Your chats. Your choice.
You choose which chats to connect and which AI gets access. Messages are kept for up to 30 days. The ChatMate server can read them. This is not end-to-end encryption.
01History starts at connection
ChatMate saves new messages, captions and attachment details from selected chats for up to 30 days. It does not import earlier conversations, Secret Chats or channels. Your AI opens photos and documents when needed. Automatic transcription and picture storage also process new attachments as described below.
02Data from your chats
For each connected chat ChatMate keeps its name and Telegram id. For each saved message it keeps the text, caption, quotes, reply and forwarding details, earlier versions of edited messages and attachment details such as file name, type and size, with the sender's Telegram id, name, username and language as Telegram provides them. Messages can also hold contacts with phone numbers, locations and venues, polls with the votes of people in polls that are not anonymous, checklists, reactions with who reacted, and group topic names. Messages you write to your own bot are kept the same way. ChatMate keeps a list of the people who write or react in connected chats, with their names, usernames and when they were last active. It adds transcripts, image descriptions written by your AI, encrypted copies of pictures and files, Radar cards, tracked commitments and reminders, chat labels and notes your AI saves, rules you write for a chat, the members and time zones of groups where you turn on Smart Time, and the messages and actions your AI sends or proposes. In Russian and Ukrainian, ChatMate reads your grammatical gender, and that of a person who promised you something, from the word forms you and that person use about yourselves, so that cards are worded correctly. It is worked out when needed and not stored.
03Your account and use of ChatMate
Your account holds your Telegram id, name, username and Telegram language, the site language, your time zone, a small copy of your Telegram profile photo, your bots and their settings, the country of your connection as our hosting provider reports it, and your device type, such as iPhone or Windows. ChatMate also keeps the AI apps you connected, the chats each one may use and when you revoked it, and a log of the tools they call with the time and result, without the request or its content. Sign-in, session and AI access tokens are stored only as hashes. The address and key of an automation you set up in Claude, Cursor or Devin, and the address and signing secret of an AI app that subscribes to updates, are kept encrypted in the vault, where ChatMate can read them to make those calls. For minute packs it keeps Telegram Stars purchases with the payer's Telegram id, the amount and the Telegram payment id, and your minutes and their use. It keeps what you write to @chatmate_aibot and our replies, the notices and reminders it sends you, your reminder settings and the consents you gave. When you arrive from our website it keeps the page, the referring site, campaign tags, ad click ids and referral links, and links them to your account when you start. ChatMate does not store your IP address or browser user agent; to limit abuse it keeps only a hash of the IP address made with a secret key, with a request count.
04How ChatMate uses data
ChatMate uses this data to run what you set up: to save and search your chats for your AI, send messages and files at your request, transcribe audio, keep picture copies, run Radar, reminders and Smart Time, and answer you in your bot. It also uses it to sign you in, keep each owner's data separate and limit abuse, to process Stars purchases and refunds, to answer your messages and send service notices and reminders, and to see, without message content, which pages and links bring new users and which tools work. ChatMate does not sell personal data, does not show ads and does not use chat content for advertising.
05Access needs your permission
Connecting an AI requires Telegram sign-in and your approval. Each owner's data is kept separate. What your AI reads is processed under its provider's terms. ChatMate does not use messages to train models.
06Automatic transcription
ChatMate automatically downloads new voice messages and audio files up to 20 minutes long and the audio track of video circles up to 60 seconds long, and sends the audio to OpenAI for speech-to-text. This can happen on arrival, before you connect ChatGPT or Claude, or when your AI reads the clip. Video frames are not sent for transcription; other videos are not transcribed. Monthly and daily minute limits apply. Audio files used for processing are removed after the run. Transcripts are kept with the message, available to your permitted AI and included in your export. Recognized secrets in transcripts are masked before storage, but this is not a guarantee and the audio has already reached OpenAI. Machine transcripts can get words, names and numbers wrong.
07Stored copies of pictures and files
ChatMate automatically downloads one encrypted copy of each new photo, static sticker preview and image file, and of each other file up to 5 MB, while Telegram still serves it. Image files are resized and re-encoded without metadata; other files are kept as they are. Copies are kept within storage limits for the message's history window and deleted with it; protected content is not copied. The encryption key is held separately from the database, but the ChatMate server can decrypt a copy and give it to your AI after checking access. These copies are not included in exports.
08Radar and reminder checks
For Radar and reminder checks, ChatMate sends a limited conversation context to an external model through Vercel AI Gateway to find requests and timed promises and to check whether tracked commitments remain open. This context can include message text, transcripts, saved image descriptions, attachment types and message times, the chat's name and the names of people in it, your name and username, the grammatical gender read from your own messages, chat profile notes, your rules for the chat, earlier card summaries and open reminders, and up to 30 of your own recent messages from your other connected chats. Secrets that ChatMate recognizes are masked first. In groups where you turn on Smart Time, a member's message that contains a digit is also sent to the model so the time it mentions can be read. Before that, secrets that ChatMate recognizes are masked in it too, and code, quotes, links, mentions and phone and card numbers that Telegram marks in it are removed. The default model provider is Anthropic. This processing is separate from your connected ChatGPT or Claude account and can run in the background; reminder checks also run when Radar is off. It does not itself authorize messages to other people.
09Files your AI sends
When you ask your AI to send a file to Telegram, ChatMate receives it from that AI: the AI uploads it to ChatMate's private storage (Supabase Storage), passes small content in the request, or names a public https link or a ChatGPT conversation file, which ChatMate's server downloads. ChatMate keeps the file with its name, type, size and checksum for that AI connection only, checks it and sends it through Telegram to your bot chat or to a connected chat you asked for. Links are not stored. Files are deleted 24 hours after they are prepared, or two hours after their latest send or confirmation card if that is later. Disconnecting that AI makes its files unusable at once; deleting your data removes them sooner. A sent copy stays in Telegram and, like other sent messages, in your message history.
10Who receives data
Telegram delivers messages, cards and payments, handles sign-in and runs the Mini App; its scripts load on the sign-in and Mini App pages. Supabase hosts the database, file storage and the vault for bot tokens and automation keys. Vercel hosts the website and the server, runs background jobs and passes the Radar, reminder and Smart Time requests to the model provider, Anthropic by default. OpenAI receives audio for transcription. The AI app you connect receives what its tools return and processes it under its provider's terms. An automation you set up in Claude, Cursor or Devin receives only a task id and the key you gave it. When your AI asks to send a file from a public link, ChatMate's server downloads it from that site. On public pages, the analytics services described below receive visit data.
11How long data is kept
Messages from connected chats are kept for 30 days after they were sent, together with their earlier versions, attachment details, reactions, transcripts, image descriptions, picture and file copies and Radar cards. When Telegram reports that a message was deleted, ChatMate clears it at once. A person leaves the list of people once none of their messages or reactions remain. Incoming updates waiting to be processed are cleared within 72 hours. Tracked commitments and reminders are removed 30 days after their last change, and records of messages and actions your AI sent or proposed after 30 days. Smart Time members and their time zones stay until you turn Smart Time or the group off, and its time cards are removed after 14 days. An export can be downloaded for 24 hours, and its prepared parts are removed after 7 days. Messages with @chatmate_aibot are kept for 60 days. The tool log is kept for 90 days, and entries for calls that returned content or completed an action for up to 400 days. AI sign-ins are removed a day after they expire or are revoked. Automation keys stay until you replace or remove the automation, its AI connection ends or you delete your data, and an AI app's subscription to updates ends at most 24 hours after its last renewal. Website and Mini App sign-in sessions are removed 30 days after they expire or you sign out, and the small copy of your Telegram profile photo 30 days after it was made. Your account, settings, chat list, chat labels and notes, chat rules, AI connections, purchases, minutes, notices, visit details and setup progress are kept until you delete your data. Records of your export requests and requests to turn everything off are removed 30 days after the request, visit records from our website that never lead to an account after 90 days, and the hashed rate limit counters after a day. Records of deletion requests have no time limit: they are needed to repeat a deletion if an older backup is restored.
12Disconnect, download or delete
In My data you can disconnect a chat or AI, download an export and delete your data. Turning off a chat stops new message storage and automatic processing for that source; messages already saved are removed as they reach 30 days. Disconnecting an AI removes its access; it does not turn off storage or service processing for connected chats. Deletion removes your account details, messages, the list of people, transcripts, picture copies, Radar and reminder data, prepared files, connections, purchases, usage records and exports. Some records remain in the primary Supabase database: a service record of the deletion with hashed identifiers and the request time; records of your export requests with their status and times, until 30 days after each request; an account record without your name, username or Telegram id that keeps a hash of the Telegram id made with a secret key, the site language and when the account was created and last active; the Telegram ids of your former bots; and records of operator actions on the account. For paid orders, the payer's Telegram id, the Stars amount and the Telegram payment id are kept for 90 days, and longer while a refund is due, to handle refunds and disputes. An older backup may restore deleted data without the deletion record; before reopening the service, the operator must reconcile deletion requests and repeat the deletions. Records in a previously configured independent deletion ledger are retained.
13Public website analytics
On our public pages, we use Vercel Web Analytics, Google Analytics and Microsoft Clarity to measure visits and improve the site. These services receive data about pages visited; Clarity also collects interactions with those pages and creates heatmaps and session recordings. Google Analytics and Clarity may use cookies to distinguish visitors and link page views. These tools do not load on sign-in, data management or admin pages. They do not receive content from connected Telegram chats. ChatMate's own cookies on public pages link a visit to a later sign-up, so we can see which pages and links bring new users. Sign-in and Mini App pages load Telegram's own scripts, so Telegram receives data about those visits. How Microsoft handles data
14Questions about your data
Write to us with questions about this policy or your data, including requests you cannot complete in My data. privacy@getchatmate.com