Privacy Policy for WA Backup

Effective date: September 14, 2026

WA Backup ("the Extension", "we", "us") is a browser extension published by Extino Ltd that archives the user's own WhatsApp Web chats, contacts and media. This policy explains what the Extension handles, where it is stored, and the limited circumstances in which any of it leaves your device.

1. Summary

2. Information the Extension handles

To build your archive the Extension reads, from the WhatsApp Web tab you have open: your chat list, messages (text, captions, timestamps, sender names and identifiers), contacts, and - if you enable media backup - photos, videos, voice notes and documents. This information is stored in a local database (wa_archive) belonging to the Extension on your computer. It is never sent to WhatsApp, to Meta, or to us by this feature.

The Extension never sends messages, never marks chats as read and never changes anything in your WhatsApp account. It only reads.

3. Local storage and export

The archive, your settings, your device identifier and your archive encryption key are kept in Chrome's extension storage on your device. You can export selected chats to a ZIP file (HTML, JSON, CSV and media) at any time, and you can delete the entire local archive from the Extension's settings ("Wipe local archive"). Uninstalling the Extension removes its storage.

4. Optional cloud backup (zero-knowledge)

If you create or sign in to a WA Backup cloud account, the Extension uploads an encrypted copy of your archive to a server operated by Extino Ltd at inboxcrm.extino.net. Before anything leaves your device it is encrypted with AES-256-GCM using a recovery key generated on your device. The server never receives that key: it stores only ciphertext, opaque record references and timestamps, and cannot read your messages, contacts or media. We can see your account email, the amount of encrypted storage you use, and connection metadata such as IP address and time, which we use to operate the service and prevent abuse.

You can disconnect the cloud account from the Extension at any time. From the web viewer's account settings you can delete every stored record, or delete the account entirely, which removes all your data from our server immediately (nightly backups containing ciphertext are retained for up to 7 days). If you lose your recovery key, the cloud copy cannot be decrypted by anyone, including us.

5. Account sign-in (Extino)

The Extension can offer an optional Extino account sign-in for paid features. When you use it, our account service (api.extino.net) receives your email address and subscription status and stores a session token in the Extension. Payments are handled by Stripe on Extino-hosted pages; the Extension never sees card details.

6. Permissions

The Extension requests access to web.whatsapp.com (to read your chats), inboxcrm.extino.net (cloud backup, only when enabled), api.extino.net (account sign-in, only when used), plus storage, alarms, tabs, side panel and identity permissions needed for those features. It requests nothing else and does not read other websites.

7. Data sharing and selling

We do not sell, rent or share your data with third parties. Message content is never transmitted to anyone in readable form.

8. Children

The Extension is intended for adults managing their own WhatsApp account and is not directed at children under 16.

9. Changes

We will update this page when the policy changes and update the effective date above.

10. Contact