Privacy policy

Last updated: July 15, 2026

The short version: your conversations and media are processed 100% locally, in your browser. They are never sent to a server, never stored anywhere but on your device, and we cannot read them. The only piece of data that travels over the internet is your license key, at activation time.

What we do not collect

When you drop a WhatsApp export (.zip) into Souvenir, the file is opened and read directly by your browser, on your device. No message, no photo, no voice note, no video, no contact name is transmitted to our servers or to any third party. We have no technical means of accessing them.

What does travel: your license key

At activation, the license key you enter is sent to our API (hosted on Vercel), which passes it to Lemon Squeezy to check its validity. It is the only piece of data you transmit to us through the application. It contains neither your name nor the content of your conversations.

Session cookie

After a successful activation, a session cookie (a JWT token, flagged HttpOnly) is placed in your browser for 90 days. Its only purpose is to let you access the application without re-entering your key on every visit.

• This cookie is strictly necessary for the service to work: it is exempt from prior consent requirements.
• We use no advertising cookies and no audience measurement cookies (see “Audience measurement” below).

Audience measurement

The public pages of this site (home, activation, legal pages) use Vercel Web Analytics, a cookie-free audience measurement tool. It produces aggregate visit statistics — page views, country, device type — which cannot be used to identify you or to track you across sites.

The application itself (/app) is excluded: no measurement script is loaded there. This audience measurement never has access to the content of your conversations, your media or your files, which do not leave your device.

Third-party resources loaded by our pages

To work, our pages load two resources from third-party servers. As with any content loaded on the web, your IP address is technically visible to these providers during loading:

• Google Fonts (fonts.googleapis.com / fonts.gstatic.com) — the site's typefaces, provided by Google LLC.
• JSZip via cdnjs (cdnjs.cloudflare.com) — the library that lets your browser open your .zip file locally, served by Cloudflare, Inc.

These requests carry none of your conversation data: they only serve to download these files to your browser.

Hosting and technical logs

The site and the API are hosted by Vercel Inc. (United States). Like any hosting provider, Vercel may generate technical logs (IP address, timestamps, requested pages) needed for the security and operation of the platform.

Payment

Purchases are handled by Lemon Squeezy, LLC, our merchant of record. Billing data (email, payment details) is collected and processed directly by Lemon Squeezy under its own privacy policy. We never receive or store your payment information.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction and objection regarding your personal data. Given Souvenir's architecture, we hold almost no data about you — your conversations stay on your device. For any question or request, write to us: souvenirchat.contact@gmail.com. You can also delete the session cookie at any time from your browser settings.

Changes to this policy

If we were to change these processing activities or introduce a new audience analytics tool, this page would be updated beforehand, with its revision date.