Privacy Policy

1. Overview

wrapped.green turns your exported WhatsApp chats into a personal “wrapped” story. Your chat export and your photos are read and analysed locally in your browser — they are never uploaded. Only if you explicitly choose to save a Relate, a small amount of data described below is stored on our servers.

2. Data controller

The controller responsible for processing of personal data on this site is listed in the Imprint.

3. What is processed locally (never uploaded)

• Your WhatsApp chat export (.zip) including all message text.
• Any photos you add — full image content and EXIF metadata.

4. What is stored on our servers (only if you save a Relate)

When you choose to save or share a Relate, the following data is stored in our database (Supabase, EU region) and storage:

• Aggregated statistics derived from the chat: total messages, per-day and per-hour counts, top emojis, media counts, longest streaks, peak times, etc. The raw message text is never uploaded.
• Participant names as they appear in your chat export (first names of the people you message). This is third-party personal data.
• Photo thumbnails — up to 9 small (~400 px) JPEGs picked from the photos you added, stored in object storage.
• Photo GPS coordinates and timestamps for photos where this information is present in the EXIF metadata, used to render the map slide.
• Account data if you sign in with Google: your Google account ID, email address, and display name.
• An unguessable share token used in the share URL.

5. Retention

Saved Relates are automatically deleted after 12 months via a daily database cleanup job. You can also delete individual Relates, export all your data, or delete your entire account at any time from /my-wraps.

6. Legal bases (Art. 6 GDPR)

• Art. 6(1)(b) — performance of the service you requested (creating and saving your Relate).
• Art. 6(1)(a) — your explicit consent, given at upload time, for storing third-party participant names and photo metadata in a saved Relate.
• Art. 6(1)(f) — legitimate interest in keeping the site secure and functioning (technical logs, abuse prevention).

7. Sub-processors

• Supabase — database, authentication and object storage. Hosted in the EU (Frankfurt).
• Lovable Cloud — application hosting and CDN.
• Google — identity provider for “Sign in with Google”. We receive only your Google account ID, email and display name.

8. Cookies & tracking

No advertising cookies, no third-party trackers. We use only strictly necessary local storage (e.g. your draft Relate on your own device) and an authentication cookie if you sign in.

9. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict or object to processing (Art. 18, 21)
• data portability (Art. 20) — use “Download my data” in /my-wraps
• lodge a complaint with a supervisory authority (Art. 77)

10. Supervisory authority

The competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

11. Changes to this policy

We may update this policy as the product evolves. The “last updated” date at the top reflects the latest version.