Telegram Privacy Policy

This document is Telegram's Privacy Policy governing data collection, storage, and processing for its cloud-based messaging services, with Telegram Messenger Inc. as data controller; the legal basis asserted is legitimate interests under GDPR Article 6(1)(f), namely service provision and fraud/security protection. The policy states that cloud chat messages, photos, videos, and documents are stored server-side in encrypted form, while secret chats use end-to-end encryption with no server-side storage; the terms authorize sharing of IP address and phone number with law enforcement upon receipt of a valid judicial order, and permit sharing of message text with Google or Microsoft for translation and audio data with Google for voice-to-text transcription. Notably, the policy explicitly states no ad targeting based on user data and no use of cookies for profiling, which distinguishes it from common industry practice among large messaging platforms; however, cloud chat content remains accessible to Telegram in encrypted-but-decryptable form, and third-party bots receive user data including messages and account details with limited Telegram oversight over downstream use. The policy engages GDPR directly, designating EDPO as its Article 27 EEA representative and referencing standard contractual clauses for intra-group transfers to BVI and Dubai entities; UK GDPR, the EU Digital Services Act moderation obligations, and applicable data protection frameworks in jurisdictions where Telegram operates also create material compliance considerations, particularly regarding the adequacy of legitimate interests as a sole legal basis for broad metadata collection and cross-border data transfers.