What stays local. What doesn't.

TL;DR

Your encrypted Crypt15 backup, the 64-digit key, decrypted databases, media, contact mappings, and .tarc archives all stay on your Mac. We never see any of it. The only data we store is what you give us at purchase + activation: your email, your license row, and the device IDs you bind to it.

What stays on your Mac

• The encrypted .crypt15 file you transferred from Android.
• Your 64-digit WhatsApp encryption key. We never see it.
• Decrypted msgstore.db, the media files referenced by it, and (optionally) a contacts.json built from any vCard/CSV address book you imported plus a manual_contacts.json with your in-app rename edits.
• .tarc archive bundles you save.
• Manual contact mappings you create.

What stays on your Android phone

• Everything Chat Hoarding for Android scans: WhatsApp folders, backup file metadata, your contacts.
• We can verify this: Chat Hoarding for Android's AndroidManifest.xml has no INTERNET permission. Android enforces this at the OS level.
• When you share a zip, you choose the destination (LocalSend, Quick Share, Drive, etc.). The companion never decides.

What we store on our servers

Three things, stored in Supabase (EU region):

• Your email address (entered at Stripe checkout). Used as your login identity.
• License row: tier, purchase date, currency, refund status. No message content. Ever.
• Device activations: a SHA-256 hash of the Mac's hardware UUID (IOPlatformUUID; the raw UUID never leaves the Mac), device name, OS version, last-seen timestamp. We compare these to enforce the 2-Mac cap.

Subprocessors

• Stripe: payment processing.
• Supabase: Postgres + auth. Holds the license row + device activations + the 6-digit OTP during sign-in.
• Cloudflare: CDN + DNS for chathoarding.app. Sees IP at the edge; never sees chat content.
• Microsoft Clarity: anonymous session-replay on the marketing site only. Doesn't run in the Mac or Android app.
• Google Analytics 4: page views and visit statistics on the marketing site only, using Google's analytics cookies. Doesn't run in the Mac or Android app.
• Chatwoot (self-hosted by Launch52 at support.launch52.ai): the support chat widget on every page of the website. If you're signed in to /account, it also receives your email, name and license details (account ID, avatar, signup date and account age, plan, purchase date and amount, Macs active out of your cap, the last 4 characters of your license key, revoked status, and the referrer, landing page and UTM tags of your first visit when we have them) so we can answer you. Doesn't run in the Mac or Android app.

That's it. No analytics inside the apps. No error monitoring SaaS. No advertising pixels.

Network calls Chat Hoarding for Mac actually makes

• POST /api/licenses/validate: sends your license key, the hashed device ID, the Mac's name and macOS version. Binds this Mac to your license on first activation, refreshes last_seen_at on later checks.
• POST /api/licenses/devices/deactivate: only when you deactivate this Mac, to free its seat.
• GET chathoarding.app/appcast.xml: EdDSA-signed update feed.
• GET chathoarding.app/dl/ChatHoarding-<version>.dmg: only when you choose to update.

Your rights (GDPR)

• Access: email [email protected] and we send the license row + activation list.
• Deletion: same email, we revoke the license and delete the row + all activations.
• Portability: same email, JSON-dump of everything we have on you (which is the row + activations).
• Rectification: change device names from /account; change email by emailing [email protected].

Children

Chat Hoarding is not directed at people under 16.

Changes

We'll update this page when the data we collect changes. Material changes get an email to license holders.

Contact

Questions: [email protected].