Privacy
OkaZip · updated 21 September 2026
OkaZip keeps conversations exported from WhatsApp. The point of the product is that they are encrypted on your device before they leave it. This page says plainly what leaves and what does not.
What never reaches the server readable
The text of your messages, the photos, the videos, the voice notes, the filenames, and the title of every conversation. All of it is encrypted in the browser with a key belonging to your account, and what goes up is the encrypted result. There is no plaintext copy anywhere on our side.
What is stored on the server
- An account identifier, which is a random number.
- How you sign in: the provider (Google or a passkey), the identifier it gives us, and any email and name that come with it.
- Your display name and profile picture, if you set one.
- Your devices: platform, a label, the passkey's public key and the date it was last used.
- How much space you use, how many conversations exist, how many messages each one holds and the date of the most recent — numbers and dates, not content.
- The encrypted blocks themselves, and your account keys in wrapped form, which only your own credentials can open.
The exception, said out loud
If you signed in with Google and never added a passkey, we are the ones holding your key — sealed in Google Cloud KMS. That is what lets you sign in on any device without losing the archive. It also means that, in that mode, we are able to decrypt your conversations. We do not, but we can, and you deserve to know.
To end that: open your account in the app, add a passkey to this device, then tap “Stop holding my key”. From then on the key is yours alone — and not even we can recover it if you lose everything.
Technical logs
Like any service on the internet, our servers log requests: IP address, date, the path requested and the browser. It is for finding faults and containing abuse. These logs are discarded within 30 days and are never joined to the contents of your archive — which would be impossible, because it is encrypted.
AI features, and the one time your messages leave readable
This is off until you turn it on, and nothing is sent before you do. Everything above describes an archive we cannot read. AI features are the deliberate exception, and they are opt-in for that reason.
When they are on and you use them, these leave your device readable:
- The text of the messages in the conversation you are asking about, decrypted in your browser and sent through our server.
- The question you typed, and the earlier questions and answers in that same thread.
- The titles of your conversations, so a question can name one.
They go to Google, which is the third party here: the
model is Gemini 2.5 Flash, called through
Google Vertex AI in the us-east1 region of
the United States. Google processes this content to produce the answer
under its Vertex AI terms, which provide for customer data not to be used
to train its models.
We do not keep what is sent. No copy of the decrypted text is written to our database or our storage. What we do record is that a read happened — the time, which conversation, and how many messages — and that log is shown to you in the app, under AI features, so the list of what has been read is yours to inspect.
Turning the feature off stops any further sending. You can turn it off at any time in the same place.
Who else is involved
OkaZip runs entirely on Google Cloud, in the us-east1 region
(United States): the server, the database, the storage of the encrypted
blocks and the key vault. Signing in with Google uses Firebase
Authentication, also Google's, which receives that sign-in data.
There is no advertising, no tracking, no third-party analytics, and nothing is sold or shared with anyone for marketing.
How long
For as long as the account exists. When you delete the archive from the account panel, the keys are destroyed first — the content stops being readable immediately, by you, by us, by anyone — and the data is removed after. There is no undo and no copy kept.
Your rights
You can see and correct what is on your account from the app itself, and you can delete all of it there too, without asking anyone. If you would rather ask us, or want a copy of your data, write to the address below.
Children
OkaZip is not directed at children under 13, and we do not collect data from anyone we know to be under that age.
Changes
If this policy changes in any meaningful way, the date at the top changes and we say so inside the app.