Privacy Policy

Last updated: September 14, 2026

1. Overview

BotWave is a Telegram group management bot that provides moderation, AI assistance, engagement tools, analytics, and channel management features. This policy explains what data we collect through the bot and how we use it.

By adding BotWave to your Telegram group or by using any of our features, you agree to the practices described in this policy.

2. Data We Collect

Telegram user IDs and usernames - We store Telegram user IDs to identify group members, admins, and owners. Usernames are cached for display purposes in the mini app dashboard.
Group and channel IDs - We store the IDs of groups and channels where the bot is added to associate settings, modules, and configurations.
Group settings and configurations - Module enable/disable states, welcome and farewell messages, captcha settings, filter rules, locked types, warning counts, mute records, karma scores, economy balances, and custom command configurations.
Moderation records - Warnings, mutes, bans, and appeal history tied to user IDs within specific groups.
AI assistant interactions - When a user invokes the AI assistant, the question and generated response are processed in real time. We do not retain full conversation history. Aggregate usage counts may be stored for analytics.
Web search queries - When a user triggers a web search, the query is sent to our SearXNG instance and results are returned. Search queries are not permanently stored.
Analytics data - Message counts, activity timestamps, member join/leave events, and engagement metrics. This is aggregate data used to power the analytics dashboard in the mini app.
Language preferences - Per-group and per-user language settings for multilingual translation features.

3. Data We Do Not Collect

We do not store the full content of your group's messages. The bot processes messages in real time to apply filters, moderation rules, and AI features, but it does not retain message text beyond what is needed for active features like notes, reminders, and scheduled broadcasts. Private messages sent to the bot are processed for the requested command and not stored unless the command explicitly saves data (such as setting a welcome message).

4. How We Use Data

To operate bot features: moderation, captcha, welcome messages, filters, karma, economy, games, and AI assistant
To enforce group rules: warnings, mutes, bans, and auto-actions triggered by custom rules
To provide analytics: group activity stats, message counts, member engagement, and channel metrics
To enable cross-group features: global ban federation, trust scores, and federation-linked moderation
To support multilingual use: translation of messages, commands, and bot responses
To secure the bot: rate limiting, spam detection, anti-raid protection, and captcha verification

5. Data Storage and Encryption

All data is stored in a PostgreSQL database hosted on our own infrastructure. Sensitive data such as userbot session strings and WhatsApp session files are encrypted at rest using Fernet symmetric encryption. All connections use HTTPS with TLS encryption in transit.

The database is not publicly accessible. Access is restricted to the application backend and authorized system administrators.

6. Data Retention

Active group data (settings, configurations, karma, economy): Retained as long as the bot is active in your group. When the bot is removed, settings can be deleted by request.
Moderation records (warnings, mutes, bans): Retained for the lifetime of the group unless an admin explicitly clears them or a user successfully appeals.
Analytics data: Aggregate counts are retained indefinitely. Individual message content is not stored.
AI interactions: Processed in real time and not permanently stored.
Scheduled broadcasts: Stored until sent, then the message content is delivered and the scheduling record is deleted.

7. Data Sharing

BotWave does not sell, rent, or trade your data with third parties. Data is not shared with external services except:

AI providers (Groq, Gemini, Pollinations.ai) - When a user invokes an AI feature, the question text is sent to the AI provider for processing. The provider receives only the query, not your group data.
SearXNG - Web search queries are sent to our self-hosted SearXNG instance, which fetches results from search engines. No user identity is sent.
Telegram API - The bot communicates with the Telegram Bot API to send messages, manage groups, and deliver features. This is core functionality.

We do not share data with advertising networks, data brokers, or analytics platforms.

8. Your Rights

Access: Group owners can view all settings and data associated with their group through the mini app dashboard.
Deletion: Group owners can request deletion of their group's data by removing the bot and contacting us. Individual users can request deletion of their personal data (karma, warnings, economy balance) by contacting us through the support chat.
Portability: Group owners can export their group settings and configurations using the import/export feature in the mini app.
Opt-out: Users can opt out of karma, economy, and engagement features by using the relevant commands in their group.

9. WhatsApp Bot Companion

If you connect the WhatsApp companion bot, your WhatsApp session data is encrypted at rest and stored only on our server. Session data is never shared, exposed in client-side code, or committed to version control. You can disconnect at any time, which removes the session data.

10. BotWave Labs

If you also use BotWave Labs (labs.botwave.online), that service has its own separate privacy policy at labs.botwave.online/privacy. The Labs service collects different data (email, name, monitored URLs, screenshot API usage) and has its own data handling practices.

11. Children's Privacy

BotWave is not directed at children under 13. Telegram requires users to be at least 13 years old. We do not knowingly collect data from children. If you believe a child under 13 has provided data through the bot, contact us and we will delete it.

12. International Users

BotWave is used by groups worldwide. Your data is stored on our server in the European Union. If you are located outside the EU, your data is transferred to and processed in the EU. We comply with GDPR standards for data protection.

13. Security Measures

All database connections are internal and not publicly exposed
Row-level security policies on all database tables
Encryption at rest for session strings and sensitive credentials
HTTPS enforced on all web endpoints with HSTS headers
Rate limiting on authentication and API endpoints
Server-side validation of Telegram WebApp initData on mini app requests
No secrets, tokens, or API keys in client-side code
Regular dependency scanning and security audits

14. Changes to This Policy

We may update this privacy policy as we add new features or change how data is processed. We will update the "Last updated" date at the top of this page whenever we make changes. Significant changes will be announced in our support chat.

15. Contact

For privacy questions or data requests, contact us through our support chat on Telegram.