Telegram

Telegram can update its terms anytime without your new consent.

What this means: Telegram can change its Terms of Service at any time without requiring your active agreement to the new version. The ToS contains no clause requiring affirmative re-consent — simply continuing to use the service after a change is implicitly treated as acceptance.

What you can do: Periodically check telegram.org/tos for updates. If you disagree with a change, stop using the service before the new terms take effect.

Privacy policy updates bind you the moment they are published online.

What this means: Privacy Policy changes take effect the moment Telegram publishes the revised version on its website. You are expected to check the page yourself; there is no requirement for Telegram to obtain your fresh consent before the new data-handling rules apply to you.

What you can do: Subscribe to Telegram's announcement channel or check the privacy policy page regularly. If a change is unacceptable, delete your account before the new policy takes effect.

Regular chats are stored on Telegram's servers and are not end-to-end encrypted.

What this means: Regular (non-Secret) chats — including all messages, photos, videos, and documents — are stored on Telegram's servers in encrypted form, but Telegram holds the encryption keys. This means Telegram can technically access the content of your regular chats. Only Secret Chats use end-to-end encryption where Telegram cannot read the content.

What you can do: Use Secret Chats for any sensitive conversations you want to keep private from Telegram itself. Be aware that group chats and channels are always cloud-stored and not end-to-end encrypted.

Your IP and phone number can be shared with police on a court order.

What this means: Telegram will hand your IP address and phone number to law enforcement when it receives a valid court order in a criminal investigation. The threshold is being a suspect in activities that violate Telegram's own Terms of Service — not necessarily a conviction or even a formal charge. Disclosures are logged in a quarterly transparency report, which is a meaningful safeguard.

What you can do: Use a VPN to mask your IP address. Be aware that your phone number is always linked to your account and cannot be hidden from Telegram itself.

Your data is shared with Telegram affiliates in offshore jurisdictions.

What this means: Your personal data can be shared with Telegram's parent company and two affiliated companies, all registered in offshore jurisdictions (British Virgin Islands and Dubai). While standard contractual clauses are mentioned as a safeguard for EEA users, these jurisdictions have weaker data-protection oversight than the EU.

What you can do: EEA users can contact Telegram's GDPR representative (EDPO) to request details about the data-transfer safeguards in place.

Telegram keeps your IP address and device metadata for up to 12 months.

What this means: Telegram collects metadata including your IP address, device information, app versions used, and username change history for anti-spam and security purposes. This data can be retained for up to 12 months. While the retention period is capped, the scope of metadata collected is broad.

What you can do: Use a VPN to limit IP address exposure. Minimize unnecessary username changes to reduce the metadata footprint Telegram holds on you.

Telegram's algorithms can scan your regular cloud chat messages.

What this means: Telegram states it may use automated algorithms to scan the content of regular (non-secret) cloud chats to detect spam and phishing. This means your messages in standard chats are not private from Telegram's automated systems, even though they are encrypted in transit and at rest.

What you can do: Use Secret Chats for sensitive conversations — these are end-to-end encrypted and explicitly not stored or scanned by Telegram's servers.

Using translation or voice-to-text sends your message content to Google.

What this means: When you use Telegram's translation or voice-to-text features, the content of your messages or voice recordings is sent to Google LLC for processing. Google's contractual commitment is limited to providing the service and not using the data for its own products or advertising, but the data does leave Telegram's infrastructure.

What you can do: Avoid using the in-app translation and voice-to-text features for sensitive messages. Use Secret Chats where these features are not available.

Third-party bots can read your private messages to business accounts.

What this means: When you message a Telegram Business account that has connected a third-party chatbot, that bot can receive your messages and profile data. You may not know you are talking to a bot rather than a person. Business account owners can also grant bots full access to their private chats, allowing the bot to read all messages and act on their behalf.

What you can do: Be cautious when messaging business accounts on Telegram. Check whether a business account has a chatbot connected before sharing sensitive information.

Telegram can cancel your Premium subscription at any time.

What this means: Telegram can terminate its Premium subscription service at any time for any reason, including circumstances outside its control. If this happens, you receive a pro-rated refund for unused time. This means paid features you rely on could disappear with little notice.

What you can do: Avoid paying for long subscription periods upfront if continuity of Premium features is important to you. Monthly billing limits your financial exposure.

All purchases are non-refundable, including early subscription cancellations.

What this means: Purchases on Telegram — including Premium subscriptions and Stars — are generally non-refundable. If you cancel a subscription early, it remains active until the end of the paid period but you receive no partial refund for unused time.

What you can do: Trial the free features thoroughly before subscribing. Cancel before the renewal date if you no longer want the service, as refunds are not available.

Telegram processes your data without asking for your consent.

What this means: Telegram processes your personal data based on its own "legitimate interests" rather than asking for your explicit consent. This is a broad legal basis that lets Telegram decide for itself when processing your data is justified, without you actively agreeing. While GDPR permits this basis, it gives users less control than a consent-based approach. You can object to this processing, but the burden is on you to do so.

What you can do: If you are in the EU/EEA, you can object to processing based on legitimate interests by contacting Telegram's EDPO representative. Review your privacy settings under Settings > Privacy and Security to limit data use where possible.

Exercising your data rights requires contacting an external representative manually.

What this means: To exercise your data rights (access, deletion, correction, portability, objection), EU/EEA users must contact Telegram's external EDPO representative — there is no self-service mechanism described for these rights. This is a manual process that may be slower and less convenient than an in-app tool.

What you can do: Submit your data rights request via the EDPO online form or by writing to Avenue Huart Hamoir 71, 1030 Brussels, Belgium. For account deletion specifically, you can use the in-app deactivation page.

Telegram tracks your location in the background even when the app is closed.

What this means: If you enable Live Location sharing or the "People Nearby" feature, Telegram continues to track and broadcast your location even when the app is closed. This is an opt-in feature, but users may not realize the tracking continues in the background after closing the app.

What you can do: Disable Live Location sharing and the "People Nearby" feature when not actively using them. Check your active location shares in the app and stop any you no longer need.

Your phone number is permanently tied to your account and known to Telegram.

What this means: Your phone number is the permanent unique identifier for your Telegram account and cannot be changed to an anonymous identifier. If you consent to contact sync, Telegram stores your contacts' phone numbers and names on its servers. Your phone number is always known to Telegram and can be disclosed to authorities under a court order.

What you can do: Decline contact synchronization if you prefer not to share your address book with Telegram. You can delete synced contacts at any time under Settings > Privacy and Security > Data Settings.

Secret Chats are end-to-end encrypted and not stored by Telegram.

What this means: Secret Chats use end-to-end encryption with keys only you and the recipient hold. Telegram does not store these messages on its servers and keeps no logs of who you messaged or when. This is a strong privacy protection that goes beyond what most messaging services offer.

What you can do: Use Secret Chats for any conversation you want to keep private from Telegram and third parties. Note that regular cloud chats do not have this protection.

Telegram does not use your personal data for targeted advertising.

What this means: Telegram explicitly commits to not using your personal data for targeted advertising. Any sponsored messages shown in public channels are based only on the channel's topic, not on your profile or behaviour. This is a meaningful user-protective commitment.

What you can do: No action needed — this is a user-protective clause. Premium subscribers can also opt out of seeing even the topic-based sponsored messages.

Telegram publishes quarterly reports on all government data disclosures.

What this means: Every time Telegram shares user data with law enforcement, it commits to logging that disclosure in a publicly available quarterly transparency report. This allows users and researchers to monitor how often and under what circumstances data is handed over.

What you can do: Follow the transparency report channel at t.me/transparency to stay informed about government data requests.

You can fully delete your account and all data yourself at any time.

What this means: Telegram provides a self-service account deletion tool that removes all your messages, media, contacts, and cloud data. Deletion is permanent and irreversible, which is a strong user-protective feature.

What you can do: You can delete your account at any time via the deactivation page. Make sure to export any data you want to keep before doing so.

Inactive accounts are automatically deleted after 18 months by default.

What this means: Telegram automatically deletes inactive accounts after 18 months by default, removing all associated data. Users can adjust this period in settings. This is a user-protective feature that prevents indefinite data retention for dormant accounts.

What you can do: You can shorten the auto-deletion period in Settings to reduce how long your data is retained if you stop using the service.