Privacy Policy

TgBotAI ("we", "us", "our") provides a no-code platform for building Telegram bots, with optional AI assistance and crypto-native billing on the TON blockchain. This Privacy Policy explains what information we collect from you ("you", "your"), why we collect it, how we store it, and what choices you have.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use TgBotAI.

1. Information We Collect

We collect only the data we need to operate the Service:

• Account data: the email address you register with, a username of your choice, and a salted hash of your password. We never store passwords in plaintext.
• TON wallet address (optional): if you sign in via TON Connect or pay for a subscription, we record your public wallet address. Wallet addresses on TON are public by design — we never see or store private keys.
• Bot configurations: the flow configs, node settings, Telegram bot tokens, and metadata you create on the platform. Telegram bot tokens are stored server-side and are never returned to the browser in full — the UI only sees a masked hint.
• AI dialog history: the messages you exchange with our AI builder assistant, and the AI's responses. This history is what makes iterative refinement of your bot possible.
• Payment transactions: records of TON blockchain transactions associated with your subscription — amounts, memos, timestamps, and resulting plan status. Transactions on the TON blockchain are public; we link them to your account internally.
• Operational logs: minimal request logs (timestamp, route, status code) for debugging, security, and abuse prevention. We do not run third-party analytics trackers or advertising pixels.

2. How We Use Your Information

We use the information described above to:

• provide, operate, and maintain the Service;
• let you sign in, recover your password, and manage your account;
• generate AI responses that help you build and refine your bot;
• verify TON blockchain payments and grant the corresponding subscription tier;
• enforce plan limits (such as the FREE-plan single-bot quota);
• respond to support requests;
• detect fraud, abuse, or violations of our Terms of Service.

We do not sell your data. We do not use your data to train third-party models without your consent.

3. Sharing & Third Parties

We share limited data with the following categories of providers, only when needed to deliver the Service:

• AI providers (such as OpenAI, Anthropic, and OpenRouter): when you chat with the AI builder, we forward your messages and minimal context (your current bot's flow config) to the provider so they can return a response. We do not send your password, email, or payment data to these providers.
• Telegram: bots you build run against the Telegram Bot API. Messages between your end users and your bot pass through Telegram's servers, governed by Telegram's Privacy Policy.
• TON network: subscription payments are recorded on the TON blockchain, which is a public ledger. Anyone can see the transaction itself; only we link it to your account.
• Hosting infrastructure: our servers and databases run on cloud infrastructure providers under standard commercial data-processing agreements.

We may also disclose information if we are legally required to do so (e.g. a valid subpoena or court order), or when necessary to protect the rights, safety, or property of TgBotAI or our users.

4. Storage & Retention

Account, bot, and AI dialog data is stored in PostgreSQL and Redis databases running on managed infrastructure. Connections to and between our services use TLS. Passwords are stored only as bcrypt-style salted hashes. JWT secrets and internal API tokens are kept out of source control.

Retention periods (TODO — to be finalized before public launch): we retain account and bot data for as long as your account is active. AI dialog history is retained while the related bot exists. Operational logs are kept for a short rolling window (target: 30 days) for debugging and security. Payment records are retained as long as required for accounting and dispute resolution.

Encryption at rest is on the roadmap and depends on the final hosting choice. Until that is finalized, you should not store secrets in your bot configs that you would not be comfortable storing on our servers.

Data residency: the geographic region where your data is stored will be disclosed here once finalized (TBD).

5. Your Rights

We aim to honor the rights granted by data-protection laws such as the GDPR and similar frameworks, regardless of where you live. You can:

• Access the data we hold about you by writing to kuprik666@gmail.com.
• Correct inaccurate account data via your settings page or by contacting us.
• Delete your account and associated bot configs. Today this requires a support request; full self-serve deletion is on the roadmap.
• Export your bot logic — every bot has an "Export" button that downloads a self-contained Python file you can run independently of TgBotAI.
• Object to specific uses of your data. We will explain why we processed it and stop if there is no overriding legitimate reason to continue.

Note: data already written to the public TON blockchain (payment transactions) cannot be deleted by us — the blockchain is immutable.

6. Cookies & Local Storage

TgBotAI does not use third-party tracking or advertising cookies. We use the following client-side storage mechanisms:

• Authentication token (localStorage): after sign-in, your JWT access token is stored in your browser's localStorage so you stay logged in across reloads. We are migrating to HTTP-only cookies in a future release for stronger XSS protection.
• UI preferences: minor settings such as your last-active bot or sidebar state may be cached locally to make the UI feel responsive. These are never sent to third parties.

7. Children

TgBotAI is not directed at children. You must be at least the age of digital consent in your jurisdiction (typically 13, 16, or 18, depending on country) to use the Service. The minimum-age policy will be finalized before public launch (TBD). If you believe a child has created an account, please contact us so we can remove it.

8. Changes to This Policy

We will update this Privacy Policy as the product matures. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify registered users by email or via an in-app notice. Continued use of the Service after a change constitutes acceptance of the updated policy.

9. Contact

Questions, requests, or complaints about this Privacy Policy can be sent to kuprik666@gmail.com. We aim to respond within a reasonable time frame.