Privacy Policy
Last updated: 18 September 2026
This policy covers the My Albums website and the photo cloud in @MyAlbumsBot. The data controller is Sole proprietor “Aziya+” (IE Aziya+), IIN 850806350014, 11 Kabanbay Batyr St, office 145, Astana, Kazakhstan. For any question about your data, message @Azike on Telegram or email [email protected]. Telegram is a separate platform with its own rules.
1. What we store
Our storage holds encrypted files and encrypted information about them. In readable form the application server knows only the following.
| Data | Why |
|---|---|
| Telegram ID and username | To link the storage to your account. |
| Number and sizes of files | To count used space and plan limits. |
| Upload date | To process and account for uploads. |
| File type: photo or video | To account for files within the plan. |
| Plan, subscription end date, Stars payment records (amount, date, Telegram payment id) | To renew the subscription, avoid counting a payment twice, cancel the previous subscription when you switch plans, and handle disputes. |
The upload date is not the capture date. The server never receives the content of photos and videos, captions, names of tagged people, capture dates or face prints in readable form. Search queries are not sent to the server: search runs on your device. The name of the place where a photo was taken is determined on your device from a built-in list of cities (data by GeoNames, CC BY 4.0); coordinates are not sent anywhere.
2. Encryption and your key
The client runs in the browser inside Telegram and encrypts data on your device with AES-256-GCM before transfer. The key is created on your device and stored in your Telegram account; it never reaches the My Albums server. We do not hold a key that could open your photos.
“Who is in this photo” suggestions start after a week of use. Faces are recognised on your device; the face print (a set of 128 numbers) is stored inside the encrypted photo information and never reaches the server in readable form. The app only suggests a tag — you decide.
On first launch you are shown a 52-character recovery code. Keep it separately and never send it to support. A secret album is protected by its own password. If both the key and the recovery code are lost, we cannot restore access to the encrypted files. A forgotten secret-album password cannot be recovered either.
Encryption does not protect against access to an unlocked phone or Telegram account, an infected device or tampered client code. Protect your device, check the bot address and enable two-step verification in Telegram.
3. Website, Telegram and Cloudflare
This website has no advertising pixels, external fonts, third-party analytics or data-collection forms. The site code sets no cookies and writes nothing to localStorage. Opening Telegram is a separate action by you.
The site is delivered through Cloudflare, which processes technical connection details (IP address, HTTP headers) to serve pages and protect the network; its infrastructure may set service cookies, e.g. during a security check. See the Cloudflare privacy policy.
Telegram processes your account details and your interaction with the bot under its own privacy policy. Because the key is stored in your Telegram account, the security of that account matters for access to your photos. We do not promise anonymity towards Telegram or network providers.
4. Support and payments
If you write to support, we receive what you send in that conversation: the text of your request and any payment details needed to help. They are used to answer, verify a payment and resolve disputes. This is a separate Telegram conversation, not the content of your encrypted albums.
Payments are made inside Telegram with Telegram Stars: from Telegram we receive only the payment record (plan, amount in Stars, date, payment id). Card details are never passed to us. Do not send card numbers, CVV codes, one-time bank codes, your key or your recovery code.
5. Purposes and recipients
Data is used to provide storage, count used space, support you and handle your requests. We do not use album content for advertising or model training and do not sell it: we have no access to the decrypted content.
Encrypted files are stored in Cloudflare R2 in the European region. Telegram operates your account and the bot; Cloudflare delivers this site. A lawful request from an authority can only concern data we actually hold; it cannot give us a key we do not have.
The application server and storage may move between providers; they still receive only encrypted files. Current infrastructure details are available from @Azike.
6. Retention and deletion
Encrypted files are kept until you delete them yourself. Files are never deleted for non-payment; storage ends only if the service closes entirely, and we will warn you in advance and give you time to download. Individual files are deleted in the app. To delete everything, open the Albums tab and tap “Delete all my data” (with confirmation), or write to @Azike from the same Telegram account — we verify account ownership so that nobody else can delete your data.
Deleting the chat with the bot does not delete your storage. Download what you need first: after final deletion nothing can be recovered. Immediate physical deletion of every technical copy is not promised; backups are overwritten within 31 days.
Records of disputed payments or support requests may be kept as long as needed to resolve the matter or to meet a legal obligation. They never include your key or decrypted photos.
7. Your rights, age and changes
You may request information about the processing of your data, correction of your username, deletion of your data or termination of the service. Write to @Azike; do not send documents or secrets until verification is agreed. If you are in the European Economic Area or the United Kingdom, you have the rights set out in the GDPR / UK GDPR, including access, rectification, erasure, restriction, portability (your files can be downloaded in the app) and the right to complain to your local supervisory authority. Your legal rights apply regardless of the wording on this page.
The service is intended for people aged 16 and over. We do not knowingly process data of younger children; if this has happened, write to @Azike and the data will be deleted.
The current version is published here with its date. Material changes to purposes or access terms will be announced before they apply; where separate consent is required, continued use of the site does not replace it.