Mellow Grid Labs Privacy Policy
Last updated: October 24, 2026
Scope
This policy applies to the WhatsApp Sound Box and WhatsApp Chat Grid Chrome extensions and their supporting Mellow Grid Labs services. Both products can be used without signing in. Google sign-in is optional. It can save the limited product settings described below or show linked products in the Mellow website account.
Mellow website account
If you sign in on mellowgridlabs.com, we store your verified Google subject identifier and email address, hashed OAuth state and browser-session tokens, and their expiry times. A Secure, HttpOnly, SameSite=Lax cookie keeps your website session for at most 30 days. We compare the verified Google subject identifier with separate product-account records to show which products you use. We do not merge extension sessions or copy their settings into the website account. The website requests only the openid and email scopes.
Information used by both products
If you choose Google sign-in, the relevant product stores your Google account subject identifier, email address, verified-email status, a random account installation identifier, extension ID and version, locale, hashed session credentials and entitlement records. We do not receive your Google password or access Google mail, contacts, files or calendar data. The sign-in request is limited to the openid and email scopes.
Standard security logs may temporarily contain an IP address, timestamp, request path and request ID. They are used to secure and operate the services.
WhatsApp Sound Box
If you use account sync, Sound Box stores whether the extension is enabled, the selected built-in sound and the one-sound-per-unread-chat setting. WhatsApp messages, media, contacts, phone numbers, chat names, message and chat identifiers, mute and unread state, per-chat sound assignments and WhatsApp page content never leave the browser and are not sent to the Sound Box API.
Sound Box stores its local settings, account session, a separate random analytics identifier, the last analytics-report time and the review-request schedule in the Chrome profile. A browser-session flag prevents repeated review requests during one browser start. The extension cannot read whether a rating or review was submitted.
WhatsApp Chat Grid
Chat Grid reads the conversations selected by the user so it can render the grid and activate the native WhatsApp composer. WhatsApp messages, media, contact and group names, phone numbers, chat identifiers and drafts are processed in the browser and are not sent to the Chat Grid API. The extension does not automatically send WhatsApp messages.
Chrome local storage keeps the selected layout, scale settings, language, panel assignments, default chat identifiers, account session, signed entitlement, analytics timing and review-request state. If you use account sync, Chat Grid stores only the panel count and layout scale settings. Panel assignments, default chat identifiers and chat content are not synchronized.
Technical counters
At most once per 24 hours while either extension is running, it can send a separate random analytics identifier, extension version and locale. The API immediately stores only a SHA-256 hash of that identifier with first-seen and last-seen timestamps. This record has no user ID, email address, Google identifier, chat identity or message content. It is used only for aggregate known-installation and active-installation counts and is deleted after 400 days without activity.
The extensions can send allowlisted technical event names with limited technical fields such as version, locale and, for Chat Grid, selected layout. These events are stored only as daily aggregate counters without a user ID, installation ID, chat identity or message content. A click on Rate extension does not confirm a submitted rating or identify who clicked. Aggregate counters are retained for 400 days.
Chat Grid diagnostic reports
A Chat Grid diagnostic report is sent only after the user presses Send report to developer. It contains a bounded set of technical fields such as reason, extension and WhatsApp versions, locale, layout, panel positions, capability booleans, bounded timings and safe error codes. It contains no message text, chat or contact names or identifiers, phone numbers, DOM snapshots, cookies, drafts, attachments, OAuth tokens or refresh tokens.
Diagnostic reports do not store a user ID or installation ID and are deleted after 30 days. One installation can submit one accepted report every 15 minutes, with additional source-address and global limits to prevent abuse.
Purpose, sharing and sale
We use data only to authenticate users, synchronize the limited settings listed above, prevent abuse, operate and secure the services, investigate user-submitted diagnostics and understand aggregate product use. We do not sell data or use it for advertising, creditworthiness or unrelated profiling. Google is used only as the optional sign-in provider. Hosting infrastructure processes encrypted traffic and stored data only as necessary to operate the services.
Retention and deletion
OAuth states expire after 10 minutes, login tickets after 60 seconds, access tokens after 15 minutes and refresh sessions after 30 days. Mellow website OAuth states expire after 10 minutes and web sessions after at most 30 days. Account, installation, entitlement and synchronized-preference records are retained while the account exists. A verified deletion request removes them from the relevant active database. Daily rotating database backups may retain removed records for no more than seven backup cycles.
Deletion instructions are available for the Mellow website account and separately for WhatsApp Sound Box and WhatsApp Chat Grid. Removing an extension from Chrome deletes its locally stored settings and identifiers from that Chrome profile.
Security
Network requests use HTTPS. Refresh credentials are stored as hashes, access rights are digitally signed and API requests are accepted only from allowlisted extension origins. Sound Box and Chat Grid use separate OAuth clients, token audiences, sessions, signing keys, storage keys and databases. The Mellow website has its own OAuth client and revocable web sessions; its account view reads only whether a matching verified Google subject exists in each product database.
Google API Limited Use
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Contact
Questions and deletion requests can be sent to mellowgridlabs@gmail.com.
Mellow Grid Labs products are independent and are not affiliated with WhatsApp LLC or Meta Platforms, Inc.