Privacy Policy

1. What we store

Our storage holds encrypted files and encrypted information about them. In readable form the application server knows only the following.

The upload date is not the capture date. The server never receives the content of photos and videos, captions, names of tagged people, capture dates or face prints in readable form (except files you export to your own chat, section 2). Search queries are not sent to the server: search runs on your device. The name of the place where a photo was taken is determined on your device from a built-in list of cities (data by GeoNames, CC BY 4.0); the coordinates from the file are kept only inside the encrypted photo information and never reach the server in readable form.

Anonymous technical measurements. The app sends measurements of how it performs: load time, network type, device type, approximate number of photos and device memory, interface language and the number of page errors; for videos — how the video was played, how long the first frame took, pauses while watching, file size, codec and phone OS version. They are recorded without any link to your account — no Telegram ID, name, IP address or exact time (date only), kept for up to 90 days and used only to make the app faster.

2. Encryption and your key

The client runs in the browser inside Telegram and encrypts data on your device with AES-256-GCM before transfer. The key is created on your device and stored in your Telegram account; it never reaches the My Albums server. We do not hold a key that could open your photos.

“Who is in this photo” suggestions work from day one. Faces are recognised on your device; the face print (a set of 128 numbers) is stored inside the encrypted photo information and never reaches the server in readable form. The app only suggests a tag — you decide. To find similar photos your device computes an “image fingerprint” (64 bits from a small copy); it is also stored only inside the encrypted information.

On first launch you are shown a 52-character recovery code. Keep it separately and never send it to support. A secret album is protected by its own password. If both the key and the recovery code are lost, we cannot restore access to the encrypted files. A forgotten secret-album password cannot be recovered either.

Encryption does not protect against access to an unlocked phone or Telegram account, an infected device or tampered client code. Protect your device, check the bot address and enable two-step verification in Telegram.

Shared albums. A shared album is encrypted with its own key, not your main one: sharing it does not open the rest of your archive. To let members and guests in, the server knows which files belong to a shared album, who was invited and with which role, who opened the album link (Telegram ID and name, time), who uploaded which file and who reacted to which file (the emoji itself is encrypted), and, if a member saved the album’s photos to their own library (“Save members' photos to my library”), which album files they copied. The album name, captions, dates, people tags and the photos themselves stay encrypted. The album key is stored on the server only in locked form: for each member — with their personal key, for link guests — with the code from the invitation, which is never sent to the server. A member needs a key pair: the public half is stored on the server, the private half only in encrypted form. A file takes up the storage of whoever uploaded it. Access can be closed at any time; whatever a member or guest has already downloaded stays with them.

Downloads and exports. When you download or export files, they are decrypted and from then on are kept unencrypted — on your device or wherever you saved them. On Android a file is exported through your chat with the bot: the decrypted file passes through the server to Telegram, and the server does not store it.

3. Website, Telegram and Cloudflare

This website has no advertising pixels, external fonts, third-party analytics or data-collection forms. The site code sets no cookies and writes nothing to localStorage. Opening Telegram is a separate action by you. On the app page itself Cloudflare may add its Web Analytics counter: it collects anonymous page-load performance data and cannot see your photos or their descriptions.

The site is delivered through Cloudflare, which processes technical connection details (IP address, HTTP headers) to serve pages and protect the network; its infrastructure may set service cookies, e.g. during a security check. See the Cloudflare privacy policy.

Telegram processes your account details and your interaction with the bot under its own privacy policy. Because the key is stored in your Telegram account, the security of that account matters for access to your photos. We do not promise anonymity towards Telegram or network providers.

4. Support and payments

If you write to support, we receive what you send in that conversation: the text of your request and any payment details needed to help. They are used to answer, verify a payment and resolve disputes. This is a separate Telegram conversation, not the content of your encrypted albums.

Payments are made inside Telegram with Telegram Stars: from Telegram we receive only the payment record (plan, amount in Stars, date, payment id). Card details are never passed to us. Do not send card numbers, CVV codes, one-time bank codes, your key or your recovery code.

4.1. The assistant (AI)

The bot and the app include an assistant (Kadrik in Russian, Snappy in English) that answers questions about using My Albums. Answers are written by Claude, an artificial intelligence model from Anthropic, PBC (USA). To answer, we send Anthropic the text of your message to the assistant (in the bot — any message that does not start with “/”, including a photo search query), a few recent turns of that conversation and service details: how many files you have, how much space is used, whether your plan is free or paid, and the type of phone. Photos and videos, captions, names of tagged people, album names and keys are never sent to the assistant — our server does not have them. A message that looks like a recovery code is not sent at all: the bot deletes it, and the app does not send it from the phone.

We keep the assistant’s questions and answers for 90 days without your Telegram ID or name, to understand what is unclear in the app and improve the help. Separately, only a daily question counter is kept for 7 days (up to 20 questions a day per person). The conversation is remembered for 30 minutes in server memory and is never written to disk. Anthropic processes this data on our behalf to produce the answer; under Anthropic’s commercial API terms such data is not used to train models. If you prefer not to use the assistant, simply don’t write to it: search inside the app runs on your phone, and its queries go nowhere.

5. Purposes and recipients

Data is used to provide storage, count used space, support you and handle your requests. We do not use album content for advertising or model training and do not sell it: we have no access to the decrypted content.

Where the data is. The application server and the account database (Telegram ID, name, file sizes, plan and payments) are hosted with Vultr (The Constant Company, LLC) in a data centre in Warsaw, Poland (European Union). Encrypted files and daily database backups are stored in Cloudflare R2 in the European region. One more daily copy of the account database is kept on the service owner's equipment in Astana, Kazakhstan; it contains no photos and no keys. Both are cross-border transfers you agree to by using the service; neither Vultr nor Cloudflare has a key to your files. Telegram operates your account and the bot; Cloudflare delivers the website and the app. A lawful request from an authority can only concern data we actually hold; it cannot give us a key we do not have.

Legal bases. The data in the table above is processed to perform our contract with you (providing storage and your plan), to meet legal obligations (payment records) and in our legitimate interest in protecting the service from abuse. For users in Kazakhstan processing follows the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”; for users in the EEA and the UK — the GDPR / UK GDPR.

The application server and storage may move between providers; they still store only encrypted files. Current infrastructure details are available from @MyAlbums_support.

6. Retention and deletion

Encrypted files are kept until you delete them yourself, with one exception. If your paid plan has ended and you use more than the free plan, files beyond it are kept for as many days as you paid in total (at least 30 and at most 365); then your most recent uploads among them move to the trash and are deleted permanently after 30 days. The bot warns you in advance (see the terms, section 2). Files that fit the free plan are never deleted for non-payment. Storage also ends if the service closes entirely, and we will warn you in advance and give you time to download. Individual files are deleted in the app. To delete everything, open the Albums tab → “More” → “⚙️ Settings” → “Delete all my data” (with confirmation), or write to @MyAlbums_support from the same Telegram account — we verify account ownership so that nobody else can delete your data.

What is deleted and what remains. When you delete your account, we erase all photos and videos, albums and file details, the keys stored with us (in encrypted form), sign-in sessions and logs of visits and in-app steps. Only a minimal record remains: your Telegram ID, the date of your first sign-in, the date your paid period ran until, and your plan, plus, for invite-bonus accounting, which Telegram ID brought a bonus to whom. It is kept solely so that deleting an account cannot be used to get an invite bonus again; it contains no name, no files and no photo details. Payment records are kept separately, to the extent required for accounting.

Deleting the chat with the bot does not delete your storage. Download what you need first: after final deletion nothing can be recovered. Immediate physical deletion of every technical copy is not promised; backups are overwritten within 31 days.

Records of disputed payments or support requests may be kept as long as needed to resolve the matter or to meet a legal obligation. They never include your key or decrypted photos.

7. Your rights, age and changes

You may request information about the processing of your data, correction of your username, deletion of your data or termination of the service. Write to @MyAlbums_support; do not send documents or secrets until verification is agreed. If you are in the European Economic Area or the United Kingdom, you have the rights set out in the GDPR / UK GDPR, including access, rectification, erasure, restriction, portability (your files can be downloaded in the app) and the right to complain to your local supervisory authority. Your legal rights apply regardless of the wording on this page.

The service is intended for people aged 16 and over. We do not knowingly process data of younger children; if this has happened, write to @MyAlbums_support and the data will be deleted.

The current version is published here with its date. Material changes to purposes or access terms will be announced before they apply; where separate consent is required, continued use of the site does not replace it.