Effective and last updated: November 11, 2026
In short
- ConnectChats links your WhatsApp account to the AI apps you choose (such as ChatGPT or Claude) so they can read, search and summarize the chats you share and draft replies that you approve.
- Your account has no name, email address, phone number or password. You sign in with a passkey.
- We store the messages of your linked chats for 30 days on the free plan, or until you unlink the app or delete your data, whichever comes first. Message and draft text is stored encrypted with a key that only your passkey can unlock. Chat names, contact names, phone numbers, profile pictures and message times are not encrypted.
- An AI app sees only what its tool calls return, and only from the chats you share.
- We do not sell your data, we do not use it for advertising, and we do not train AI models on your messages.
Who we are
ConnectChats is operated by EchoWave Incorporated ("ConnectChats", "we", "us"), Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, P.O. Box 30099, Ras Al Khaimah, United Arab Emirates. This policy covers the website at connectchats.com, the
ConnectChats web app at https://connectchats.com/app and the ConnectChats MCP server at https://api.connectchats.com/mcp, which AI apps connect to.
For questions about this policy or your data, write to contact@connectchats.com.
For the personal data described here we act as the controller. When you use ConnectChats, you decide which chat apps to link, which chats to share and which AI apps to connect, and we process the data in those chats on your instructions.
Information we collect
Account and sign-in
When you create an account we store a random account id, your plan and the time the account was created. For your passkey we store its credential id, its public key, a signature counter, the transports your device reports and the time it was created. We never receive your passkey's private key or your device's biometric data. Your passkey is saved in your password manager as "ConnectChats" followed by six characters of your account id.
Your browser also creates a key pair that encrypts your messages. We store its public half and a copy of its private half (your data key) that is itself encrypted with a secret from your passkey. We never store your data key in readable form.
To limit abuse, we count how many accounts are created from each IP address in a one-hour window (at most 10). This counter holds the IP address, the start of the window and a count, and is not linked to your account.
Cookies
The web app sets a session cookie that keeps you signed in for 30 days. It holds your account id, its expiry and your data key, encrypted and signed by our server. Two short-lived cookies (5 minutes and 2 minutes) carry the sign-in steps. These cookies are needed for the service to work; we use no advertising or analytics cookies. The marketing website sets no cookies and runs no analytics. Its pages load fonts from Google Fonts, so your browser requests those files from Google.
Linked chat apps
WhatsApp is the chat app available today. When you link it, ConnectChats becomes a linked device on your WhatsApp account, named "ConnectChats", in the same way WhatsApp Web is. The session of that linked device is kept on our server so it can receive and send your messages. We store the account's name as WhatsApp reports it (your phone number) and its connection state. We never ask for or receive your WhatsApp password or verification codes.
Chats and contacts
For each chat of a linked account we store its name, whether it is a direct chat or a group, its picture, the names, profile pictures and identifiers of its members (identifiers are derived from phone numbers), your settings for it (shared with your AI or not, auto-send on or off), when you last read it and when its last message arrived.
Messages
When you link WhatsApp, we import the last 200 messages of each chat, then every new message. After an interruption on our side, up to 500 missed messages per chat are caught up. For each message we store its text, its sender (name and identifier), its time, its kind, the message it replies to, whether it was edited and, for messages sent through ConnectChats, whether delivery was confirmed. Photos, videos, voice notes and files are not kept: we store only a short text description of them and their caption. Stickers and GIFs without a caption are not stored. These messages include what other people wrote to you and in your groups.
Drafts
When your AI app drafts a reply, we store its text, the chat it is for, the message it replies to, its status (waiting, sent or discarded), how often a send was tried and why the last attempt failed, if it did.
Connected AI apps
When you connect an AI app, we store the name and redirect addresses it registers (the app names itself; we do not verify the name), your account id, when you connected it, and what we need to check the access and refresh tokens it uses. Each connection holds its own copy of your data key, encrypted with that app's token, so the app can open the chats you share without asking for your passkey on every request.
Logs
Our services write operational logs to run and secure ConnectChats: timestamps, event names, internal ids (such as account, chat, room and message ids) and error codes. They are written not to contain message text, draft text, your data key or passkey secrets. Our hosting provider Cloudflare also records technical request logs for the website and the web app.
Usage analytics
To understand how ConnectChats is used, our servers record usage events under your random account id: that you created an account, signed in or out, opened a page of the web app, linked, unlinked or lost a chat app (and which app), connected or disconnected an AI app (and the name it gave itself), changed a chat's sharing or auto-send setting, sent or discarded a draft, and, for each tool call, the tool's name, whether it worked, how long it took and the user agent of the AI app that made it. Web app events also carry the country Cloudflare reports for your connection. They never contain message text, draft text, search words, chat or contact names, phone numbers or your IP address. The web app sets no analytics cookies and runs no analytics code in your browser: events are sent by our servers. They go to PostHog, an analytics service that runs on a server we operate.
Error reports
When something fails in our services, we send an error report to Sentry: the error's type and code, where in our code it happened, your random account id, the request's method and path and your browser's user agent. Error reports are built to contain no message text, draft text, request bodies, cookies, tokens or IP addresses.
Support emails
When you write to us, we keep your email address, your message and our reply to answer you.
What is encrypted and what is not
Stored messages are encrypted with a key that only your passkey can unlock. We keep no copy of that key, so we cannot read your stored messages. The text of every message and draft, including the descriptions and captions of photos, voice notes and files, is encrypted with AES-256-GCM. The rest is stored unencrypted: chat names, contact names, phone numbers and other identifiers, profile pictures, the time and kind of each message, who sent it and which message it replies to, and your settings.
Because our server is the linked device that receives your messages, a message is readable on it for a short time. The messaging server and the WhatsApp bridge we run keep a plain-text copy of each message while it arrives. We remove those copies automatically: the copy in the messaging server is blanked within seconds of being stored encrypted, cached copies expire within 2 minutes, the bridge's history import rows are deleted 15 minutes after an import goes quiet, and the bridge's retry buffers are deleted after at most 24 hours. Pieces of the text can remain in the database's internal log for a few more minutes. A message you send through ConnectChats stays readable until WhatsApp confirms it, usually within seconds and at most 24 hours. Files attached to a message are deleted from our server when the message is processed, and in any case after 7 days.
When your AI app asks for messages, they are decrypted for that request in our Cloudflare Worker and sent to the AI app. Search also runs there, on decrypted text, because the server never holds your key. More detail, including the limits of this protection, is on our security page.
Why we use your information, and the legal bases
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases under the GDPR (and its UK and Swiss equivalents):
- To provide ConnectChats (performance of our contract with you): creating and signing in to your account, linking your chat apps, importing and storing your messages, answering your AI app's tool calls, saving drafts and sending the messages you approve or allow.
- To process the messages and contact details of the people you chat with (legitimate interests): you and we have a legitimate interest in giving you access to your own conversations through the tools you choose. We limit this to the chats you link, keep message text encrypted, and delete it on the schedule below.
- To keep ConnectChats secure and prevent abuse (legitimate interests): sign-up limits, logs, error reports and investigating failures.
- To understand how ConnectChats is used and improve it (legitimate interests): the usage analytics described above, which hold no message content and are tied only to your random account id.
- To answer you (legitimate interests, or our contract with you): replying to support requests.
- To comply with the law (legal obligation): responding to valid legal requests and keeping records the law requires.
We do not use your messages, contacts or drafts for advertising, to build profiles, or to train AI models, and our staff do not read them. Message text is encrypted in a way we cannot open.
Who receives your information
We do not sell personal information or share it with data brokers. It reaches these parties, only as far as each needs:
- Cloudflare, Inc. hosts the website and runs the web app, the sign-in, the AI app connections and the MCP server (Cloudflare Workers). Accounts and passkeys are stored in Cloudflare D1, AI app connections and their tokens in Cloudflare Workers KV. Traffic between Cloudflare and our server goes through Cloudflare Tunnel and Cloudflare Access.
- Hetzner Online GmbH provides our server in Helsinki, Finland, which runs the WhatsApp bridge, the messaging server and the message store. Its data volume is encrypted at rest. Hetzner also hosts the server we operate for our usage analytics (PostHog).
- Functional Software, Inc. (Sentry), in the United States, receives the error reports described above to help us find and fix failures.
- WhatsApp (Meta Platforms). ConnectChats connects to WhatsApp as a linked device on your account, so WhatsApp receives the messages you send through ConnectChats and sees that device and the server it connects from. WhatsApp processes your data under its own terms and privacy policy.
- The AI apps you connect, such as ChatGPT (OpenAI) and Claude (Anthropic), and their providers receive your tool inputs and the tool outputs described below, and process them under their own terms and privacy policies. We do not receive your conversation with the AI app, only the tool calls it makes.
- Authorities and others where the law requires it, or where reasonably necessary to enforce our terms, investigate abuse or security issues, or protect the rights and safety of our users, the public or us.
- A successor, if EchoWave Incorporated is involved in a merger, acquisition, financing, reorganization or sale of assets, subject to notice and continued protection of your information.
What each MCP tool receives and returns
These are all the tools ConnectChats offers to AI apps. A tool can reach only the chats you share: a chat you do not share is never listed, searched or read, and a tool asked for it answers that it is not available. Tool outputs are at most 20,000 characters. Every tool that returns message text marks it as written by other people and tells the AI to treat it as data, never as instructions. Times are in UTC.
| Tool | Inputs | What it returns or does |
|---|---|---|
list_linked_apps | None. | One line per linked chat app account: the app (for example WhatsApp), the account's name as the app reports it (for WhatsApp, your phone number), its connection state and its account id. |
list_chats | Optional: an app, an account, unread only, how many chats (up to 50) and a page cursor. | Your shared chats: the app, the chat name, the unread count, the time of the last message, a preview of the last message (up to 120 characters) and the chat id. |
read_messages | A chat id. Optional: how many messages (up to 200), only messages before a time, only messages since you last read the chat, and a page cursor. | The chat's name and its messages: the time, the sender's name (or "You"), the text, the kind of message (a photo, a voice note and so on) with its caption, whether it was edited and, for messages sent through ConnectChats, whether delivery was confirmed. |
search_messages | Words to look for. Optional: an app, an account, a chat id, how many results (up to 50) and only messages before a time. | Matching messages, newest first, each with its chat name, app, chat id, time, sender and text. On the free plan, one search checks your 5,000 most recent messages. |
get_messages_to_summarize | A chat id. Optional: a start time (by default, since you last read the chat). | Up to 300 messages from that chat, in the same form as read_messages, for your AI app to summarize. ConnectChats itself does not summarize or run any AI model on your messages. |
draft_reply | A chat id, the text of the reply (up to 4,000 characters) and optionally the id of the message it replies to. | Saves a draft (stored encrypted) and returns its id and a link where you approve or discard it. Nothing is sent. |
send_message | A chat id, the text (up to 4,000 characters) and optionally the id of the message it replies to. | In a chat where you turned on auto-send, sends the message through the chat app and returns whether delivery was confirmed, is pending or failed (with the reason). In every other chat, saves a draft instead and returns its approval link. |
Tool inputs are used only to run the request. We keep nothing from a tool call except what it creates (a draft, or a message sent and stored like any other message) and the usage event described in Usage analytics, which records the tool's name, whether it worked and how long it took, never its inputs or outputs.
How long we keep your information
- Messages and drafts: 30 days on the free plan (messages by the time they were sent, drafts by the time they were created), checked every hour. They are deleted sooner when you unlink the chat app, wipe your data or delete your account.
- Chats and contacts: while the chat app is linked. They stay listed after their messages expire, because a chat's name is not message content.
- Unlinking: when you unlink WhatsApp in ConnectChats, we delete its chats and messages at once. If you remove the ConnectChats device on your phone instead, we notice within about 5 minutes and delete them then.
- Plain-text copies on our server: removed within seconds to 24 hours, as described in What is encrypted. Photos, voice notes and files are not kept.
- AI app connections: until you disconnect the app, wipe your data or delete your account. Disconnecting destroys that app's copy of your data key.
- Account and passkeys: until you delete your account. After deletion, our message store keeps your random internal id and the public keys used to encrypt your messages, which contain no message content and cannot decrypt anything.
- Sign-up counter: kept only to enforce the hourly limit, and not linked to any account.
- Logs: for the limited time our hosting setup keeps them, and longer only when needed for an incident, dispute or legal obligation.
- Error reports: up to 90 days in Sentry.
- Usage events: as long as we need them to understand how ConnectChats is used. They are tied only to your random account id, which identifies no one once your account is deleted.
- Support emails: as long as needed to answer you and keep a record of the request.
If WhatsApp unlinks ConnectChats on its side, for example because your phone stayed offline for about 14 days, ConnectChats treats it like an unlink and deletes that account's chats and messages.
Your controls
- Choose which chats your AI sees. In the web app, under Chats, turn "Share with my AI" on or off for each chat. New chats of a linked app are shared by default; turn off "Share new chats" for that app to change this.
- Approve every send. Your AI's messages are saved as drafts that you send or discard in the web app. Auto-send is off for every chat until you turn it on for that chat and confirm a warning; you can turn it off at any time.
- Unlink a chat app in Settings or under Link a chat app, or remove the ConnectChats device in WhatsApp under Settings, Linked devices.
- Disconnect an AI app in Settings, Connected AI apps. Access stops at once. Content the AI app already received stays with that app.
- Wipe your data in Settings: unlinks every app, disconnects every AI app and deletes all chats, messages and drafts. Your account stays.
- Delete your account in Settings: does all of the above and deletes your account and passkeys. It cannot be undone.
You also have the right to access, correct, export, restrict or object to the processing of your personal data, and to have it deleted. Write to contact@connectchats.com. Because your account has no email address, we may ask you to prove the account is yours, for example from the web app. We cannot decrypt your stored messages, so we cannot export or recover their text for you, and if you lose your passkey we cannot recover your account. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also lodge a complaint with your data protection authority.
Security
Every connection uses TLS. Message and draft text is encrypted with a key that only your passkey can unlock. Our server accepts no connections from the internet: the web app reaches it only through Cloudflare Tunnel with Cloudflare Access, and administrators reach it only over a private network. Its data volume is encrypted at rest. Every request is scoped to your account, so one user can never reach another user's chats or drafts. The full picture, including where the protection stops, is on our security page.
International transfers
Our server is in Finland. Cloudflare processes requests on its global network, EchoWave Incorporated is based in the United Arab Emirates, and the AI apps you connect may process tool outputs in other countries. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.
Children
ConnectChats is not intended for children and you must be old enough to accept our Terms of Service to use it. We do not knowingly collect data from children. If you believe a child created an account, write to contact@connectchats.com and we will help delete it.
Changes to this policy
We will post any change on this page and update the date above. If a change is significant, we will give a more prominent notice, such as a message in the web app. We will not reduce your rights under this policy without your consent.
Contact
EchoWave Incorporated, Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, P.O. Box 30099, Ras Al Khaimah, United Arab Emirates (D-U-N-S 85-108-5644). Email: contact@connectchats.com.