Privacy Policy
In short
- We use your Telegram ID, username, first name and language to run your account. We never ask for your phone, email or wallet keys.
- Deposits are public TON blockchain transactions; we record them to credit your balance.
- Providers that fulfil orders receive only the link and the quantity, not who you are.
- Questions you type to the AI assistant are sent to Google to write the answer and are kept for 90 days to improve the catalogue. Do not put personal data in them.
- We do not sell your data and do not use it for advertising. There are no third-party trackers.
- You can ask us what we hold, to correct it or to delete it, except financial records we must keep.
This policy explains what personal data the GRAM Hub Telegram Mini App and its bot (the "Service") collect, why, who receives it and what choices you have. It applies together with our Terms of Service. "We" means the operator of the bot.
1. Data we collect
| Data | Source | Why |
|---|---|---|
| Telegram user ID, username, first name, language code | Telegram, when you open the Mini App (verified cryptographically) | To create and secure your account, show your name and write to you in your language |
| Wallet address you pay from, deposit amounts, transaction hashes | The TON blockchain, when you make a deposit | To confirm and credit deposits, prevent double crediting and keep financial records |
| Balance and transaction history (deposits, purchases, refunds) | Generated by the Service | To operate your prepaid balance and show your history |
| Orders: the link you provide, quantity, price, status | You | To fulfil the order, show its progress and handle refunds and support |
| Referral data: who invited you, whom you invited, your earnings | Generated by the Service when an invite link is used | To run the referral programme and pay rewards |
| Support requests and your messages in them | You | To answer you and resolve problems |
| Questions you type to the AI assistant and the services it recommended, with your Telegram ID (or, if you are not signed in, a one-way hash of your IP address that cannot be turned back into the address) | You, when you use the assistant | To answer you, limit abuse of the assistant and see what customers look for, so the catalogue can grow |
| Usage events: app opened, screens and catalogue sections viewed, steps of an order | The app, only while you are signed in | To understand which parts of the app work and improve them (first-party only) |
| Technical data: IP address, device and request logs | Our hosting and infrastructure providers | To run, secure and troubleshoot the Service and detect abuse |
We do not ask for your phone number, email, real name, passwords, or your wallet's private keys or seed phrase. We never receive them: wallet connection uses the TON Connect standard and you approve each payment in your own wallet.
2. What we do with it
- Provide the Service: sign you in, process deposits, place and track orders, issue refunds, run the referral programme.
- Send you service messages in the bot: deposit received, order completed, cancelled or partially completed. These are transactional, not marketing.
- Prevent fraud and abuse, enforce our Terms (including suspending accounts) and comply with legal obligations.
- Support: investigate payment or order problems you report.
- Improve the app using aggregated usage events.
We do not sell your personal data and we do not use it for advertising or profiling.
3. Who receives data
- Promotion providers that fulfil your orders receive only the link you want promoted and the quantity. They do not receive your Telegram identity from us. Links you provide are by nature public content or profiles.
- Telegram delivers the Mini App and bot messages under its own privacy policy.
- Infrastructure providers that host the app and database (Supabase and Vercel) process data on our behalf.
- Google (Gemini API) receives the text of your questions to the AI assistant, together with the catalogue entries relevant to them, to write the answer.
- The TON network and a blockchain data API: deposits are public blockchain transactions; we query a public API to confirm them. Blockchain data is public and permanent by design.
- An exchange-rate service: we fetch a public TON/USD price; no personal data is sent.
- Authorities or advisers, where required by law or to protect our rights.
4. What is stored on your device
The app does not use advertising or tracking cookies. It keeps a few settings in your device's local storage: your chosen language and theme, and a marker that an invite link was already applied. You can clear them by clearing the app's data in Telegram.
5. How long we keep it
Account data is kept while your account exists. Financial records (balances, deposits, orders, refunds, referral earnings) are kept as long as needed for accounting, dispute handling and legal obligations, even after you stop using the Service, because the ledger must stay complete and unaltered. Usage events and technical logs are kept for a limited period. Questions to the AI assistant are deleted after 90 days.
6. Security
Access to data is restricted by role-based database rules; money movements are recorded in an append-only ledger; secrets are stored only on our servers; traffic is encrypted in transit. No system is perfectly secure, and we cannot guarantee absolute security.
7. Your choices and rights
- Ask us what data we hold about you, to correct it, or to delete it. We act on requests where the law allows. Some records (for example financial transactions) must be retained and cannot be deleted.
- Stop receiving bot messages at any time by stopping or blocking the bot. You will then not be told about deposits and orders.
- Disconnect your wallet at any time from the Wallet screen.
- Depending on where you live (for example the EU, the UK or Ukraine), you may also have the right to object to or restrict processing, to data portability, and to complain to your data protection authority.
8. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from them. If you believe a minor has used the Service, contact us and we will remove the account where possible.
9. International transfers
Our infrastructure providers may process data in countries other than your own. We choose providers that apply appropriate safeguards.
10. Changes
We may update this policy; the date at the top shows the current version. If a change is significant we will tell you in the bot.
11. Contact
For privacy questions or requests, write to the bot @GHTE_PR_BOT or open a request in the app's Support section.