Privacy Policy for ChipChip

Summary

We do not sell your personal data. We do not embed advertising SDKs or in-page Google Analytics (gtag) in the extension. The extension sends allowlisted product events through our Cloud Function to Google Analytics 4 Measurement Protocol (see below).

Website (chip.romsyn.com)

The public marketing site loads Google Analytics 4 (gtag) in cookieless mode: it sets no analytics cookies and stores no identifier, so we cannot recognise you across visits or link a visit to your extension install. Google Signals and ads personalisation are switched off, and the site loads no advertising pixels. PayPal subscription checkout may set its own cookies when you complete a purchase. The site does not read your WhatsApp messages or extension storage. We use the visitor IP (via the hosting platform and optional IP-reputation lookups) only to choose regional list prices and to treat known VPN, proxy, Tor, relay, or datacenter addresses as the standard US price. We do not use this to block a purchase.

Data we access locally

Stored on your device (not as a cloud backup of your scheduler):

• IndexedDB: message text, schedules, attachments, tags, tag↔group assignments, saved prompts, and recipient lists (including display phone numbers and names you save).
• chrome.storage.local: license/entitlement material (encrypted), optional Chrome Identity email, chat notes and quick replies keyed by WhatsApp chat/group id, composer history, UI preferences, WhatsApp relay settings, and send logs with contact phones redacted (last digits only).
• Group and contact identifiers visible on WhatsApp Web while the extension runs (to pick recipients and send scheduled messages).

Clearing the Chrome profile or extension storage removes local data, including the device DEK (encrypted secrets become unreadable).

Encryption at rest (device DEK)

Sensitive values in extension storage are protected with a per-Chrome-profile AES-GCM data encryption key (DEK) managed by the extension (wrapped for that profile / extension id).

Typically encrypted this way: license key, billing email, and entitlement JWT.

Data sent to ChipChip servers (Google Cloud / Firebase)

When you use subscription, Sheets import, or support features, the extension communicates with Firebase and Cloud Functions on Google Cloud (chipchip-a3d33), including:

• Subscription (getSubscription): license key you paste, billing email, and App Check; returns an entitlement JWT when active. Sharing is limited by a daily distinct-IP quota, not by counting installs.
• Entitlement token: a signed JWT proving access for gated endpoints (default short TTL).
• Public Google Sheets: spreadsheet / sheet identifiers; the server returns a cell grid that may contain phones or names if your sheet contains them. Values you import may then be stored in local IndexedDB recipient lists.
• Install support code: a short identifier for your install, used for support and license flows.
• Usage analytics (reportProductAnalytics): always-on product metrics. Allowlisted event names (ext_updated, schedule_created, schedule_sent, license_activated, settings_opened, sidebar_opened, bulk_started, bulk_finished, upgrade_gate_shown, chat_exported, webhook_started, language_changed) plus a fixed set of non-identifying values (ok, ack, has_media, version, count, feature, lang), a pseudonymous install id, and a rotating session id with time-on-task (session_id, engagement_time_msec). Segmentation is limited to plan tier, interface language and extension version. Your browser time zone (for example Europe/Madrid) is sent to our Cloud Function, which converts it to a two-letter country code so we can see which countries use ChipChip; only that country code reaches Google, never the time zone and never your IP address. On send failure only: payload_kind and fail_code. No message text, filenames, phones, or chat ids. Forwarded to GA4 Measurement Protocol to improve reliability. Uninstalling the extension stops new events.

We use HTTPS for these requests. Server operational logs are limited to metadata where designed (status codes, lengths, redacted identifiers)-not full API keys or full message bodies in those paths.

Third-party services you may enable

• PayPal: subscription payments and webhooks; we do not receive your full card details.
• FirstPromoter: if you open the site from a partner link, or join the referral program, FirstPromoter may store a referral cookie and, for partners, your name, email, and payout details. Purchases are reported from our server after PayPal confirms payment. We do not put the FirstPromoter API key in the browser.
• Google Sheets: only if you import a public sheet; we send the sheet id to our Cloud Function and receive cell values.
• Google Analytics 4 (Measurement Protocol): only for Usage analytics events above. The API secret stays on the server; the extension never embeds gtag.
• Google reCAPTCHA Enterprise / App Check: used to obtain a short-lived App Check token when the extension calls our Cloud Functions.

Usage analytics events are forwarded by our Cloud Function to Google LLC (GA4 Measurement Protocol) to improve the product. We do not sell this data. The install id is a random local identifier, not your name, email, or phone. Events already received by Google Analytics are retained according to that property’s retention setting and are not linked to your WhatsApp identity.

What we do not do

• We do not sell or rent your data to data brokers.
• We do not inject third-party advertising or tracking pixels in the extension UI.
• We do not use ad-targeting or advertising trackers on the marketing website.
• We do not upload your IndexedDB scheduler archive (messages, attachments, recipient lists) as a cloud backup.
• The Chrome Web Store build does not request host permissions beyond WhatsApp Web (https://web.whatsapp.com/*) for messaging, plus the existing ChipChip Cloud Functions host used for subscription, Sheets, analytics, and support.

Chrome extension permission: offscreen

ChipChip requests the Chrome offscreen permission to run a hidden extension page that is never shown to you.

• Why: To obtain a short-lived Firebase App Check token via https://chipchip-a3d33.web.app. Google reCAPTCHA Enterprise may run as part of this process.
• When: Only when the extension calls ChipChip cloud services (subscription, Sheets import, analytics, or support code).
• What is sent: A technical App Check token in the X-Firebase-AppCheck header to our Cloud Functions.
• What is not collected: The offscreen page does not read WhatsApp messages, browsing history on other websites, or screen content.

App Check tokens are kept in memory for use and are not intended to be persisted in extension storage.

Security practices

• Production builds limit verbose console output; sensitive fields are redacted in client and server logs.
• PayPal webhooks are verified with PayPal’s signature API when verification is enabled in production.
• HTML the extension inserts is sanitized before DOM insertion.
• License material remains in your browser profile under the device DEK.

Limitation: Data in the browser Network tab or DevTools may still show request bodies while you debug-that is expected browser behavior, not server logging.

Data retention

On your device

• Failed / missed / cancelled scheduled messages are automatically pruned from IndexedDB after about 48 hours.
• Pending / sending / sent schedules, tags, prompts, recipient lists, chat notes, and similar local data remain until you delete them or uninstall / clear the extension.
• Exports you download (CSV/XLSX) stay where you save them; export helpers do not upload those files to our servers.

On our servers

• Subscription / license records are retained as needed for billing, support, and abuse prevention.
• Entitlement JWTs are short-lived (about 2 hours by default).
• Other operational collections (rate limits, webhook deduplication, caches) expire on backend schedules.
• Usage analytics events are forwarded to Google Analytics 4 and retained according to that property’s GA4 retention setting. Our Cloud Function logs event names and counts, not message content.

There is no single in-extension “delete all my cloud data” API. Revoking a license affects server-side seats/devices; it does not by itself wipe your local notes, schedules, or IndexedDB.

Your choices

• You can use core local scheduling without enabling Sheets import or WhatsApp relay.
• Usage analytics has no in-extension off switch. Uninstall ChipChip or clear extension data to stop new events. Privacy requests: support@romsyn.com.
• You can clear extension storage by uninstalling or clearing extension data in Chrome.
• Premium / gated cloud features require an active license / entitlement as applicable.

Children

ChipChip is not directed at children under 13. We do not knowingly collect children’s data.

Changes

We may update this policy. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

Contact

Questions or privacy requests: support@romsyn.com

Disclaimer

ChipChip is an independent product and is not affiliated with, endorsed by, or sponsored by WhatsApp, Meta, Google, or PayPal.

Terms of Service

Use of ChipChip is also subject to our Terms and Conditions and End User License Agreement.