Privacy

The short version: your chat is read on your phone. We send a small, filtered sample to an AI to write the awards, then delete it. Results disappear after 30 days. No accounts, no ads, and we never sell data.

Who we are

Sumzap is run by Ryan Jarrett, trading as Cleansheet, 11 Merleburgh Drive, Sittingbourne, Kent ME10 2RW. For anything about your data, email hello@sumzap.app.

Your chat file

When you pick your WhatsApp export, it's read inside your browser, on your phone. The file itself is never uploaded to us.

What we send to make the awards

When you tap See your awards, your phone sends us:

• The group's name and members' first names. Members saved only as a phone number are shown as "Unknown" plus the last three digits; full numbers are never sent.
• Counts worked out on your phone: messages, voice notes, late-night messages, who starts conversations and so on.
• Up to 150 short messages (200 characters each at most), picked to give the AI something to judge. Before they leave your phone, we drop any message containing a phone number, email address, link, card-like number or postal address, and we check again on our server.

We pass this to Anthropic, whose Claude AI writes the awards and the verdict. Anthropic processes it for us under its commercial terms, which don't let it use the data to train its models. As soon as the awards are written, we delete the message sample. We never store it and never log message content.

What we keep, and for how long

• Your result (the stats, awards and verdict, with first names): 30 days, then deleted automatically.
• Payment records (amount, date and Stripe's payment reference, but no card details): kept for as long as UK tax law requires, usually six years.
• Visitor counts from Cloudflare Web Analytics: pages viewed and where visitors came from, with no cookies and nothing that identifies you.
• Usage events (for example "card 2 viewed" or "paid"), with no names, messages or IP addresses: used to improve Sumzap.
• Your email, if you give it for a receipt (or Apple Pay or Google Pay passes it on): it goes to Stripe, which emails the receipt. We don't store it or use it for anything else.
• A random ID in your browser: so you see the same price each time you use Sumzap (we sometimes test prices). It's a random string, isn't linked to you, and you can clear it by clearing this site's data.
• Abuse protection: to stop people running up costs, we count requests per connection using a scrambled (hashed) version of your IP address. That count is deleted within two hours.

Who can see your result

Only people with a link. The group link shows all three cards to anyone who has it, so share it with the group only. The person who paid can reset it, which stops old links working. The public link shows card 1 only, and hides the group's name unless the payer turns that off. Neither link is listed in search engines.

Only upload chats where you're happy for the group to see the result.

Companies that help us

• Cloudflare hosts Sumzap, stores results and runs the "are you human" check (Turnstile).
• Anthropic writes the awards and verdict from the sample described above.
• Stripe takes payments. Your card details go straight to Stripe; we never see them.

Why we're allowed to use it

Under UK data protection law (UK GDPR), we use your data to give you what you asked for (performing a contract), and to keep Sumzap secure and working well (our legitimate interests). Sumzap is for adults (18+) only.

Your rights

You can ask to see, correct or delete data we hold about you, or object to how we use it: email hello@sumzap.app with the link to your result. Results delete themselves after 30 days anyway. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated October 2026.