Is WA Privacy safe?

Medium risk

WA Privacy reads your WhatsApp number and sends it with a persistent device ID to a third-party analytics endpoint on every logged event.

The extension pulls your own WhatsApp number out of web.whatsapp.com's local storage, then attaches it, a persistent UUID, and browser/device details to analytics events fired each time you open the popup or toggle one of its privacy switches, sending them to an Alibaba Cloud logging endpoint. The same number is also placed in an uninstall-survey URL. Separately, the popup reads your signed-in Chrome account email and sends it in a plain URL to a third-party subscription-check domain unrelated to WhatsApp privacy features.

So Lets Talk Digitalv1.0.0Chrome Web Store
49Risk
Who publishes it

So Lets Talk Digital - 4 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
So Lets Talk Digital
Declared legal entity
So Lets Talk Digital
Website
soletstalkapp.com/contact

Same store account

4 other listings published from this account, 2k+ users between them, none of them carrying a finding.

LinkedIn Video Downloader816LowWAPlus Bulk Sender377LowWAPP Sender370LowGroup Exporter 210Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WA Privacy sends your real WhatsApp phone number to Alibaba Cloud

Code analysis shows the extension reads your real WhatsApp number from the page and saves it locally.

Opening the popup or toggling a privacy switch then sends that number and a device ID to an Alibaba Cloud logging endpoint.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open web.whatsapp.com while logged in, then open the extension's popup or toggle any privacy setting.

The extension's only stated purpose is hiding WhatsApp Web UI elements for privacy.

The extension did this

The extension reads your real WhatsApp number from the page and attaches it to a logging event sent to Alibaba Cloud with a persistent device ID.

The same number is embedded a second time in the uninstall-survey URL the extension registers with chrome.runtime.setUninstallURL.

Fields in the event payload sent to Alibaba Cloud
  • Your WhatsApp phone number
    15551234567

    Directly identifies you and is read from your own logged-in WhatsApp Web session.

  • Device ID
    3f2a9c7b-8e21-4d6a-9c31-7a5e0b2f441d

    A UUID generated once at install and stored locally, ties every logged event to the same device.

  • Country code
    US

    Derived from the dialing code of your phone number.

  • Event type
    100005

    Numeric code for what you just did, such as opening the popup or toggling a setting.

  • Install time
    1737331200

    Unix timestamp of when you installed the extension.

The code that does this

Reading the phone number, then attaching it to every logged event

Readable version

load.js: reads your WhatsApp number off the page on every page load

load.js
      (window.onload = l(        u().mark(function e() {          var t;          return u().wrap(function (e) {            while (1)              switch ((e.prev = e.next)) {                case 0:                  try {                    window.localStorage.getItem("last-wid")                      ? ((t = window.localStorage.getItem("last-wid")),                        (myNumber = t.split("@")[0].substring(1)))                      : ((t = window.localStorage.getItem("last-wid-md")),                        (myNumber = t.split(":")[0].substring(1))),                      chrome.runtime.sendMessage({ userPhoneNum: myNumber }),                      chrome.storage.local.set({ userPhoneNum: myNumber });                  } catch (r) {}                case 1:                case "end":                  return e.stop();              }          }, e);        })

popup.js: pulls the stored number back out and adds it to the log event

popup.js
    function l(t) {      var e = t.eventType,        r = t.otherParams;      chrome.storage.local.get(null, function (t) {        var o = void 0 !== t.browserInfo ? t.browserInfo : "",          a = o ? o.userAgent : "",          c = o ? o.browser : "",          l = void 0 !== t.platform ? t.platform : "",          u = void 0 !== t.installTime ? t.installTime : "",          d = t.userPhoneNum,          y =            (void 0 !== t.firstSendTime && t.firstSendTime,            void 0 !== t.uuid ? t.uuid : ""),          p = void 0 !== t.version ? t.version : "",          m = void 0 !== t.language ? t.language : "",          h = {            event_type: e,            event_time: Math.round(new Date() / 1e3),            install_time: u,            platform: l,            user_agent: a,            browser_type: c,            uuid: y,            version: p,            language: m,          };        if (void 0 !== d) {          var g = n("a689"),            f = g("+" + d).getRegionCode(),            b = new g(d.toString(), f),            v = b.getRegionCode() ? b.getRegionCode() : "",            w = s(v) ? s(v) : "";          (h.user_phone_num = d),            (h.country_code = w),            chrome.storage.local.set({ phoneNum: d, countryCode: w });        } else (h.user_phone_num = ""), (h.country_code = "");        if (r) for (var j in r) h[j] = r[j];        i.send(h);      });    }

chunk-vendors.js: the logging class POSTs the event to Alibaba Cloud

chunk-vendors.js
                key: "logger",                value: async function (e = !1) {                  var t = !1 !== e && e.length > 0 ? e : [];                  if (0 !== t.length) {                    var n =                      "https://" +                      this.project +                      "." +                      this.host +                      "/logstores/" +                      this.logstore +                      "/track";                    try {                      var i = JSON.stringify({ __logs__: t });                      let e = new Headers({                        "x-log-apiversion": "0.6.0",                        "x-log-bodyrawsize": i.length,                      });                      if (this.compress) {                        e.append("x-log-compresstype", "lz4");                        var r = u.from(i),                          o = d.encodeBound(i.length),                          s = u.alloc(o),                          a = d.encodeBlock(r, s);                        (s = s.slice(0, a)),                          fetch(n, {                            method: "POST",                            headers: e,                            body: s,                          }).then((e) => e);                      } else {                        let t = new Blob([i], {                          type: "application/x-protobuf",                        });                        e.append("Content-Type", "application/x-protobuf"),                          fetch(n, {                            method: "POST",                            headers: e,                            body: t,                          }).then((e) => e);                      }                    } catch (l) {                      console.log(l);                    }                  }                },
Where the phone number ends up
    • extension-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Log Service endpoint the vendor uses for a logstore literally named scrm-privacy (Social CRM); receives the phone number on every popup open or privacy-toggle change.

    • waplus.io

    The vendor's own site. Receives the same phone number a second time via the uninstall-survey URL fired when the extension is removed, plus install_time, country and a device UUID.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on whatsapp.com

    *://*.whatsapp.com/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed WA Privacy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • extension-us.us-west-1.log.aliyuncs.comwidely used

    WA Privacy sends data to extension-us.us-west-1.log.aliyuncs.com. A widely used service: 28 other extensions we have analyzed send data here.

  • soletstalkapp.com

    WA Privacy sends data to soletstalkapp.com. 2 other extensions we have analyzed send data here.

  • waplus.io

    WA Privacy sends data to waplus.io. One other extension we have analyzed sends data here.

Updated 30 September 2026mjkagldgjfdcfepbccpgphcgadbemkcc