Privacy Policy

Last updated: September 15, 2026

Data we process

When you sign in, we store your Google account identifier, email address and email-verification status. We also store a random extension installation identifier, extension ID and version, locale, hashed session credentials and feature entitlement records. Standard security logs may temporarily contain an IP address, timestamp, request path and request ID.

Data that stays local

WhatsApp messages, media, contacts, phone numbers, chat names, mute state and WhatsApp page content never leave the browser. Local sound preferences are not uploaded.

Purpose and sharing

Account data is used only to authenticate you, unlock features, prevent abuse and operate the service. We do not sell data or use it for advertising. Google is used only as the sign-in provider; hosting infrastructure processes requests needed to run the API.

Our use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Retention and deletion

OAuth states expire after 10 minutes, login tickets after 60 seconds and refresh sessions after 30 days. To request deletion, follow the instructions on the Account and Data Deletion page linked from the homepage. After a verified request, the account and related installations, sessions and entitlements are removed from the active database. Database backups rotate within seven days.

Security

Refresh credentials are stored as hashes, access rights are digitally signed and additional sounds are integrity-checked by the extension.

WhatsApp Sound Box is independent and is not affiliated with WhatsApp LLC or Meta Platforms, Inc.