Effective date: September 4, 2026
KrazeMessage (also called “Messages for Desktop”) is a program that runs on your own computer. This policy explains what happens to your data, and, just as importantly, what doesn’t.
This Privacy Policy describes the data practices of KrazeMessage (“KrazeMessage,” “the app,” “we,” “us,” or “our”). KrazeMessage is independently operated by an individual based in California. It is not currently a separately incorporated company or limited liability company.
California’s Online Privacy Protection Act (“CalOPPA”) applies to commercial online services that collect personally identifiable information from California consumers. This policy is intended to satisfy CalOPPA’s disclosure requirements and to describe our actual practices. Based on KrazeMessage’s current scale and data practices (in particular, that we operate no server that receives your content), we do not currently meet the statutory thresholds that make a business subject to the California Consumer Privacy Act (“CCPA”). KrazeMessage is operated from the United States and is not marketed or directed to individuals in the European Economic Area in a manner intended to make it subject to the European Union’s General Data Protection Regulation (“GDPR”). If our size, operations, geographic reach, or data practices change, we will reevaluate the privacy laws that apply and update this policy as appropriate.
There is no sign-up, no login, and no cloud service operated by KrazeMessage. We do not host a backend that stores your conversations, and we have no database of users. Because of this, we cannot read, sell, hand over, or lose your messages; we never have them in the first place. The rest of this policy is mostly about the services the app connects to on your behalf, since those are the only places your data can go.
KrazeMessage keeps its data locally on your computer, under your Windows user account, in %APPDATA%\Messages for Desktop\. This includes:
messages.db) holding your conversations, messages, drafts, settings, and a cached copy of contacts used for matching and search.media-cache/ and scheduled-media/), plus any attachments you choose to save to a folder you pick.session.json), and, if you connect Google Contacts/Calendar, an authorization token (google-auth.json).This data is protected by your operating system’s file permissions and your user account. It stays on your machine unless you move or back it up yourself. You can delete all of it at any time by clearing that folder or uninstalling the app (see “Your control over your data”).
KrazeMessage works by pairing with the Google Messages app on your Android phone, the same way Google Messages for web does. You pair the two devices by scanning a QR/pairing code. From then on, the messages you send and receive are carried through Google’s Messages service (Google’s own servers) between your phone and the app.
This means your message content and media pass through Google’s infrastructure as an inherent part of how Google Messages works. That traffic is governed by Google’s privacy policy and terms, not by KrazeMessage. KrazeMessage is not operated by, affiliated with, or endorsed by Google. We do not receive a copy of this traffic; it goes between your devices and Google.
KrazeMessage includes optional AI features: reply suggestions, drafting a reply, rewriting the tone of a message (for example, more formal or shorter), summarizing a conversation, translating a message, and detecting possible calendar events in your conversations.
AI is off by default. To use it, you turn AI features on in Settings and provide your own Anthropic API key (or connect your locally installed Claude Code, if you use it). There is no AI key bundled with the app. When AI is off, no message content is sent to any AI provider.
When you enable AI and use one of these features, the relevant text is sent from your computer directly to Anthropic (the maker of Claude) to produce the result:
Because you use your own Anthropic account and key, Anthropic’s handling of this data is governed by your agreement with Anthropic and its API terms and privacy practices. Under Anthropic’s commercial API terms, API inputs and outputs are not used to train its general-purpose models by default. KrazeMessage does not send your messages to any AI service other than as described here, and never when AI features are turned off. AI results can be wrong; review anything important before you rely on it.
If you choose to connect your Google account for contacts and calendar, KrazeMessage uses a standard Google sign-in on your computer and requests permission to access your Google Contacts and Google Calendar. This connection is entirely optional and separate from message pairing.
The authorization token that lets the app do this is stored locally on your device (google-auth.json), protected by your operating system account. You can disconnect at any time, and you can also revoke KrazeMessage’s access from your Google account’s security settings.
KrazeMessage’s access to, and use of, information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google Contacts and Google Calendar is used only to provide the features described above that you choose to enable; it is stored only on your own device; it is never sold, never used for advertising, and never transferred to others except as needed to provide those features at your request or as required by law; and human access to it is not permitted except where you have granted consent, for security or debugging you request, or as required by law.
The GIF picker is off until you enable it by providing an API key for a GIF provider (GIPHY by default; Tenor and Klipy are also supported). When enabled, the text you type to search for a GIF is sent to that provider to return results. No GIF provider key is bundled with the app, and no GIF searches are sent anywhere when the feature is not configured.
When a conversation contains a web link, KrazeMessage fetches that link from your computer to build a small preview card (title and image). This means the destination website, and any service it uses, may see a request coming from your device, as it would if you opened the link in a browser. Only the linked address is requested; your messages are not sent to it.
To keep itself current, the app checks for updates when it launches and periodically while running (you can turn this off in Settings). The check is a simple request to the developer’s update server at updates.kraze.online for the latest version information and, if you choose to install, the installer file. As with any web request, that server can see your device’s IP address and basic request information in its logs. No usage data, message content, or device identifiers are sent as part of the update check.
KrazeMessage contains no analytics, telemetry, crash reporting, advertising, or third-party tracking. The app does not build a profile of you and does not report your activity back to us or anyone else. Features that look like analytics, such as “Relationship Radar” and conversation statistics, are computed entirely on your device from your local data and are never transmitted.
Requests to the KrazeMessage website (messages.kraze.online) are logged by our hosting infrastructure. These logs include information such as IP address, browser/user-agent, the requested page, and the time of the request, and are used for security, abuse prevention, and operating the site. The website does not use advertising cookies or third-party behavioral tracking, and does not build an advertising profile from your visit.
Connections the app makes to external services (Google, Anthropic, GIF providers, and the update server) use encrypted (TLS) connections. Your local data is protected by your operating system account and file permissions. Because your data lives on your own device, its security also depends on the security of your computer and your accounts, so keep your device, your Google account, and any API keys protected. No method of transmitting or storing information is perfectly secure.
Because everything is local, you are in direct control:
%APPDATA%\Messages for Desktop\, or uninstall the app to remove it from your device.We have no server-side copy of your data to provide, correct, or delete, because we never receive it.
KrazeMessage is intended for adults and is not directed to or designed for children. We do not knowingly collect personal information from children. Because the app stores data locally and we operate no account system, we do not receive personal information from any user, including children.
Some browsers send “Do Not Track,” Global Privacy Control, or similar signals. KrazeMessage does not sell personal information, does not engage in cross-context behavioral advertising, and does not track users across unrelated websites. Because those activities do not occur, these signals do not change how KrazeMessage operates.
We may update this policy as the app changes, the services it connects to change, or legal requirements evolve. When we do, we will revise the effective date at the top. Material changes will be reflected on this page.
KrazeMessage is operated by an individual in California and is not currently a separately registered corporation or limited liability company. For questions about this policy or KrazeMessage’s privacy practices, contact privacy@kraze.online.