Is it safe to upload your WhatsApp chat?
It comes down to one thing: whether the file leaves your device. That's the question to ask any tool before handing it a private conversation.
The actual risk
An exported chat contains everything: names, phone numbers, addresses, years of what you said to each other. Upload it to a server and that sits on a computer you don't control, subject to that company's policies and to whatever happens to that company later.
Most online analyzers work exactly that way: you send the file, they process it, they send back a result.
What's actually inside an exported chat
It's worth opening the file before deciding whether to upload it anywhere. A year of chat holds the names exactly as you saved them, the phone numbers of everyone who spoke in a group, every link that was shared, and the exact time of every message across months.
That last one is the most underestimated. Timestamps on thousands of messages draw a routine: what time you wake up, which days you're away, who you talk to at 3am, when you stopped writing to someone. None of that requires reading a single conversation.
And it isn't only yours. In a group of twenty people, the file holds the data of twenty people.
The alternative: processing in the browser
A website can read a file without sending it anywhere. The browser opens it locally, does the math on your own device, and shows you the result. The file never travels.
That's how this tool works. There's no server receiving your chat because there's nothing to send.
"We don't look at it" is not "we don't receive it"
This is the distinction the whole subject turns on. A company that receives your file can promise nobody will read it, and it may well be telling the truth. But the promise depends on it continuing to be kept: on nobody slipping up, on nobody breaking in, on nobody changing their mind next year, on the company still existing.
A file that is never sent needs no promise at all. There's no copy to leak, no policy to rewrite, no new owner to reinterpret it. That's the difference between trusting someone and not having to.
How to check for yourself
You don't have to take a website's word for it. You can test it:
The airplane mode test
Load this page, disconnect from the internet, and upload your file. If it still works, nothing is being sent. With a server-based tool, this fails.
Watch the network traffic
Open your browser's developer tools (F12), go to the "Network" tab, and upload the file. You'll see no request goes out carrying its contents.
Read the page's own policy
The site is served with a Content-Security-Policy header, and the browser is what enforces it, not us. Its connect-src directive does not include our own origin: the page has no permission to open a connection back here, not with fetch, not with XHR, not with a WebSocket. The only destinations allowed belong to the ad provider, which never touches the file. You can read it in that same Network tab, under the document's response headers.
The counter right above
At the top of the page, next to the site name, there is a readout that counts, using the browser itself, the requests this site makes after the chat is read. With a file loaded it reads zero. It deliberately leaves out the ad provider: the requests that matter are the ones that could carry your chat away, and those would be ours.
What can happen to a chat on a server
This isn't abstract paranoia — the risks are concrete and documented.
Breaches
Any database can leak. If your conversation sits on a server, it joins the set of things that can end up published if that company has an incident.
Change of ownership
A privacy policy binds the company that wrote it. If the site is sold, the data usually goes with it, and the buyer can rewrite the rules.
Training data
Plenty of terms of service include a broad license over whatever you upload. Real conversations are valuable material for training language systems.
Third parties who never agreed
A chat also contains other people's messages, and they never consented to anything. Uploading it decides for them.
What to look for in a privacy policy
If a tool asks you to upload the file and you still want to use it:
- Does it say how long files are kept? "Deleted after processing" isn't the same as never stored.
- Does it claim any rights over uploaded content?
- Does it name the third parties it grants access to?
- Is there a way to request deletion, and on what timeline?
A policy that doesn't answer those four isn't a policy, it's decorative legal text.
Why this works without a server
It isn't a trick: modern browsers can read local files with the File API and run heavy computation in a Worker without freezing the screen. Everything this tool does — counting, grouping, sorting, computing medians — is arithmetic that runs fine on a phone.
The reason many tools use a server isn't technical. A server lets you keep the data, and the data has value.
What to check in any tool before uploading a chat
- Does it say explicitly where the file is processed?
- Does it ask you to create an account? No server means no account needed.
- Does it have a privacy policy that says how long data is kept?
- Does it work offline once the page has loaded?
What this tool does
- The file is read in your browser and never sent to any server.
- No signup, no accounts.
- Nothing is stored: close the tab and it's all gone.
- It works offline once the page has loaded.