LEGAL

Terms of Service

Please read this before generating or deploying a SAHAN-MD session.

Last updated: 2026-11-04

1. Acceptance

By using this pair site, generating a pair code / QR code, or deploying a bot with a SESSION_ID issued here, you confirm that you have read, understood and agree to these Terms. You must only link a WhatsApp account that you own or are authorised to administer.

2. What this service does

The site links your WhatsApp account as a companion device using a pair code or QR code. On success it stores the full authentication state (creds plus every Signal key), encrypted, in MongoDB, and issues a short random SESSION_ID token. Your bot uses only that token to open, update, renew, release and revoke its own session over HTTPS.

3. Your SESSION_ID is a bearer credential

Anyone who obtains your SESSION_ID can connect a bot to your WhatsApp account.
Never share it, never paste it into public chats, issues, screenshots or logs.
Store it only in your deployment platform's private environment variables.
The session is shown once in the browser; the server cannot show it again.
If you believe it leaked, revoke the token and unlink the device in WhatsApp.

4. Delivery to your WhatsApp inbox

Upon request, the generated SESSION_ID and deployment instructions are also sent as a message to the WhatsApp account you just linked (a message to yourself). This is a convenience feature with real privacy implications:

The token is transmitted through and stored by WhatsApp's systems and appears in your chat history.
WhatsApp / cloud chat backups, linked devices and notifications may retain or display it.
Delete that message from your chat after copying the SESSION_ID.
Do not use this feature on shared or monitored devices. It can be disabled by the operator with SEND_SESSION_TO_WHATSAPP=0.
If WhatsApp delivery fails, the browser copy still works; delivery is best-effort.

5. Encryption and storage

The whole snapshot is encrypted with AES-256-GCM, a fresh nonce per write, authenticated with the session id and phone number.
MongoDB stores only a hash of the token as the record id plus the encrypted envelope; the plaintext token is never stored or logged.
Unclaimed sessions expire after 15 minutes. Claimed sessions persist across restarts.
There is no MEGA upload, no plaintext token and no disk fallback for stored sessions.
Backups of the encryption key are the operator's responsibility; changing it without migration makes every stored session unreadable.

6. Revocation is not unlinking

Revoking a token removes the encrypted payload, but it does not invalidate WhatsApp credentials already copied into a running bot. To fully invalidate a session, open WhatsApp → Settings → Linked Devices and unlink the SAHAN-MD device.

7. Acceptable use

You are solely responsible for your bot's behaviour, messages, automation and compliance with WhatsApp's own terms and applicable law. Do not use the service for spam, harassment, unsolicited messaging, impersonation, or to access accounts you do not control. The operator may rate-limit or block abusive use (per-IP start limits, concurrent attempt caps).

8. No warranty

The service is provided "as is" without guarantees of availability, delivery, compatibility with any particular bot build, or continued access. WhatsApp may change its pairing behaviour, log out companion devices, or reject connections at any time. Features shown on the landing page describe a typical SAHAN-MD bot build and depend on the bot software you deploy.

9. Changes and contact

These Terms may be updated; the "Last updated" date above will change. Official links:

Website: https://sahan-test.enzonic.dev/
WhatsApp Channel: https://whatsapp.com/channel/0029VbDAxUKJpe8fTZfJwl0x
Terms: https://sahan-test.enzonic.dev/terms (or /terms)

I understand — generate a session Back to home