Zawa

Before You Start ​

Please read this all the way through so you don't get lost later. It's nothing complicated, just a few notes so everyone stays comfortable and nobody gets hurt.

Please Don't Do Anything Weird ​

Zawa exists to help fellow developers. It's free, it's open, and it's built with good intentions. So please:

Don't

  • Use it for spam.
  • Spread hoaxes, scams, or anything that would make your parents shake their heads.
  • Brute force it, or hammer the API with a 100-thread bot while sipping coffee like you own the place.

Go right ahead

  • Bots and notifications for your own app's users.
  • OTPs and verification codes.
  • Broadcasts to people who actually want your messages.
  • Experiments, learning, or just tinkering.

If you abuse the system, well... your access might get switched off without warning. Sad, right? We'd be sad too. So let's just not.

Look After Your Number ​

Zawa connects as a linked device, so every message is sent from your own WhatsApp number. That means WhatsApp's own rules still apply:

  • Messaging lots of people who don't know you in a short time is the fastest way to get banned by WhatsApp.
  • Leave a gap between messages, especially when broadcasting.
  • If you're just experimenting, use a spare number rather than your main one.

Feel more human

Call Send Typing a few seconds before Send Message. The recipient sees "typing…" first, just like with a real person.

Keep Your Session Keys Safe ​

Your id and session-id are like house keys. Anyone who has both can send messages from your number. So:

  • Keep them on your server (environment variables or a secret manager), never in frontend code or a mobile app.
  • Don't commit them to a public Git repository.
  • If they leak, delete the session right away and create a new one.

What Data Is Stored? ​

To be transparent, this is what Zawa keeps while your session exists, and what it doesn't:

Not stored

  • Message contents, whether you send or receive them.
  • Media from a URL. The file is only downloaded temporarily to send it, then deleted straight away.

Stored while the session exists

  • Session info: your number, name, profile picture, and connection status.
  • Linked-device keys, so you don't have to scan the QR code again every time the server restarts.
  • The address book synced from your phone, used to decide who sees your statuses and to name group members.

When you delete a session, everything that was stored is deleted too, and the linked device is logged out from your phone.

We're All Human Here ​

Zawa isn't an enterprise service with 24/7 support and a soothing call-center voice. But there is a real person behind it who wants to help however they can.

So if you hit a bug, an error, or you're just confused, send a friendly message to [email protected]. You'll get help as soon as possible.

If all of this sounds good, head over to the Quick Start, guilt-free and with no surprise throttling. 🚀