Privacy Policy

Version 2026-10-14. Last updated 14 October 2026.

1. Who is responsible

Dia Bonito Solarte (Tim Street), based in Bocas del Toro, Panama, runs the WhatsApp Inbox app and decides how your data is used. Contact: [email protected].

2. What we collect

About you

• Your name, sign-in name, and the languages you chose.
• A scrambled (hashed) form of your passcode. We cannot read your passcode.
• Your settings: daily limit, reply style, notification choices, which chats you muted, pinned or hid.
• Your record of agreeing to these documents: which version and when.
• Your subscription status and payment history. Payment details are handled by our payment provider and we do not keep your card number.
• Sign-in records: a session cookie and a device cookie, the type of browser you use, and when you were last active.
• A record of actions on your account (for example, changing your key or asking to delete your account).

From your WhatsApp

• The messages your WhatsApp account receives and sends, with the names and phone numbers of the chats, groups and people in them, and the time of each message.
• Voice notes, photos, videos and documents, when the app downloads them to show, play or process them.
• Whether you have read a chat.

What the app makes from it

• Translations, transcripts of voice notes, text read from photos, reply suggestions, notes about your writing style that help suggestions sound like you, and your edits to suggestions.
• Calendar details (a date, a time, a place) that the app finds in a message for its Add to calendar button.

Your Claude API key

• Your key, stored encrypted. Only its last four characters can be shown.
• A count of what the app spent through your key, per day.
• If you choose the plan where we provide the key ("Use our key"), you have no key of yours with us. The app uses ours, and we keep a record of what your use costs us each month, so that the plan's monthly allowance can be applied.

3. People who message you

The people in your chats did not sign up for the app. Their messages reach us only because they wrote to you. We use them only to serve you: to translate and read them to you. We do not contact them, we do not build profiles of them, and we do not use their messages for anything else. If you are one of those people and you want something removed, write to [email protected] or ask the person you wrote to.

4. Why we use your data

• To give you the service you asked for: showing, translating and answering your messages.
• To keep your account safe: sign-in limits, preventing abuse and fixing problems.
• To take payment and keep records we must keep by law.
• To improve reply suggestions for you. The style notes stay in your account only. We do not use your messages to train any model.

We do not sell your data. We do not show ads. The app does not use advertising or analytics trackers.

5. Who else receives it

• Anthropic (Claude). To translate messages, suggest replies and read text in photos, the app sends the relevant message text, and photos you ask it to read, to Anthropic using your own API key. If you are on the plan where we provide the key, the same text goes to Anthropic through our account with Anthropic instead, so Anthropic receives it from us, under our agreement with Anthropic, and we do not use it for anything else. Anthropic's own terms and privacy policy cover what they do with it, and your agreement with Anthropic applies. We do not control that. Voice notes are turned into text on our own server and the audio is not sent to Anthropic.
• Oracle Cloud. Our server is hosted by Oracle in United States (Oracle Cloud, Ashburn, Virginia). Your data is stored there.
• Our tunnel provider. The connection between your phone and our server passes through a tunnel service (currently Cloudflare and ngrok). It can technically see the traffic in transit. It does not store your messages with us.
• Our payment provider. It handles payments and sends us your subscription status.
• Browser push services. If you turn on notifications, the notification text is delivered through your browser's push service (for example Apple's or Google's), encrypted for your device.
• WhatsApp (Meta). The app connects to WhatsApp as a linked device, so WhatsApp sees that connection. See the unofficial connection notice.
• The law. We give data to authorities only when a valid legal request requires it.

6. Where your data is stored

On a server in United States (Oracle Cloud, Ashburn, Virginia). Anthropic is in the United States. If you live somewhere else, your data crosses borders. We keep each person's data in a separate store, and the app cannot show one person's data to another.

7. How long we keep it

• Your account and WhatsApp data stay until you delete your account.
• When you ask to delete, we wait 7 days so you can change your mind. After that we delete your messages, translations, settings and files from our server, unlink your WhatsApp from the app, and delete your key and your sign-in. This cannot be undone.
• Copies in our backups are removed when those backups expire, no later than 30 days after the deletion.
• We keep a short record that your account existed and was deleted (your sign-in name, and the dates), so we can show that we honoured your request, and records we must keep for tax and payment rules.

8. Your rights

You can, in the app under Menu, then Your account:

• Download your data. You get a zip file with your messages, translations and settings in JSON format.
• Delete your account. Your data is deleted after the 7 days described above. You can cancel the request during that time.
• Change your settings, languages and key at any time.
• Withdraw your agreement by deleting your account.

Depending on where you live, you may also have the right to ask us what we hold about you, to correct it, to limit or object to how we use it, and to complain to the data protection authority in your country. Write to [email protected] and we will answer within a reasonable time.

9. Security

• Your Claude key is encrypted. Your passcode is stored only as a hash.
• Each person's data is kept apart from everyone else's.
• The connection to the app is encrypted (HTTPS).
• We limit sign-in attempts to protect your account.

We run the server, so we can technically reach the files on it. We keep your messages, their translations and the app's working logs so we can check the quality of translations and replies over time, and we may read them for that purpose and to fix problems you report. We do not sell them or use them for advertising, and we do not share them except with the services named in this policy or where the law requires it. No system is perfectly secure. If we learn of a breach that affects you, we will tell you.

10. Cookies

We use only the cookies the app needs to work: one that keeps you signed in and one that recognises your device. We do not use advertising or tracking cookies.

11. Children

The app is for people aged 18 and over. We do not knowingly collect data about children.

12. Changes

If we change this policy in a way that matters, we give it a new version and ask you to accept it the next time you sign in.

13. Contact

Write to [email protected].