Is TooBot safe?
TooBot sends deleted and view-once WhatsApp Web messages, including media, to api.toobot.express.
On web.whatsapp.com, the extension hooks WhatsApp's internal message store and posts the content of deleted messages and view-once messages to its own backend with an auth token. It can also post whole message objects to a webhook endpoint when that module is enabled. The backend address comes from a remote config the vendor serves.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed TooBot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.toobot.express
TooBot sends data to api.toobot.express. No other extension we have analysed sends data here.