Privacy Policy

WA Mail Sync

Last updated: August 6, 2026 — previously published as “WhatsApp Chat Sync to Gmail”; the app is the same, renamed because it is no longer Gmail-only.

Summary

This app copies WhatsApp chat exports that you provide into your own mailbox. It runs entirely on your device. There is no backend server, no account system, no analytics, and no advertising — the developer never receives, stores, or has access to your messages, your mail, or your accounts.

There are two ways to connect, and which one you choose determines what the sections below apply to:

• An email app password (IMAP) — the default. Works with any IMAP provider, including Gmail, Outlook, Yahoo, iCloud and Fastmail. No Google account or Google user data is involved unless the IMAP server you point it at happens to be Gmail's.
• Google sign-in (OAuth) — Gmail only. The Google-specific sections below apply to this option.

What Google user data the app accesses

The app accesses the following Google user data, and nothing else. Each item is obtained through the Google OAuth scope named beside it, which you grant on Google's own consent screen:

• Write access to add new messages to your Gmail mailbox (https://www.googleapis.com/auth/gmail.insert). This permission allows the app to add a message to your mailbox. It grants no ability to read, search, modify, delete, or send any mail that is already in your account, and the app does not receive the contents of your mailbox through it.
• The list of Gmail labels in your account, and the ability to create labels (https://www.googleapis.com/auth/gmail.labels). The app reads the names and IDs of your existing labels only so that it can tell whether the label it needs already exists, and creates the label if it does not. Label names and IDs are the only Google user data read here; no message content is accessed by this scope.
• The email address of the Google account you connect (https://www.googleapis.com/auth/userinfo.email, Android app only). This is the address string only — no name, profile photo, contacts, or any other profile field.

The app requests no read scope for your mail, and no access to Google Contacts, Google Drive, Calendar, or any other Google service.

If you connect with an email app password (IMAP)

On this option no Google user data is accessed and no OAuth token exists. Instead:

• You supply your email address, your provider's IMAP host and port, and an app password — a separate credential your provider issues for one application, which you can revoke at any time without changing your real password.
• That app password is stored only on your own device and is sent only to the IMAP server you named. On Android it is encrypted with the Android Keystore. On Windows it is held in the app's own data folder, readable only by your Windows user account.
• The app uses the IMAP APPEND command, which adds a message to a folder. It creates the folders it needs and lists folder names to check whether they already exist. It does not fetch, search, modify or delete any message already in your mailbox, and it never sends mail.

Your mail provider necessarily sees the messages you archive, because they are stored in the mailbox they host for you. That relationship is governed by your provider's own privacy policy, not this one.

How the app uses Google user data

Google user data is used for one purpose only: to place the WhatsApp chat export that you supply into your own Gmail account as ordinary, organised emails. Specifically:

• The Gmail write (insert) permission is used to add each rendered WhatsApp message — with its original text, timestamps, sender names, and any photos, videos, or documents from the export — into your mailbox as a new email. This is the app's core and only feature. The app deliberately does not use gmail.send, so nothing is ever transmitted to any recipient; the message simply appears in your own mailbox.
• The label data is used to find or create a parent WhatsApp label and a child label named after the chat (for example WhatsApp/Mom), and to apply that label to the messages the app adds, so your archive is browsable and searchable in Gmail.
• The email address is displayed inside the app as "Connected as <address>", so you can confirm you are archiving into the intended mailbox before you start a sync. It is used for display only.

Google user data is never used for advertising, never used to build a profile of you, never used to train any machine-learning or AI model, never sold, and never used for any purpose other than the ones stated above.

How the app shares Google user data

It does not. Google user data is not transferred to the developer or to any other person, company, or service. It moves only between your own device and Google's own API endpoints. There is no developer-operated server, no analytics provider, no crash-reporting service, and no third-party SDK that receives it. The only circumstance in which any of it would be disclosed is if you choose to do so from your own Gmail account.

Limited Use disclosure

The app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention and deletion

The developer retains no Google user data, because the developer never receives any. On your own device, the OAuth token is stored until you disconnect or uninstall, and the local dedup database (message hashes only, no message content) is stored until you uninstall or clear the app's data. On the IMAP option there is no token; the saved app password is kept until you clear it in the app or uninstall. Emails the app has added to your mailbox are yours — delete them like any other message at any time.

Where your data goes

Nowhere but your own device and your own mailbox. The WhatsApp export file you share or import is copied into the app's private storage on your device, parsed there, and sent directly from your device to your mail provider — Google's Gmail API over HTTPS on Google sign-in, or your provider's IMAP server over TLS on an app password. In neither case is there an intermediate server operated by the developer that your messages, attachments, or credentials ever pass through.

The app keeps a small local database on your device (message hashes and sync status) purely to avoid re-sending the same message twice. This database never leaves your device. Deleting the app removes it.

How your data is protected

Because the messages you sync are sensitive personal data, the app is built so that this data is exposed to as few systems as possible:

• Encrypted in transit. Every network request the app makes — the OAuth sign-in and every Gmail API call, or every IMAP connection — goes directly to your mail provider over TLS. Your messages, attachments, access tokens, and app passwords are never sent over an unencrypted connection.
• No developer server, ever. There is no backend operated by the developer. Your data travels only between your own device and your own mail provider's servers, so there is no third-party system that could store, log, or leak it.
• Credentials stay on your device. The OAuth access and refresh tokens are cached only in local app storage on your device (auth/token.json on Windows; app-private storage on Android). They are never transmitted anywhere except to Google's own OAuth endpoints to obtain access.
• Minimal local footprint. The only thing the app keeps is a small on-device database of message hashes and sync status, used purely to avoid re-sending the same message. It contains no message content and never leaves your device.
• You control access and can revoke it instantly. Access is limited to the narrow scopes listed above and can be withdrawn at any time (see the next section), which immediately invalidates the stored tokens.

Because your data lives only on your own device and in your own Google account, we recommend protecting both with the usual safeguards — a device lock/OS-level encryption, and two-step verification on your Google account.

Account connection & revoking access

Google sign-in. You can disconnect the app at any time from within the app itself (Settings → Disconnect), or by visiting your Google Account's third-party access page and removing it from the list. It is listed there under the name registered on Google's consent screen, "WhatsApp Chat Sync to Gmail".

Email app password (IMAP). Clear the saved password in the app (Settings → Forget saved password), and revoke the app password with your mail provider so it cannot be used again.

Either way, revoking access does not delete anything already synced — those are ordinary emails in your mailbox and are yours to keep or delete like any other message.

Third parties

None. The app does not share, sell, or transmit any data to any third party. The only network calls it makes are to Google's own OAuth and Gmail API endpoints, directly from your device.

Changes to this policy

If this policy changes, the updated version will be published at this same address with a new "Last updated" date.

Contact

Questions about this policy or the app can be raised as an issue on the GitHub repository.