How to add a privacy policy to a Telegram bot

Who this is for

• Developers publishing a bot or mini app on Telegram
• Bots that collect anything beyond the message they reply to (profiles, payments, locations, files)
• Teams asked by users or Telegram where the bot's privacy policy is

Not for

• Telegram channels and groups without a bot
• Legal advice on which data protection law applies to your bot

What the platform requires

• Bot Developer Terms, section 4: all third-party bots and mini apps must be bound by a privacy policy that is easily accessible to their users, detailing what data they store, how they collect it and for what purpose.
• Telegram's Standard Bot Privacy Policy applies by default to every bot and mini app that does not provide a policy of its own; if your data practices are not covered by it, or your service conflicts with it, you must provide a separate privacy policy that is easily accessible to your users, and it then takes precedence.
• The terms say bots must set up a privacy policy in @BotFather, furnishing all relevant privacy information and policies; your policy cannot conflict with, amend or show discrepancies with the terms.
• The Standard Policy expects developers to provide an easily accessible avenue for users to consult the policy, to identify themselves in the service's terms, interfaces or the reply to /developer_info, and to answer lawful data requests within the legal timeframe and no later than 30 days.
• Bots that mishandle user data or otherwise violate their own privacy policy will be terminated from the Bot Platform.

Step-by-step: paste your privacy policy URL

1. Decide whether the Standard Policy covers you. Read Telegram's Standard Bot Privacy Policy. If your bot stores more than it describes (accounts, payments, files, locations, analytics) or uses data differently, you need your own policy. Most bots that persist anything do.
2. Write the policy. Say what the bot stores (user IDs, chat IDs, messages it keeps, payment references), how it collects that, for what purpose, how long you keep it, who else receives it, and how a user asks for deletion. Name the developer.
3. Host it at a stable URL. Put it on a public HTTPS page that loads without a login, your own site or a hosted policy. Telegram's terms care that users can reach it easily; the URL must not change.
4. Set it in @BotFather. Open @BotFather, select your bot, and set the privacy policy as the terms require, furnishing the policy information Telegram asks for. Also reply to /developer_info with who operates the bot.
5. Link it inside the bot and keep it true. Add the link to your /start, /help or settings reply. When you add a feature that stores new data, update the policy first; Telegram terminates bots that break their own policy.

Field labels to look for

@BotFather

Where Telegram's terms say the bot's privacy policy is set up.

/developer_info

The reply where a bot identifies its developer under the Standard Policy.

Standard Bot Privacy Policy

Telegram's default policy for bots that publish none of their own.

Common reasons the form fails

• Relying on the Standard Policy while storing data it does not describe
• A policy link that only lives in a channel post, not in the bot
• Changing the policy URL after users and @BotFather point at it
• No way for users to request deletion, which the Standard Policy expects

What Telegram gives you and what it does not

Telegram's terms set the obligation and the default; they do not give you the policy text. Telegram also says your policy may not conflict with or amend its terms, which take precedence.

FAQ

Related

• Telegram bot privacy policy URL (lander)
• Discord app privacy policy URL how-to
• Slack app privacy policy URL how-to