Privacy Policy

Last updated 25 October 2026

Telepath is a product of lemma (lemma.company), operated by Konstantin Prokhorov. It connects your Telegram account to your own AI assistant so you can search, read and reply to your chats. This policy explains what we process and why. Questions: hello@lemma.company.

What we process

Your 1:1 Telegram messages — text, captions, file and media metadata, and voice/video notes — archived so your assistant can search and read them.
Optional, only if you enable them: groups the bot is added to, channels you explicitly connect as their owner, their linked discussion groups if you connect comments, the bot's own direct messages, and notes you create in Telepath.
Account & auth — your Telegram user id and login (to identify your account), OAuth tokens (stored hashed), and, if you connect your own bot, its token (stored encrypted).
Reminders you request — reminder text, scheduled time, timezone and delivery status are stored in your account, either independently or linked to a task. We also keep daily creation counts to enforce your allowance. The Telepath bot sends the reminder to your own Telegram chat. You can view and cancel pending reminders in the bot; for task reminders, you can also delete the task; completing the task also cancels a pending reminder.
Billing — your subscription status, payment identifiers, purchased products, amounts and refunds. Telegram purchases use Stars. Website purchases use Polar as merchant of record, with Stripe processing payments. We send Polar your Telegram account identifier and the name you use to sign in to associate the purchase with your account; chat contents are not shared for billing. Polar collects the billing details needed at checkout. We do not receive full card numbers or security codes.
Conversations with the Telepath setup bot — messages and captions you send, attachment references, bot replies and buttons, edits, actions and delivery results, including before registration. We use this separate record to provide support and diagnose setup problems. It is not exposed to your AI assistant through the connector. Recognized login credentials and tokens are redacted; attachment files are not downloaded for this record.

Product usage metrics

We record account-linked feature milestones, daily useful activity, assistant type, known entry source and successful purchase metadata to understand onboarding, retention and paid-feature adoption. These metrics contain no message text, prompts, API keys or raw payment identifiers. Milestones and attribution are kept until account deletion; daily activity is kept for up to 90 days, and entries that never register are removed after 30 days. This is first-party measurement, without tracking cookies or fingerprinting. Website billing uses an essential, HTTP-only session cookie to keep you signed in for up to seven days; it is not used for advertising.

Why we process it

Only to provide the service you asked for: searchable history, reading files and transcribed voice, replying as you, notes, billing for paid features, support and troubleshooting, and measuring use to improve onboarding and the service. We do not sell your data and we never use it to train AI models.

Who it is shared with

Your AI client (ChatGPT, Claude, Grok, etc.) — you connect it yourself; your requests and the data you ask it to read flow to it under that provider's terms.
Audio transcription — when transcription is enabled, voice/video-note audio is processed by an operator-controlled GPU worker when available, with OpenAI (gpt-4o-mini-transcribe) as the cloud fallback. Temporary audio copies are deleted after processing; transcripts remain in your archive. Cloud requests are subject to OpenAI’s applicable data-processing and retention policies. Telepath does not use this audio to train models.
Telegram — the platform your messages already live on.

Daily digests (optional)

If you enable daily digests, Telepath automatically selects recent active chats and sends a bounded amount of message text and existing transcripts to OpenAI to summarize. This includes messages available through your connected Telegram Session or your Telepath archive. No new audio transcription is started by a digest. OpenAI API requests use store:false and are subject to OpenAI’s applicable data-processing and retention policies. You can turn off future digests in the bot at any time.

Digest source messages are not saved as a separate copy. The prepared digest is encrypted while waiting for delivery and removed from the queue after delivery or a final failure. Delivery and usage metadata are retained for up to 30 days. A hashed Telegram account identifier and trial-use record are retained separately, including after account deletion, to enforce one free digest trial per Telegram account; this record contains no message content.

About the people you chat with

Your chats contain messages from the people who contact you. As the owner of that inbox you are the controller of that data; you are responsible for handling your contacts' information lawfully, as you already are with any CRM, email, or helpdesk tool. Telepath acts as a processor on your behalf.

Retention & your controls

Archive data is kept until you delete it. Send /deletedata to the bot to permanently erase your entire archive, settings, subscription record and setup-bot conversation history. This command also works before registration.
The separate setup-bot conversation record is retained for 30 days; detailed technical journey events are retained for seven days.
Remove the bot in Telegram’s Chat automation settings and save the change to stop any further archiving; revoke the connector in your AI client to cut its access.
Media files are deleted from our server as soon as a transcript is stored.
Adjust what the connector may do at any time with /settings.

Security

Traffic is encrypted in transit (TLS). Each account's archive is isolated through account-scoped data access; auth tokens are hashed and connected-bot tokens encrypted at rest; and the server's disk uses full-disk encryption (LUKS), so stored data is encrypted at rest. Telepath is not end-to-end encrypted — running search and transcription requires our servers to read your data, so we can technically access it and only do so to operate the service or, with your request, for support. If you need a guarantee no operator can read it, the connector can be self-hosted on your own machine.

Children

Telepath is not directed to children under 13 and must not be used by them.

Changes

We may update this policy; the date above changes with it. Material changes will be surfaced in the bot.

Connected channels

When you explicitly connect a channel you own, we verify your ownership and the bot’s permissions through Telegram and store new posts, edits, attachments and available aggregate reaction counts. If you separately connect its discussion group, we store received discussion messages and the links between posts and comment threads. Anonymous reaction updates do not identify individual voters. This feature does not read your Telegram subscriptions or channel Direct Messages inboxes.

Channel actions are performed only within authorized capabilities. We retain an action key, payload hash, outcome and minimal Telegram result identifiers to prevent duplicate publications, until account deletion. These records do not contain post bodies or button URLs; post content follows the archive retention rules. Disconnecting stops future collection but does not erase existing data. Deletion through Telepath is reflected in the archive; deletions performed by other channel administrators may not be detected.

Optional AI auto-reply

To enforce the one-time 14-day auto-reply trial, we keep a hashed account identifier, trial start and expiry times, and whether an expiry notification was attempted. This minimal eligibility record remains after account deletion to prevent repeated trials; it contains no API key, instructions or message content.

If you enable auto-reply, Telepath sends your saved instructions and a bounded text context from selected private Telegram Business conversations to OpenAI through the Responses API, using your own API key. You choose the model, recent customer-message count and daily request limit. Context includes intervening replies, with a maximum of 24,000 characters and 3,000 characters per message. Media files are not sent for this feature.

For optional group auto-replies, the current group owner selects a group through Telegram, grants the bot administrator status for ownership verification, and explicitly enables replies. We verify ownership before processing and again before sending. Only explicit mentions of the shared Telepath bot trigger replies. Context is limited to the same participant’s addressed text messages and the bot’s replies in the same group topic, using up to 1–30 turns from the previous 30 days and the same character limits. Other participants’ conversations, private chats and Notes are not included in these requests. Replies are visible to everyone in the group. Group settings and encrypted API keys are separate from private-chat settings; the trial entitlement is shared.

OpenAI API usage is billed separately to your account. We send store: false; this does not override OpenAI’s applicable abuse-monitoring or other retention policies. Your API key is stored encrypted on our server and is never exposed through MCP tools. You can remove it and disable auto-reply in the bot’s settings screen.

We store automation settings, per-conversation handoff state, activity timestamps and optional auto-resume deadlines, and delivery/job metadata. Job and usage metadata are retained for up to 30 days. Conversation text follows the archive retention described above; pending handoff state remains until resumed or account deletion. Notifications to you may include a short excerpt from the customer’s latest message. Deleting your Telepath data also deletes the automation key, settings and records.

Turning automation off stops new work; a message already being sent may still arrive. You are responsible for choosing the conversations and instructions you authorize, and for informing your customers as appropriate.