Privacy Policy

1. Who we are

WaLink (“we”, “us”) is a free WhatsApp link generator operated by WaCloud (wacloud.app). This policy explains what data we collect when you use link.wacloud.app and how we use it.

2. Data we collect

• Account data: email, display name, and timezone (only if you sign up), plus a password hash if you use email-and-password registration.
• Link data: phone numbers, prefilled messages, custom slugs, and expiry dates you create.
• Click analytics: aggregated counts, timestamps, country, referrer, and coarse device type for each short link.
• Technical data: IP address, user agent, and cookies needed for sign-in and security.

Google sign-in

If you choose Google sign-up or sign-in, we request only the openid, email, and profile permissions. We receive and store your Google account identifier, name, email address, email verification status, and profile picture URL when provided. We use these details to create or link your WaLink account, authenticate you, and populate your account profile.

Our authentication system also stores Google-issued access and ID tokens, a refresh token if Google provides one, granted permissions, and available token expiry information with your account connection. This data is stored with our account records using the infrastructure providers described below. We do not receive your Google password or request access to Gmail messages, Google Drive files, or Google contacts.

Unique-message links

For eligible visits to a unique-message link, we record the redirect time, assigned message version, coarse device, browser and operating-system labels, language, referrer hostname, and available campaign source, medium and campaign labels. When a trusted visitor address is available, it is masked before being stored in detailed activity records (IPv4 /24 or IPv6 /48). Approximate country or city may be included when supplied by verified hosting infrastructure; unavailable details remain unknown. Detailed activity is scoped to the link owner's account. It describes a redirect to WhatsApp, not confirmation that a message was sent or delivered.

When an allocated message contains a web URL, WaLink may replace each occurrence with a random internal short URL. The mapping stores the original destination and is tied to that message version. Opening it can record a count, time, masked address and the same limited browser, device, location, language and source labels described above. Scanners and forwarded messages can open a short URL, so this does not prove who opened it or that the original WhatsApp recipient did so.

Anonymous WhatsApp handoff

A unique-message redirect opens WhatsApp with the selected message text only. WaLink does not add a visible visitor reference to the draft. A direct wa.meredirect does not provide the visitor's WhatsApp name, username or phone number to WaLink, and it does not prove that the draft was sent or delivered.

3. How we use your data

• To create and serve your WhatsApp short links and QR codes.
• To show you click analytics in your dashboard.
• To prevent abuse, spam, and security incidents.
• To send essential service emails (password reset, security notices).

We do not sell your personal data.

4. Sharing and processors

We use trusted infrastructure providers to host the app, store data, and deliver email. They process data only on our instructions. We may disclose data when required by law or to protect users.

An account owner can use the AI provider configured by the WaLink administrator, or optionally connect OpenAI, Google Gemini, OpenRouter or a custom OpenAI-compatible public HTTPS endpoint with their own API key. The owner's source message and a limited set of recent message variations are sent to the selected provider to prepare new wording. Visitor IP addresses, device details and click activity, WhatsApp webhook identities, and inbound message metadata are not included in these generation requests. Provider processing and data policies apply. Personal API charges apply only when the owner chooses their own provider. Saved personal API keys and the administrator's provider key are encrypted and are not returned to the browser.

5. Cookies

We use first-party cookies and local storage strictly to keep you signed in and to remember preferences. We do not use cross-site advertising cookies.

6. Data retention

Account and link data is kept until you delete it or close your account. Anonymous click logs may be kept for up to 24 months for aggregate analytics.

Detailed activity queries for unique-message links show only the last 30 days. Older detailed records are removed through bounded cleanup runs triggered by subsequent unique-link traffic. Storage deletion can therefore occur later than the 30-day cutoff during inactivity or a cleanup backlog. This does not extend the detailed activity visible in the dashboard.

Detailed internal short-link click records use the same 30-day cleanup window. Destination mappings and aggregate open counts remain for the lifetime of the parent link so already-issued URLs can keep working; deleting the parent link removes them.

Limited WhatsApp identity or inbound-message metadata retained from a legacy matched event follows the same 30-day detailed-activity window. It is deleted with that record during the bounded cleanup process described above. New redirects do not include a visible visitor reference for contact matching.

A separate per-link history keeps generated message text and normalized hashes, including previously issued wording, for the lifetime of the link. This history prevents reuse across later batches and source-message edits; it does not contain visitor IP addresses or device details. Deleting the link also deletes its message history and associated detailed activity.

7. Your rights

You may access, export, correct, or delete your data at any time from your dashboard, or by emailing us. EU/UK users have rights under GDPR.

To stop using Google sign-in or remove Google access, manage WaLink in your Google Account connections. Removing that connection does not automatically delete your WaLink account or data already stored by us. To request deletion of your account and associated Google sign-in data, email the contact address below; there is currently no self-service account-deletion control in WaLink.

8. Children

WaLink is not directed to children under 13. We do not knowingly collect data from children.

9. Changes

We may update this policy. We will post the new date at the top and, for material changes, notify signed-in users.

10. Contact

Questions? Email hello@wacloud.app.