Telegram Privacy Policy

This document is Telegram Messenger Inc.'s Privacy Policy governing the collection, storage, processing, and disclosure of personal data in connection with its cloud-based messaging services, with legitimate interests cited as the primary legal basis for processing under GDPR Article 6. The policy states that Telegram collects mobile phone numbers, profile names and pictures, email addresses (for 2FA recovery or login authentication), IP addresses, device metadata, username change history, and contact names and numbers; it explicitly states that user data is not used for ad targeting or profiling, and that sponsored messages are based solely on public channel topics rather than user data. Notably, the policy asserts that cloud chat messages, photos, videos, and documents are stored server-side in encrypted form with encryption keys held by Telegram across multiple jurisdictions, while secret chats use end-to-end encryption with no server-side storage, creating a meaningful operational distinction between chat types that affects the scope of any compelled disclosure. The policy engages GDPR through its designation of EDPO as EEA Article 27 representative, its reliance on Standard Contractual Clauses for intra-group transfers to entities in the British Virgin Islands and Dubai, and its disclosure that law enforcement data requests are limited to IP address and phone number upon receipt of a valid judicial order, with disclosures reported quarterly; applicable law in EEA jurisdictions may impose additional constraints on the legitimate interests basis and the adequacy of transfer mechanisms used. The policy also discloses data sharing with Google LLC and Microsoft Corporation for translation services, and with Google LLC for voice-to-text transcription at user request, both described as restricted-purpose processing under agreements with Telegram.