Who is responsible
The controller of your personal data is Victor Araya Jiménez, a sole trader in Costa Rica, reachable at admin@telegramrouter.com.
Costa Rican data protection law (Ley N.º 8968) applies to us. If you are in the European Economic Area or the United Kingdom, we will honour the rights the GDPR gives you, as set out below.
What we collect
- Account: your email address and a password stored hashed by our authentication provider — we never see it
- Telegram: your phone number, and a session that lets us read the channels you select and post to your destinations
- Channels and rules: the identifiers of the channels you listen to, and the forwarding rules you create — destination, name, template
- Messages: the text of messages from your listened channels, both as they arrived and as they were forwarded
- Subscription: the email address you bought with and the status of your plan, from Hotmart
- Technical: ordinary server logs — IP address, timestamps, error traces — kept to run and debug the service
We do not ask for your address, your date of birth or any identity document. We do not build advertising profiles, and we have nothing to sell to anyone.
Your Telegram session
The session we hold is the equivalent of a linked device. It lives in our database, which our provider encrypts at rest, and it is never returned by any endpoint — not to you, not to support, not to anything the app can call.
We read messages only in the channels you selected, and only while listening is switched on. Your two-step password, if Telegram asks for one during sign-in, goes straight to Telegram and is never stored. Private chats are not read for any purpose.
Switching listening off stops the reading. Disconnecting deletes the session.
The messages we store
For channels you listen to, we store the text of the messages we processed: the original text and the text that was actually delivered, per rule. That record is your forwarding history — without it, a delivery could not be shown to you and a failure could not be investigated.
Messages from channels you did not add are not stored. For those, the activity log records only that a message arrived, from a partly masked channel id, with no content.
Why we process it
- To provide the service you paid for: listening to channels, applying your rules, delivering messages. Without this data there is no product
- To keep your account secure and prevent abuse
- To check your subscription is active, by matching the email you bought with at Hotmart
- To debug and improve — investigating a delivery that failed
- To comply with the law where we must
Under the GDPR, the first three are performance of a contract, the fourth is our legitimate interest in a service that works, and the last is a legal obligation.
Who else sees it
We do not sell personal data and we do not share it for advertising. Each of these receives only what it needs to do its job:
- Supabase — database and authentication
- Telegram — you are connecting to your own account there, and forwarded messages are posted through it
- Hotmart — payments and subscription status. They are the seller and hold your payment details; we do not
- Vercel and Render — hosting the site, the app and the backends
We may also disclose data where the law requires it.
Where the data goes
Our providers run in the United States and Europe, so your data is processed outside Costa Rica and, if you are in the EEA or the UK, outside your own country as well. Where such a transfer needs a legal basis, we rely on the providers' standard contractual clauses.
How long we keep it
- Account data: while your account exists
- Telegram session: until you disconnect, or your account is deleted
- Channels, rules, forwarded messages and activity: while your account exists — it is your history
- Subscription records: while your account exists, and afterwards where tax or accounting rules require
- Server logs: a short operational window
There is no self-service delete yet. Ask us and we will delete your account and everything we are not legally required to keep.
Security
Traffic runs over TLS. The database and the authentication system are managed by Supabase and encrypted at rest. Your Telegram two-step password is never stored.
Every request to our backend is authenticated, and the account it can reach is derived from the signed token itself rather than from anything the browser can set.
No system is perfectly secure, and we do not claim otherwise.
Cookies
This site sets no advertising cookies and runs no analytics. The only cookie it sets is the one remembering your language. Your light or dark preference is kept in your browser and never sent to us.
The app sets the cookies needed to keep you signed in. Those are functional. There is no tracking in either place.
Your rights
You can ask us to:
- give you a copy of your data
- correct something that is wrong
- delete your account and its data
- restrict or object to some processing
- send your data somewhere else
Write to admin@telegramrouter.com. We will answer within the period our law requires, and sooner where we can. A reasonable request costs you nothing, and exercising a right will never make your service worse.
In Costa Rica you can complain to PRODHAB. In the EEA or the UK, to your local supervisory authority.
Children
This service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor holds an account, tell us and we will remove it.
Changes to this policy
We may update this policy. The date at the top says when it last changed, and material changes will be announced before they take effect.
Contact
Privacy questions: admin@telegramrouter.com
General support: Telegram, @apptelegramrouter