VERSION 2026-09-23-BETA
Privacy Notice
This notice describes data handling in the current closed beta. The controller disclosure is incomplete: merchant identity and jurisdiction are not invented or silently substituted. Paid checkout remains disabled while those commercial disclosures are missing.
Data collected
The service may process Telegram OIDC identifiers and the profile fields covered by the requested scope; website sessions and login times; policy acceptance and security events; trial, plan and access state; notification preferences; support requests; and necessary technical logs. If email login is enabled later, the account email and single-use login audit are also processed.
For a future payment the service records order ID, USD value, discount, token and network, quoted amount, provider status, public transaction reference and refund state. Private keys and seed phrases are never requested.
Purposes and recipients
Data is used to authenticate users, provide trial or paid access, deliver signals, remember preferences, answer support requests, prevent abuse and keep security and audit records. Necessary data may be processed by Telegram for login or messaging, hosting and backup providers, and—only when checkout is enabled—the selected payment provider.
Retention
- Unused login state is deleted after 10 minutes; only a replay-prevention hash may remain for 24 hours.
- Revoked or expired website sessions are deleted within 30 days; routine technical logs are retained for 90 days unless connected to an incident.
- Closed support tickets are retained for 2 years. Payment, entitlement, refund, referral and acceptance audit records are retained for at least 5 years or longer when mandatory law requires it.
Rights and security
Where applicable, users may request access, correction, export, deletion, restriction or objection through authenticated product support. Identity is verified before disclosure or deletion. Required financial and audit records may be restricted instead of erased until their retention period ends.
Secrets, authorization codes and session tokens are excluded from application logs. Access is least-privilege and backups are protected. This notice will be replaced by a jurisdiction-complete version before public paid checkout opens.