WhatsApp has added two-step verification and automatic end-to-end encryption to strengthen their security, but it’s still not 100% safe to use. For one, web malware is a major threat. The app has over a billion users, and when the company announced the launch of desktop app and web interface at the beginning of 2015, a lot of fake sites and apps stealing data and distributing malware emerged.

Only your device can decode the messages you send, but they’re not necessarily safe while on your device. You can create a backup to Google Drive or iCloud on both Android and iOS. This backup contains the decrypted messages on your device.

The EU approved Facebook’s merger with WhatsApp on the condition that their data would be kept separate. This didn’t last long. In 2016, WhatsApp amended its Privacy Policy to allow data sharing from WhatsApp to Facebook, guaranteeing that no information would be visible on the social network publicly. Users could adjust their settings to turn this data sharing off. Unpleasantly enough, sharing was on by default, and if you wanted it off, you had to turn it off manually.

As things currently stand, WhatsApp users can choose between the following settings for their profile photos and/or status: nobody (nobody can see them), my contacts (only people in your address book can see them), and everyone. You can also block contacts and control what you share.

WhatsApp doesn’t store messages after they have been delivered. This policy was adopted to help ensure message confidentiality and security. However, any messages sent to someone else on WhatsApp will remain in their possession and this person will be able to share these messages with other people, both on and off WhatsApp.

Finally, it’s important to use the app’s location feature to share your location only with trusted persons.