Privacy Policy for Export Chat Reader | Cibru

Privacy Policy – Export Chat Reader # Privacy Policy Export Chat Reader · `com.exportchatreader.app` · Effective October 20, 2026 > **Chat reading is local; the whole app is not network-free.** Export Chat Reader reads WhatsApp conversations from `.txt` or `.zip` archives you select. Imported chat text and media are parsed, stored, searched, displayed, and played on your device. The app does not upload that content to our verification/referral servers or supply it to advertising providers. Advertising, Google Play purchases, purchase verification, opted-in referrals, and external links use network services. ## 1. Scope and contact CIBRU, a proprietorship operated by Krishna moni Borah, operates Export Chat Reader. Contact support@cibru.in. Postal address: Kakojan, Jorhat, Assam - 785107, India. This policy describes the app version linking to it. Paid/referral features may be unavailable during service rollout or eligibility checks. The app does not connect to your WhatsApp account, monitor live conversations, recover deleted messages, or provide a cloud backup of your chats. ## 2. Imported content and actions you choose The app can locally read message text, participant names, timestamps, photos, videos, audio/voice notes, documents, contact-card contents, and location text/links contained in files you select or share to it. Room stores the chat records and search index; extracted media is stored in private app files. Coil loads local media and Media3 plays local audio/video. These components are not used to upload your chat archive. On-device-only processing is not off-device collection under Google Play's Data Safety definition. However, when you deliberately share/open an attachment, save a copy outside the app, open a map/web link, or email support, the selected app/service receives what you send and its own policy applies. Copies in Downloads, the original archive, another app, or an email are not removed by deleting the imported chat. If you email support, we receive your email address and the information you choose to include, such as an app version, order number, referral code, or description of a problem. We use that correspondence to respond, investigate the request, and verify authority where needed. It is separate from locally stored chats; deleting local chat data does not delete a support email. You can ask about access or deletion of that correspondence at the support address below. ## 3. Advertising and privacy choices The free tier uses Google Mobile Ads (AdMob). The SDK can collect and share IP address (including approximate location inferred from it), ad/app interactions, diagnostics/performance information, and device or other identifiers such as advertising ID and App Set ID (and, where applicable, identifiers related to signed-in accounts) for advertising, measurement, analytics, and fraud prevention. The app does not provide imported chats or media to Google Ads. Google's User Messaging Platform (UMP) checks applicable consent requirements and may display a consent form. Ad requests depend on UMP's permission state. Where UMP requires a privacy-options entry, use **Settings → Legal & Privacy → Ad privacy choices**. Android also provides advertising-ID controls. Available ad types and controls depend on your region and Google configuration; non-personalized ads are not a promise of zero data processing. Verified paid Premium or an active verified referral reward suppresses the app's ad placements/requests. Already-started requests may finish, SDK initialization may still contact Google, and purchase/consent services can still operate. Read Google's Privacy Policy and Google Mobile Ads data disclosures. ## 4. Google Play purchases and verification Optional weekly, monthly, and annual subscriptions are processed by Google Play. Google handles payment instruments; we do not receive your card number, banking credentials, or full billing address. No separate app login is required for purchases. The Billing client exchanges purchase/catalog data with Google Play and passes a pseudonymous installation fingerprint as an **obfuscated account ID** to bind the purchase to this installation. It is not your email address or raw Android ID. Plan prices, eligible trials, renewal, cancellation and refund terms are in the subscription policy. To verify, restore, or delete purchase verification data, the app sends the purchase token, product and app identifiers, action, fresh request identifier, Google Play Integrity token, installation public key/fingerprint, and signed ownership proof to our Supabase-hosted backend. The private installation key stays in Android Keystore and is not sent. Google processes integrity/app/device signals to attest the request. Network providers also receive connection metadata such as IP address. The backend checks Google Play's purchase state, expiry, ownership and acknowledgement before returning entitlement. For reconciliation it stores **raw purchase tokens**, product/status/expiry/verification times and an order identifier where available; it also stores token hashes, installation fingerprints, request receipts, and acknowledgement/deletion state. It is incorrect to describe this system as storing only hashes. Tokens must not be emailed or included in public bug reports. A protected local cache grants paid access for at most **72 hours** after verification, never beyond verified expiry. Reboot, clock/cache-integrity failures, revoked status, or missing proof can require online verification. Pending payments do not grant paid access. Local storage may include Play purchase tokens needed for retry/deletion. Verification uses the original installation's secure key. Clearing Android app storage, uninstalling, moving devices, or losing that key can prevent automatic restore/deletion; legacy purchases may also require support recovery. Google Play ownership alone is not an automatic transfer to a new installation. See the purchase deletion guide. ## 5. Optional referral rewards Referral sync is off by default. Merely opening Premium or **Get Free Premium** does not enable it. Only confirming **Enable Referral Rewards** after the in-app disclosure enables participation. No name, email, password, or social sign-in is required; Supabase creates an anonymous authenticated session. Referral registration sends your app identifier, pseudonymous Supabase user identifier/session authentication, an app-scoped SHA-256 device hash, the raw Google Play Install Referrer string/referral code and click/install timestamps, a fresh request identifier, and a Google Play Integrity token bound to the request. The **raw Android ID stays on your device**; it is not sent to the v2 referral endpoint. The backend derives a further keyed device identifier for duplicate/fraud prevention. Hashes remain pseudonymous identifiers, not a claim of anonymity. Status checks and referral-deletion requests send the app identifier and saved session authentication; they do not resend the registration's raw referrer or device hash. Session renewal uses the saved refresh token, and connections expose metadata such as IP address. These data authenticate the profile, attribute qualifying invites, prevent duplicate/self/fraud claims, and record referral counts, reward events and expiry. The server, not client milestone math, grants rewards. Imported chats and media are not part of referral requests. After opt-in, sync can run on app launch/resume and explicit refresh. Offline referral access lasts at most **24 hours** after verification and never beyond reward expiry. Use **Get Free Premium → Turn off referral sync** for local unsync, or **Delete referral data** for a server deletion request. Unsync clears local profile/link/referrer caches, anonymous credentials and referral VIP access; it does not delete server records or change paid subscriptions. **Request server deletion before unsync.** Without the saved session, in-app deletion of that old profile is unavailable; contact support. Re-enabling requires a new affirmative confirmation and does not promise recovery of an old profile/reward. See Supabase's Privacy Policy, Referral Terms, and Unsync. ## 6. Retention and server deletion - **Local chats:** kept until you delete them, clear local chat data, clear Android app storage, or uninstall. Cache clearing alone does not delete the chat database or all imported media. Filesystem failures can leave files behind; the app reports incomplete cleanup and offers retry. Deletion is not a guarantee of forensic erasure from flash storage. - **Purchase records:** retained while needed to verify/reconcile the subscription. Shared-backend cleanup targets are 90 days for verified expired/revoked purchase records and 30 days for failed billing jobs. Confirmed purchase deletion removes verification rows and queued jobs for the proved purchase, not Google's payment record. The in-app request covers purchase tokens known to this installation; it is not a search of all historical purchases or other devices. - **Purchase anti-replay records:** token-hash deletion markers are retained until 90 days after the later of deletion or purchase expiry; terminal predecessor markers prevent retired-token reuse. Installation/token-hash ownership records remain until their expiry-plus-90-day deadline and until no retained purchase row or deletion marker needs them. Request receipts have a one-day cleanup target. - **Referral records:** app-scoped profiles, installation attribution, counts and reward events remain until confirmed deletion or applicable service retention. Deletion removes this app's profile/rewards and retains an anti-abuse device-key marker with a 90-day expiry. It does not delete the shared Supabase Auth identity or another app's records. Referral request receipts are removed for the deleted profile; other receipts have a one-day cleanup target. - **Operational limits:** expiry/cleanup targets require the deployed maintenance workers to run successfully; outages and outstanding ledger/tombstone dependencies can delay physical removal. Backups, provider security logs, Google-controlled data, support correspondence and legally necessary records have separate retention. Contact us for the status of a particular request; a local success or uninstall is not proof of server deletion. Purchase deletion first saves a local sync pause and removes local paid access before contacting the server. If saving the pause fails, the app reports an error and does not send the deletion request. Once saved, the pause remains even if server deletion fails; only explicit **Restore Purchases** resumes sync on that installation. The pause is a local setting, not a Google Play billing pause; clearing Android storage or uninstalling removes the setting and can also lose the key needed for restore/deletion. A referral deletion request also stops sync and clears local profile/reward/referrer caches first; on failure it retains the saved credential needed to retry. The UI reports success only after server confirmation. Neither deletion, unsync, clearing storage nor uninstalling cancels Google Play billing. Cancel separately in Google Play subscriptions. ## 7. Permissions, storage, and security - **Internet/network state and Play billing:** support ads/consent, purchase/Integrity/referral services, connectivity checks and external links. - **Selected documents:** Android's document picker/share grants access to files you choose. The app does not request broad storage access, contacts, camera, microphone, phone or precise-location permissions. Playing an imported voice note is not microphone recording. - **SDK declarations:** the merged app includes advertising ID, Privacy Sandbox ad-ID/attribution/topics, wake-lock, foreground-service and Install Referrer binding permissions, plus an app-private signature receiver permission. Library declarations are not a claim that a foreground service always runs or that every device exposes each advertising API. - **FileProvider:** grants a selected receiving app temporary read access when you choose to open/share a managed attachment. - **Protection:** the app uses Android private storage and configures backup/transfer exclusions for the managed chat database, media and service caches. Cleartext network traffic is disabled; app-service calls use HTTPS/TLS. Private storage is not a claim that every database/file is separately encrypted by the app. Debug builds can write diagnostic messages to Android's local log, including file/error context; do not share unreviewed logs or archives. The app has no separate chat analytics/crash-upload service in this reviewed source; the advertising SDK has its own diagnostics. No security control is absolute, particularly on compromised/rooted devices. ## 8. Your deletion and privacy choices For one chat, use its delete action. **Settings → Data & Storage → Clear All Data** removes the local chat records, managed imported media, local logs and cache; it does not reset preferences, cancel purchases or delete referral/server data. Android **Settings → Apps → Export Chat Reader → Storage & cache → Clear storage** resets broader private app data, including saved service credentials. Delete server data first if you want to retain the credential/proof needed for the request. See the Data Deletion Guide. For access, correction, deletion, objection or other applicable privacy rights, email support@cibru.in. We may need proportionate information to locate a pseudonymous record and verify your authority. For purchases provide an order number such as `GPA.XXXX-XXXX-XXXX-XXXXX`, never tokens, keys or passwords. Do not attach private chats or media unless necessary and specifically requested through an agreed secure channel. Google-controlled payment/advertising data is managed through Google's controls and policies. ## 9. Sharing, children, and changes We do not sell imported chats or provide them to advertising providers. Optional service data is disclosed above; user-directed exports/shares and voluntary support email are separate choices. This is a general-audience utility, not a service directed at children. Its Play audience and advertising configuration must match its actual distribution. We update this policy and effective date when practices change, with further notice where required. Applicable privacy and consumer rights are not limited by this policy. Export Chat Reader is independent of WhatsApp LLC and Meta Platforms, Inc.; their marks belong to their owners. Contact: support@cibru.in · CIBRU · Kakojan, Jorhat, Assam - 785107, India

Privacy Policy. Respect for your autonomy.

Have questions about your personal data?