How local processing works
ChatXport reads your WhatsApp export without uploading it. This page explains, in plain technical terms, how that works and how you can verify it yourself.
There is no server to upload to
ChatXport Web is a static site. The host, Cloudflare Pages, serves the HTML, CSS, JavaScript, and font files that make up the page, and nothing more. There is no backend, no API route, and no database that could receive a file. The host holds the site, not your data.
The work happens in your browser
When you open an export, the file is read into memory in your browser through the File API. If it is a .zip, it is unzipped in the browser using JSZip, then parsed and displayed, all in JavaScript running on your own machine. Photos, videos, and voice notes are turned into local blob: URLs, which are references to bytes already held in memory on your device. At no point does the code send the file anywhere, because there is nowhere for it to send it.
The browser enforces it, not just our word
The site is served with a Content-Security-Policy that sets connect-src 'none'. This directive tells your browser to block the page from opening any outbound network connection, including background methods such as fetch, XHR, WebSocket, and beacon. So this is not only a promise that we will not upload your chat; after the page has loaded, the policy blocks the page from opening a connection through which chat data could be sent. Even a dependency that tried to send something would hit the same wall.
Verify it yourself. Open your browser's developer tools and select the Network tab. Load a chat and watch: after the page finishes loading, no further requests appear. Then turn off your wifi and keep reading, searching, and switching views. The parsing and display do not depend on a connection.
What does use the network, honestly
Two things do involve the network, and it is worth being precise about them. First, the initial page load: the HTML, JavaScript, and self-hosted fonts are downloaded from Cloudflare when you first open the site, the same as any website. Second, if you choose to buy the full unlock, checkout connects to our payment provider to process that payment. Neither of these transmits your chat content. ChatXport also runs no analytics or visitor-tracking scripts on the page. The only Google tool we use is Search Console, which reports search performance to us from Google's side and does not place a tracking cookie on your device.
Where your most recent chat is kept
So that you can pick up where you left off, ChatXport may keep your most recent chat in local storage in your browser, on your own device. That copy stays on your device, is never sent anywhere, and you can remove it at any time using the Discard control or by clearing your browser data.