Privacy Policy

This Privacy Policy describes how Grupo de WhatsApp (grupodewhatsapp.com), the mobile app Grupos de Whats - Links Ativos (com.gruposdewhats.mobile on the Google Play Store), and the Chrome extension Grupos de WhatsApp - Encontre e Entre em Grupos (bfljpnadnadfjpbahpagdjflpofhhenc on the Chrome Web Store) — collectively, the "Service" — collect, use, and protect your information.

The Service is operated independently and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC, Meta Platforms, Inc., or any of their subsidiaries. WhatsApp is a registered trademark of WhatsApp LLC.

1. Who we are

We are a directory of public WhatsApp groups. Users submit publicly-available invite links, and our team validates each group before listing it. We do not host messages, conversations, or any content generated inside WhatsApp groups.

2. Data we collect

2.1 On the website (grupodewhatsapp.com)

• Usage data: pages visited, search terms, categories browsed, traffic source (referrer), browser language, and timestamps.
• IP address: used only for rate limiting, abuse prevention, and aggregate geolocation analytics (country/region). Not stored linked to your identity.
• Cookies: we use essential cookies (session, language and theme preferences) and analytics cookies (Google Analytics, Vercel Analytics). See section 6.
• Bot verification: Cloudflare Turnstile may be used on sensitive actions (revealing invite links, submitting groups).

2.2 In the mobile app (Grupos de Whats - Links Ativos)

• Non-advertising device identifier: IDFV on iOS and Android ID on Android. Used only for rate limiting, abuse prevention, and anonymous device association. We do not use IDFA or any advertising identifiers.
• Anonymous locally-generated ID: UUID v4 created on first app open and stored securely on the device (Keychain/Keystore via expo-secure-store).
• Usage and event data: screens visited, searches performed, groups viewed, selected language and theme.
• IP address (server-side): used only for rate limiting.
• Local preferences: theme (light/dark/system), language, hidden groups, search history — stored only on your device (local SQLite).

2.3 In the Chrome extension (Grupos de WhatsApp - Encontre e Entre em Grupos)

The extension is optional. You only need to install it if you want to use the automatic affiliate-link generation features on partner marketplaces (Mercado Livre, Amazon, Shopee). For browsing the group directory, the website works without the extension.

• Your grupodewhatsapp.com account e-mail: the extension connects to your account via a handshake performed in a tab on our site (you must be logged in). We store only the e-mail and the internal account ID in the browser's local storage (chrome.storage) — never your password.
• Authentication cookies of connected marketplaces: when you click "Connect" for a specific marketplace, the extension reads the session cookies of that domain (e.g. mercadolivre.com.br) via the chrome.cookies API. These cookies are sent over HTTPS to our server and stored encrypted at rest with AES-256-GCM (256-bit key under our exclusive control). They are bound exclusively to your account — no other user has access.
• What we use them for: solely and exclusively to generate, on your behalf, authenticated affiliate links on the marketplaces you connected — the same flow as cashback extensions. We do not publish, share, or resell these cookies. We do not use them for any other purpose.
• Local sync queue: the extension keeps a queue in chrome.storage with the marketplaces pending sync (domain names and timestamps only — never the cookie contents in cleartext).
• Domains the extension can access: only grupodewhatsapp.com, mercadolivre.com/.com.br, amazon.com/.com.br, and shopee.com/.com.br. The extension cannot access any other site you visit.
• How to disconnect/delete: click "Disconnect" in the extension popup to end the local session. To delete the cookies stored on our server, click "Disconnect marketplace" for each listed marketplace, or go to /en/my-account and use the "Delete credentials" option. Uninstalling the extension removes the local session but does not automatically delete cookies already sent — use the flow above.

2.4 When you sign up or ask us to get in touch

The affiliate program landing pages carry a form. If you choose to fill it in, we collect your name, e-mail and phone number — the data you typed yourself — to create your account and talk to you about the service. We keep it even if you do not finish signing up, so we can pick the conversation back up; you can ask for deletion at any time (section 12).

The phone number is also used in irreversibly hashed form to measure how well our ads perform, as described in section 4.

2.5 Optional Instagram publishing

If and when you choose to use the Instagram publishing feature, we process only the data needed to connect the selected professional account and prepare, schedule, carry out, and track the publications you request.

• Connection identity: the professional Instagram account, its associated Facebook Page, and the Meta user identifier specific to the app.
• Temporary selection authorization: while you select an account, we retain a temporary authorization for up to 10 minutes. It is removed when used or, if it expires, by the cleanup process.
• Selected credential: the access credential for the selected Page is stored in encrypted form and used only for the actions you request through this feature.
• Conditional content and operations: when the feature you use accepts content from you, we may process media you voluntarily select (such as images and, where that option is available, videos), captions, publication schedules, receipts, and minimal operational metrics.

Tokens may expire or be revoked; we do not promise automatic refresh.

• Disconnect Instagram: removes only the local social credential. It does not affect your ads connection, revoke the entire Meta app, or delete resources that have already been published remotely.
• Revoke the Meta app: is an app-wide action and affects both ads and social access linked to that app.
• Request data deletion: starts asynchronous processing. The receipt shows the actual state and appears as completed only after the applicable scope has been processed.

After completion, we keep only a minimal receipt for 90 days. To prevent reuse of a revoked authorization, we may keep only a hash-derived security marker for up to 24 hours, without retaining the app-specific identifier provided by Meta in plain form.

Track a data deletion request

2.6 What we do NOT collect

Except for media and files you voluntarily upload when using optional publishing features, including the feature described in section 2.5, we do not collect: precise location (GPS), photos, videos, files, contacts, calendar, messages exchanged inside groups, financial data, health data, biometric data, payment information (handled directly by the payment provider), or any other personally identifiable information not listed above.

The website and mobile app work without requiring registration. Account creation (with e-mail) is only necessary for optional features such as the Chrome extension and the /my-account panel.

3. What we use the data for

• Operate and maintain the Service (core functionality) — legal basis: performance of a contract.
• Prevent abuse, fraud and automated activity, which includes relating browsing behaviour to group joins in order to spot people evading blocks — legal basis: legitimate interest.
• Analyze usage in aggregate to improve the product — legitimate interest.
• Measure how well our own ads perform: how many people joined a group after seeing an ad of ours — legitimate interest. This measurement is aggregate: it counts joins per ad, without claiming that a specific person came from a specific ad.
• Moderate content and respond to reports of inappropriate groups.
• Comply with legal obligations.

We do not sell your data to third parties. We do use data to measure and optimize the delivery of our own ads on Meta platforms (section 4) — we do not build profiles to sell to advertisers, and we do not show third-party advertising targeted on what you do here.

4. Data sharing

We share data only with essential providers required to operate the Service:

• Supabase (database and backend) — stores anonymous and aggregated data.
• Vercel (website hosting) — processes HTTP requests.
• Cloudflare (CDN and anti-bot protection).
• Google Analytics, Vercel Analytics, PostHog and Umami (aggregate usage analytics).

We may disclose data when legally required (court order, request from a competent authority).

5. Retention and deletion

• Aggregate usage data: up to 26 months.
• Browsing events (pages viewed, group clicks) and short-link clicks: kept while they remain useful for metrics and abuse prevention, and deleted on request.
• Signup data (name, e-mail, phone), including from people who started and did not finish: kept until you ask for deletion or until it is no longer needed.
• Rate-limiting logs: 30 days.
• Local app data: you can erase it at any time by clearing the app's data on Android (Settings > Apps > Grupos de Whats > Storage > Clear data).

Since we do not collect personally identifiable data for the website/app browsing flow, there is no "account" to delete in that context. To request deletion of any data associated with your IP / device identifier, contact us.

6. Cookies and similar technologies

The website uses the following cookie categories:

• Essential: session, theme and language preferences.
• Analytics: Google Analytics, Vercel Analytics, PostHog, Umami. Includes an anonymous visitor id (gdw_aid), created on your first visit and kept for 1 year, used to count visitors without knowing who they are.
• Campaign: gdw_attribution, kept for 90 days, holding the parameters of the ad that brought you (source, medium, campaign and the identifiers of the creative). It is what lets us tell how much each signup cost. Only created if you arrive through a campaign link.
• Advertising: Meta Pixel cookies (_fbp, _fbc) on the landing pages and in the signup flow.
• Security: Cloudflare Turnstile (anti-bot verification).

The mobile app does not use cookies. It uses native local storage (SQLite, Keychain/Keystore).

7. Your rights (LGPD / GDPR)

You have the right to confirm processing, access, correction, anonymization, portability, and deletion of your data. Because our collection is minimal and anonymous by default, in practice most of these rights are satisfied by the product's architecture itself. To exercise any right, contact us.

8. Children

The Service is intended for users 13 years of age and older. We do not knowingly collect data from children under 13. If you believe we have collected data from a child, contact us and we will remove it immediately.

9. Security

We adopt reasonable technical and organizational measures to protect your data (HTTPS on all communications, network segregation, access control). No system is 100% secure; we will report relevant incidents as required by law.

10. International transfer

Our providers (Supabase, Vercel, Cloudflare, Google) may process data outside Brazil. We ensure these providers adopt standard contractual clauses or equivalent mechanisms recognized by applicable legislation.

11. Changes to this policy

We may update this policy from time to time. Material changes will be signaled on the site's home page or via notice in the app. The "Last updated" date at the top of this page indicates the current version.

12. Meta connection (ads)

From /minha-conta you can connect your Meta account (Facebook and Instagram) to follow and create ads pointing at your links page. This connection is optional and only exists if you authorize it. While it is active, we store:

• The authorization token issued by Meta, encrypted (AES-256-GCM) and never shown back to you. It expires in about 60 days and is not refreshed automatically.
• Your Meta name and identifier, only to show which account is connected.
• The ad account, Facebook Page and Instagram profile you pick to run the ads with.

We use this access only to read how your campaigns are doing (spend, impressions, clicks) and to create campaigns when you ask — always paused, so you review and turn them on inside Meta. We never post on your behalf, never activate ads on our own, never use this data to target our own advertising and never share it with third parties.

Disconnecting from the campaigns panel removes the local credential for that connection. Revoking the app in Meta settings is an app-wide action and affects the ads and social access linked to it. A deletion request starts asynchronous processing that can be tracked with its receipt, and the covered local data is removed as the request progresses. Resources already created remotely, such as campaigns, are not deleted. Track the request: /privacy/data-deletion.

13. Contact

For questions, rights requests, or privacy-related reports:
E-mail: contato@grupodewhatsapp.com
Contact page: /en/contact