Every WhatsApp AI assistant is built to answer your customers. Yours is mostly family.

We make one of the tools below. Brownie is ours, so read this the way you would read any comparison written by someone with a stake in it. Everything in the table links out, every open-source project is named with its licence so you can go and look, and where something could not be verified we have said so instead of guessing.

Meta's only WhatsApp API is the Business Platform, and Meta's documentation is unambiguous about who it is for: it “enables businesses to communicate with customers at scale”. It wants a business portfolio and a business phone number, and the terms add that “using unauthorized third-party tools is prohibited”. There is no interface to your own account, and there never has been one.

Which leaves exactly one place your WhatsApp history exists in a form a program can read: the SQLite database WhatsApp Desktop keeps in its own group container on your Mac. The only thing that can open it is a program running on that machine, after you have granted Full Disk Access yourself. It cannot be a web service. Nobody can build this as a SaaS, and that one constraint sets the shape of everything in the table below: every tool that reaches your own chats is a program you install yourself, on the machine the messages are already sitting on.

This is the third time the same wall has turned up. Counting Obsidian plugins: of 9,759 in the community registry, not one mentions iMessage. Looking at promise trackers: everything that works automatically can only see email, because email has an open protocol and the messaging apps do not. The channels where real life happens are reachable only from a machine you own.

The exporters are good software and they do what they say. So does Message Summaries, which is genuinely useful and, on WhatsApp's own account, built carefully — the processing happens in Meta's Private Processing environment and WhatsApp says neither Meta nor WhatsApp ever sees “your messages or the private summaries”.

It would be wrong to say they all just hand you a copy. whatsapp-mcp lets an assistant read your chats and send from them, and SocializeAI will draft and send replies on its own once you start it on a thread. These go well past a folder of HTML.

Look at the fourth column instead. A bridge answers when an assistant asks it something. An exporter runs when you run it. Message Summaries waits for you to open the chat. SocializeAI watches the one thread you pressed Start on. Every one of them begins with a decision you made — which chat, which moment, which question. That is fine when you know what you are looking for, and no use at all for the thing you have forgotten.

The biggest version of this shipped in August 2026, when OpenAI gave ChatGPT on the Mac access to Apple Messages: it can search your threads, draft a reply and send it with your approval, given Full Disk Access. OpenAI's own description of the design is the interesting part — it reads your messages when asked and does not build an index of them. The largest company in the field built retrieval, deliberately, and said so.

So the gap is not access. Access is solved several times over, by people giving it away free. What is missing is something that reads the week without being asked, decides what mattered, writes it down, and is still right in March.

At an hour you choose — three in the morning, unless you say otherwise — the Mac wakes itself and a four-billion-parameter model on your own GPU reads everything new since last night. Not just WhatsApp: iMessage, Telegram, mail, Apple Notes, the calendar, files. Almost all of it is thrown away. What is left goes into plain Markdown notes, one per person.

By the time you sit down there are a handful of cards. Amma asked for the scan report again on Tuesday and it still has not gone. Karan said he would send his villa share on Friday, and nothing has come since. Priya is waiting to hear whether 3–6 October works for Goa. Each card shows the message it came from and a draft in your own words, and you press Send — Brownie never does.

None of those are things you would have thought to search for. You already knew all three, somewhere. The knowing was just not helping.

So here is exactly what happens. The database is opened read-only, on your Mac, after you have granted Full Disk Access and switched WhatsApp on specifically — every source is off until you turn it on one at a time. The reading is done by a model on your own GPU. The messages themselves never leave the machine, and that is structural rather than a promise: the only thing the pipeline is able to emit is a short summary that has passed a PII backstop.

That summary goes to whichever model you chose, with your own key, and the app lists every byte of it for thirty days under What left your Mac. Choose “This Mac only” and the figure is zero — no key, no account, no server, nothing to sign out of. Nothing is ever sent on your behalf: Brownie fills in the reply and stops before Send, which is enforced in code rather than asked for in a prompt.

An item the reader marks sensitive leaves no title, no summary, no card and no line in Brownie's own logs — a count, a time and the source it came from, and nothing else. Behind the model sits a deterministic backstop for six identifier classes, chosen for what actually turns up in a family WhatsApp: Aadhaar, PAN, passport, bank account with IFSC, Luhn-valid card numbers and US Social Security numbers. There are tests for both.

One difference worth knowing, because it is invisible from a feature list. Brownie reads the database WhatsApp Desktop already keeps on your Mac; it adds nothing to your WhatsApp account and cannot send through WhatsApp at all. The MCP bridges take the other route: you scan a QR code and they pair as a linked device, the same mechanism WhatsApp Web uses. That is an official path and it is what lets them send — but it does mean an extra device on your account, holding credentials that can message as you. Neither is the right answer for everyone; they are different trades, and most pages in this category do not tell you which one they made.

All of it is AGPL-3.0, so none of the above has to be taken on trust. The privacy page says the same thing in more detail, and the source is the final word.

The notes are an Obsidian vault on your own disk — plain Markdown with [[wikilinks]], yours to edit and still yours if you delete Brownie. Ask it “what did I promise Amma?” and the answer comes with the message it came from. It is free, AGPL-3.0, needs no account, and runs on an Apple-silicon Mac on macOS 14 or later with 8 GB of memory and one 3.7 GB model download.

The same split shows up in the neighbouring categories, and we wrote those down too: local AI assistants for Mac, where nearly everything is a chat window; AI and Obsidian, where every plugin reads the vault and the registry has almost nothing that fills it; what did I promise?, on closing a loop rather than logging one; and Apple Intelligence vs Brownie, on finding things versus remembering them.

Give it one night.