← Lungash All tools Kotlin · Android · Room

WhatsApp Vault

released · v0.1

An Android app that keeps a local copy of my own WhatsApp messages and media, including the ones a sender deletes after I've seen them.

It’s a backup of your own account on your own phone. It isn’t a way to watch anyone else’s, and it can’t be: it only sees what your phone already shows you.

Notifications are diffed against saved messages into a local database. New media files are copied into private storage and matched to messages within 45 seconds. The app declares no internet permission. notification diff vs saved vault.db (Room) media folder FileObserver private storage match ≤ 45 s × INTERNET permission: not declared
Nothing in the manifest lets it talk to a network.
Messages
A NotificationListenerService reads WhatsApp’s own notifications. WhatsApp keeps one notification per chat and rewrites it in place, so each update is diffed against what’s already saved to catch the new lines without duplicating old ones.
Deletions
When a sender deletes a message, WhatsApp reposts the notification with “This message was deleted.” The app spots that and flags its saved copy as deleted, keeping the original text.
Media
A foreground service watches WhatsApp’s media folders with a FileObserver and copies new images, video, voice notes, documents and stickers into the app’s private storage as soon as they land. Linking a file to its message is a timestamp heuristic, and the README says so.
Storage
One Room database and one private media folder. No server, no telemetry.

Things it doesn’t do

  • View-once media. WhatsApp never writes it to the folder the app watches.
  • Anything WhatsApp didn’t auto-download to the phone.
  • Disappearing-message chats, reliably. Expect gaps.
  • Deletion notices in other languages. The phrases are English only so far.
  • Automated tests. Not yet, and the notification diffing is the part that needs them.
Download the APK · v0.1 · 4.8 MiB

Needs Android 8.0 or newer. It isn't on the Play Store, so your browser will ask you to allow installing apps from it. After installing you grant two things by hand: notification access, and "all files access".

Signed with my own key. If you installed an older debug build, uninstall it first, because Android won't update across different signing keys. Built for my own phone, so treat v0.1 accordingly.

SHA-256 6084eedc99bd7a7f9082fd91c49b5ef7f36e33303457e1fb5b2f6123914365b9

Source is private for now.