Disclaimer and Responsible Use
Relevant source files
The following files were used as context for generating this wiki page:This document outlines the privacy, security, and responsible use principles of the WhatsApp Chat Analytics tool. The project is explicitly designed for personal use, with an architecture that ensures all user data remains on their local computer.
The core principle is that user messages are never uploaded to the internet or any external server. The entire analysis process, from backup decryption to data visualization, occurs within the user's local environment. This design is a fundamental aspect of the tool's commitment to user privacy.
Sources: README.md:3-4, README.md:81-82
Guiding Principles
The project's README.md file contains an "Important Disclaimer" section that establishes the rules for using the software. These rules are a mix of technical guarantees provided by the software's architecture and ethical guidelines the user must follow.
Sources: README.md:84-92
Summary of Terms
| Principle | Description | Implementation/Responsibility |
|---|---|---|
| Personal Use Only | The tool is designed solely for personal use. | User Responsibility |
| Analyze Own Backups | Users should only decrypt and analyze backups that belong to them. | User Responsibility |
| Respect Privacy Laws | Users must respect privacy laws and WhatsApp's terms of service. | User Responsibility |
| No Unauthorized Access | Do not use the tool to access someone else's messages without permission. | User Responsibility |
| Independent Project | This is an open-source project not affiliated with or endorsed by WhatsApp or Meta. | Informational |
| Sole Responsibility | The user is solely responsible for how they use the software. | User Responsibility |
| Use At Your Own Risk | The software is provided "as is" without any warranties or guarantees. | Legal Disclaimer |
Sources: README.md:85-92
Local-Only Data Architecture
The primary technical feature supporting the responsible use policy is the local-only data processing architecture. At no point in the workflow are user messages or database files transmitted over the network.
The following diagram illustrates the complete data flow, which is confined to the user's machine.
This diagram shows that all stages, from decryption to analysis, occur on the user's local machine.
Sources: README.md:28-79, chatsExporter/whatsapp_db_android_exporter.py, web/src/Pages/SearchSQLite/index.jsx
1. Local Decryption
The decryption process is handled by the whatsapp_db_android_exporter.py script. This script requires the user to provide their 64-character encryption key in a local .env file.
- The script reads the
ENCRYPTION_KEYandTARGET_DIRfrom the local.envfile. - It uses the
wa-crypt-toolslibrary to runwacreatekeyandwadecryptcommands locally. - The output is a decrypted
.dbfile saved in the same local directory.
The sensitive encryption key never leaves the user's machine during this process.
Sources: chatsExporter/whatsapp_db_android_exporter.py:43-45, chatsExporter/whatsapp_db_android_exporter.py:90-97
2. Client-Side Web Application
The analysis portion of the tool is a React-based single-page application that runs entirely in the user's web browser.
- The
npm startcommand initiates a local development server for the user to access the application athttp://localhost:3000. - The application's dependencies, listed in
package.json, includesql.js, a library that allows SQLite databases to be queried directly within the browser without a server-side backend. - The main HTML file,
index.html, simply provides a root element for the React application to mount into. No external scripts that could transmit data are loaded.
Sources: web/package.json:28, web/package.json:16, web/public/index.html
3. In-Browser File Handling
When the user "uploads" the msgstore.db and model-storage-chat.json files, they are not sent to a server. The <Uploader> component is configured with action="#", preventing a network request. Instead, the files are read directly into the browser's memory using the FileService.
The useFileUpload hook manages this process:
- The user selects a file via the
Uploadercomponent. - The
onChangeevent triggers thehandleFileUploadfunction. FileService.readAsArrayBufferorFileService.readAsTextreads the file content.- The content is processed locally (e.g., initializing the
sql.jsdatabase from the array buffer).
The sequence diagram below details this client-side interaction.
This diagram shows how a file is selected by the user and processed entirely within the browser without any server communication.
Sources: web/src/Pages/SearchSQLite/components/UploadStep.jsx:20, web/src/Pages/SearchSQLite/hooks/useFileUpload.js:31-41
Conclusion
The "Disclaimer and Responsible Use" policy is a cornerstone of the WhatsApp Chat Analytics project. It is technically enforced by a strict local-only architecture that guarantees user messages and keys are never sent to any external server. The Python decryption script and the React web application are both designed to run exclusively on the user's machine, giving the user full control over their private data. Users of this tool are expected to adhere to the ethical guidelines of using it only for their own data and in compliance with all relevant laws.
Sources: README.md:81-92