Is HandChat safe?
HandChat copies WhatsApp Web messages, including deleted and view-once ones, and sends them to its own servers.
On web.whatsapp.com the extension keeps a copy of messages and, when a message is revoked or is view-once media, posts it to the vendor's API. It also sends chat history to AI suggestion and transcription endpoints, and can post a screenshot of the WhatsApp login QR code when the user clicks a button. The API and WebSocket addresses are fetched at runtime from apiexpress.hand.chat, so the vendor controls where the data goes.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed HandChat contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- apiexpress.hand.chat
HandChat sends data to apiexpress.hand.chat. No other extension we have analysed sends data here.