Privacy & Security

How Does Zyro Connect to WhatsApp?

Zyro connects to your WhatsApp as a Linked Device — the same technology that powers WhatsApp Web and WhatsApp Desktop. When you scan the QR code, you are linking Zyro as one of your companion devices.

Your Conversations Stay Completely Private

Your WhatsApp messages are end-to-end encrypted and stay completely hidden from Zyro. Your personal conversations never reach our servers — there is simply no way for us to access them.

The only thing Zyro ever acts on is a request you intentionally send it. Even then, that request is held only for the brief moment it takes to generate your reply, in temporary memory — never written to disk, never logged, and never stored.

Zero Chat Storage Policy

How We Protect Your Data

• End-to-end encryption — All WhatsApp messages are encrypted using the Signal Protocol. Not even WhatsApp or Meta can read them.
• Owner-only access — The bot only responds to the account owner. No one else can trigger your bot.
• No chat storage — We do not store your WhatsApp messages on disk. Ever.
• No message logging — Our system logs only record that a message was received, not what it said.
• Firewall protected — Our servers are protected by enterprise-grade firewalls with only essential ports open.
• Brute-force protection — Automated systems block suspicious login attempts.
• You control your data — Delete uploaded documents, disconnect Google Drive, and remove all training data anytime from your dashboard.
• Unlink anytime — Open WhatsApp, go to Settings, then Linked Devices, tap Zyro, then Log Out. Done. All connection is severed instantly.
• Auto-deletion — If you disconnect and do not reconnect within 10 days, all your data is automatically deleted from our servers permanently.

Google Account Integration (Gmail, Calendar, Meet & Drive)

Zyro offers an optional, opt-in Google integration. You connect your own Google account from your dashboard and can disconnect at any time. Zyro requests the minimum scopes required for each feature and nothing more.

1. Data Accessed

Zyro requests these Google scopes, and only these:

• Send email on your behalf (gmail.send) — a send-only scope. It does NOT allow Zyro to read, list, search, or access your inbox or any existing emails.
• Manage calendar events (calendar.events) — lets Zyro create and manage events you ask for, including attaching a Google Meet link to those events. It does NOT grant access to read your existing calendar.
• Per-file Drive access (drive.file) — a per-file scope. Zyro can access only the specific Drive files YOU select through Google's file picker. Zyro cannot see, list, browse, or access any other file in your Drive.

2. Data Usage

• Gmail: used solely to send an email at the moment you explicitly instruct the bot to. Zyro never sends email on its own.
• Calendar & Meet: used solely to create or update a calendar event — and, when you ask, generate a Google Meet link for it — at your explicit request.
• Drive: the files you explicitly select are read so the assistant can use their contents to answer your questions and power your Knowledge Base. Zyro only reads files you have picked; it never scans your wider Drive.

All Google actions are user-initiated. Zyro performs no automated or background access except the scheduled rules you create yourself.

3. Data Sharing

We do NOT sell, rent, or share Google user data with any third party. It is never used for advertising, and never used to train any generalized AI/ML model. Data is transmitted to others only as needed to perform the action you requested (e.g. sending an email through Google's own Gmail API) or where required by law.

4. Data Storage & Protection

• We store only an encrypted Google OAuth refresh token, encrypted at rest with AES-256-GCM, used solely to perform the actions you request.
• We do NOT store the contents of your inbox or calendar.
• Drive: text extracted from files you link is stored in your Knowledge Base, encrypted at rest, and deletable by you anytime.
• All data is transmitted over TLS and held on firewall-protected servers.

5. Data Retention & Deletion

• Disconnect your Google account anytime from your dashboard — this immediately revokes Zyro's token and deletes it from our servers.
• You can also revoke access at myaccount.google.com/permissions
• Any Drive-derived Knowledge Base content can be deleted by you anytime.
• If you disconnect and do not reconnect within 10 days, all associated data is permanently and automatically deleted.

Technical Details

• Zyro uses WhatsApp's official Linked Device protocol (multi-device architecture).
• The bot runs as a passive linked device — it does NOT mark itself as "online" and does NOT interfere with your phone's notifications.
• Messages are processed only when they begin with the trigger word. All other messages are not even possible for the bot to access.
• Our bot library is open-source (MIT licensed) and community-audited. It only connects to WhatsApp's own servers — verified by source code inspection.
• We use industry-standard AI infrastructure for processing. Only your "zyro" commands are sent — never personal chats.

Frequently Asked Questions