ToolyONLY
The one rule that covers most of it: a safe exporter only reads. It never sends a message, never adds anyone, never automates. Reading your own contacts is invisible to WhatsApp's anti-spam systems; automation is what gets accounts banned.
The five things a risky exporter does
Most WhatsApp contact exporters look identical on their store page. The differences are in what the code actually does once it's installed. These are the five patterns worth avoiding — described generically, because they show up across many tools:
Some exporters upload the contacts they read — and a few even report your own WhatsApp number and a device ID back to their servers on every action. Once data leaves your machine, you can't unsend it.
Does everything on your device. The file is built locally and lands in your Downloads folder. Nothing is uploaded — it keeps working even with your network switched off.
A contact exporter only needs to read WhatsApp Web. If it requests access to all sites, it can read pages that have nothing to do with WhatsApp.
Reads WhatsApp Web and no other page you visit. Any other domain it lists should have a stated job — for Tooly, Google sign-in and tooly.contact exist only for optional Premium sign-in and never receive contacts. Check the permission prompt at install before you click Add.
Some tools modify the WhatsApp Web page to show their own promos, upsells or banners. Anything that rewrites the page can also read everything on it.
Never changes WhatsApp. It reads the data already loaded in your session and leaves the interface exactly as WhatsApp built it.
A number of tools detect your location by IP and quietly raise or lower the price. You can pay more than someone in another country for the identical product.
Publishes one price for everyone, everywhere. No location sniffing, no surprises at checkout.
"Leave 5 stars to unlock." Beyond being against store policy, it tells you the ratings you're trusting were coerced, not earned.
Gives you the free features with no strings, and only ever asks for a review — it never gates anything behind one.
Your 6-point safety checklist
You can apply this to any WhatsApp exporter — Tooly included — in under a minute:
- Read-only. Does it only read, or can it also send/add/broadcast? Sending is the ban risk — avoid it.
- Narrow site access. Does it read WhatsApp Web only, or all sites? Every extra domain should have a stated reason. Fewer is safer.
- On-device. Does it still work with your network off? If yes, your contacts aren't being uploaded.
- No page injection. Does WhatsApp look untouched while it runs? It shouldn't add banners or popups.
- Honest pricing. Is the price the same regardless of where you are? Watch for IP-based pricing.
- Earned reviews. Are features free without a forced rating? No "5 stars to unlock."
How Tooly answers all six
Tooly was built to pass its own checklist. Every line here is something you can verify — on the store listing, in the permission prompt, or by pulling the plug on your Wi-Fi mid-export:
Is exporting against WhatsApp's rules?
No. Your contacts belong to you, and reading them out of your own signed-in session is not automation. What crosses WhatsApp's line — and what actually gets accounts restricted — is doing things to the account: bulk-messaging strangers, auto-adding people to groups, or broadcasting. A read-only exporter never does any of that. Use the numbers you export responsibly and with consent: export is for organising the contacts you already have a relationship with, not for cold outreach.
Export your contacts the safe way
Read-only, on your device, reads WhatsApp Web only — and it shows you exactly what it read.
Add Tooly to Chrome — free