Security: How FlagMyChat Keeps Your Chat Private
Last updated · FlagMyChat
How your chat is protected
| Protection | What it means for you |
|---|---|
| Your file stays on your device | The WhatsApp .zip is unzipped by your own browser in a background worker. Photos, videos and other media are skipped and never read. Only the chat text file is opened. |
| Only the text needed is sent | Free previews send the newest 50 messages, the full report sends the chat text, compressed and over HTTPS. Nothing is put in web addresses, analytics or error trackers. |
| Analyzed in memory, then gone | The server holds your chat only while the AI reads it. It is never written to disk, a database or logs. When the analysis finishes, it is discarded. |
| AI that does not learn from you | Analysis runs on Google's paid Gemini API, where your inputs and outputs are not used to train models. |
| No account, no password | There is nothing to sign up for, so there is no account to hack and no password to leak. Your partner is never contacted or notified. |
| Reports are not kept | Your report is shown in your browser and emailed to you as a PDF. We do not keep a copy, so it cannot be leaked or looked up later. |
| Payments handled by PayPal | Card and PayPal details go straight to PayPal and never reach our servers. Every payment is verified server to server before a full analysis can run. |
| The little we do keep is locked down | Payment records and an email delivery log (kept 90 days) live in a database that only our server can reach, with row-level security on every table and no public access. |
| Hardened website | HTTPS everywhere with HSTS, a strict Content Security Policy, protection against clickjacking and cross-site requests, rate limits and one-time signed tokens for every analysis. |
| No ads next to your chat | Ads, where shown, appear only on blog and guide pages. The ad code never loads on the analyzer or report screens. |
What we keep, and for how long
- Your chat: never stored.
- Your report: never stored (you get it on screen and by email).
- Payment record: transaction ID, amount, date and status, kept as the law requires.
- Email delivery log: address, time, plan and delivery status, kept for 90 days.
- Free daily-limit check: a one-way hash that cannot be reversed, deleted after 24 hours.
The full list is in our Privacy Policy.
Tips for keeping your chat safe
- Export without media; the analysis only needs the text.
- Delete the exported .zip from your phone or downloads once you have your report.
- Only analyze one-to-one chats you are part of, and keep the report to yourself.
- Be careful with any analyzer that asks you to create an account and keep your chats.
Common questions
Is FlagMyChat secure?
Yes. FlagMyChat is designed so your chat is never stored: the zip is opened on your device, the message text is analyzed in memory over an encrypted connection and then discarded, and there is no account or password to steal.
Can FlagMyChat staff read my chat?
No. Chats and reports are never saved to any database, file or log, so there is nothing for anyone at FlagMyChat to open later.
Is my chat used to train AI?
No. The analysis uses Google's paid Gemini API, under terms where inputs and outputs are not used to train or improve Google's models.
Report a security issue
If you think you have found a vulnerability, email hello@flagmychat.com with “Security” in the subject. Please do not access other people's data or disrupt the service while testing. We reply as fast as we can and credit researchers who report responsibly.
Free daily preview, or the full report for one small payment. Nothing is stored.
ANALYZE MY CHAT