished PDF, the platform, message count, page count, first and last message dates, the number of participants and a one-way fingerprint of their names. It never receives message text, names, phone numbers or the files themselves. Records are public by ID or by PDF fingerprint (you need one of those to look anything up) and are kept so verification keeps working for the life of your case.
• Support email. If you write to us, we keep the correspondence to help you. Please don’t send us your chat export unless we ask for a sample to fix a parsing bug — and redact it first.

Server logs

Our hosting provider (Vercel) keeps standard, short-lived request logs (IP address, user agent, URL) for security and debugging. Chat content is never part of a request, so it never appears in logs.

Your rights

You can ask us to delete any support correspondence or payment-related records we hold about you by emailing hello@chattoevidence.com. Because we do not hold your chats, there is nothing to delete on that front — clearing your browser’s site data removes the Case Pass token and any cached fonts.

Changes

If we ever change how the tool handles data, we will update this page and the date above. The in-browser processing model is the whole point of the product, so it is not going to change quietly.