Privacy Policy

Last updated: September 7, 2026

Overview

Chatroost (mcp-telegram.com) is a hosted connector that lets AI assistants (Claude, ChatGPT) access your Telegram account via the MCP protocol. Your privacy is important to us. This policy explains what the connector can reach, what we store, and your rights.

What the connector can access

The connector works through your own Telegram account, so it can reach the same data your Telegram app can. When you ask your AI assistant something, the connector fetches what that request needs, hands it to the AI client, and keeps nothing afterwards. Access is not the same as storage — the next two sections say exactly what we store and what we never do.

• Messages and media — Message text and captions, photos, files, voice messages and their transcriptions, from the chats your request concerns.
• Chats and channels — Your dialog list, group and channel details, forum topics, unread counters, drafts and reactions.
• Contacts — Names, usernames and phone numbers of the contacts saved in your Telegram account, returned when you ask for your contact list.
• Profile and settings — Your own profile, active sessions and privacy settings. For chats where you are an administrator, member lists and the admin log.
• Actions you ask for — Sending, editing, forwarding and deleting messages, reactions, and chat administration. Each one runs only on your explicit request, and irreversible actions stay switched off until you enable them.

What we collect

• Telegram session data — An encrypted session token is stored on our server so you stay connected between requests. It is deleted when you disconnect.
• Usage logs — We log which MCP tool was called (e.g. "list-chats", "read-messages"), the time, which AI client called it, and your Telegram user ID. Usage logs carry no message content. They are deleted automatically after 90 days.
• OAuth tokens — The access and refresh tokens that let your AI client (Claude/ChatGPT) reach our server. They are stored in our database, and deleted when you disconnect or when they expire.
• Audit of irreversible actions — If you switch on irreversible actions, every attempt is recorded: the tool name, the outcome, and a short summary of the arguments of up to 200 characters, which can include a chat identifier and the first characters of a message. The full record is visible to you in your account, and is deleted after 90 days.

Website analytics

Our public website (not the MCP connector itself) uses Yandex.Metrika and Google Analytics to understand how visitors use the site. These tools set cookies and may record anonymized usage. They run only after you accept the consent banner — if you decline, no analytics scripts load and no cookies are set.

• What it covers — Only the marketing/documentation website. Your Telegram data and MCP requests are never sent to any analytics service.
• Yandex.Metrika — Includes Webvisor (anonymized session replay of page interactions) and click maps. Form fields are masked by default; our pages contain no input forms with personal data.
• Opt out — Decline the consent banner, clear the mcpt-consent cookie/localStorage to be asked again, or block analytics domains in your browser.

What we never store

• Message content, media files or chat history — they pass through our server in memory and are gone once the answer reaches your AI client
• Contact lists and phone numbers — they are returned to your AI client when you ask for them, and never written to our database
• Passwords or Telegram 2FA codes

If your account uses a Telegram cloud password (2FA), that password is used only to complete the login — it passes through our server in memory for the duration of the sign-in check and is never stored or logged.

How your data flows

When you ask Claude or ChatGPT to read your Telegram messages, the AI client sends a request to our server. Our server fetches data from Telegram's API using your session, returns it to the AI client, and does not retain it. Message content passes through our server but is not stored or logged.

Data retention

• Session tokens — Deleted when you disconnect or after inactivity.
• Usage logs — Tool name, time, AI client and your user ID, kept for rate limiting and usage statistics. Deleted automatically after 90 days.
• OAuth tokens — Deleted when you disconnect; expired tokens are purged automatically.
• Audit of irreversible actions — Kept for 90 days so you can check what was done on your account, then deleted automatically.

Third parties

We do not sell, share, or transfer your Telegram data to third parties. Your Telegram data is only accessed via the official Telegram MTProto API on your behalf. The AI client (Anthropic/OpenAI) receives your Telegram data as part of the conversation — their privacy policies apply to that processing. Website analytics providers (Yandex, Google) receive only anonymized site-usage data, never your Telegram data.

Security

All connections use TLS (HTTPS). Telegram sessions are encrypted. The server runs on dedicated infrastructure with access restricted to the operator. We follow security best practices for session management and credential storage.

Your rights

• Disconnect anytime — Remove the connector in Claude/ChatGPT settings. Your session is deleted immediately.
• Data deletion — Contact us to request full deletion of any stored data.
• Self-host option — Use the open-source version to run everything on your own machine with zero data leaving your device.

Open source

The server is open source under the MIT license at github.com/mcp-telegram/mcp-telegram-cloud. You can inspect exactly what data is accessed and how.

Contact

Questions about this policy? Reach out via GitHub Issues