Privacy

What we collect

We collect what we need to run the service: an email address, a display name, the messages and media you choose to upload to your bio page, and basic device/usage telemetry (page views, click counts on your bio links).

What we do with it

We use it to authenticate you, render your inbox and bio page, deliver email notifications, and produce aggregate analytics you see on /account/analytics. We do not sell personal data to third parties.

Telegram data (optional)

If you sign in with Telegram or pay with Telegram Stars, we store:

• Your Telegram ID (a numeric identifier — not your phone number)
• Your Telegram username (if set)
• Whether your account has blocked our bot (so we can avoid sending invoices that will fail)
• Records of webhook events from Telegram (for idempotency and audit)

Telegram itself processes this data per their own privacy policy (telegram.org/privacy). When you delete your DIRTY account, we remove our copy of these identifiers; Telegram retains its records independently — we cannot delete data held by Telegram on your behalf.

Payments via Telegram Stars

Telegram processes Stars transactions. DIRTY receives a notification (webhook) when a payment succeeds, fails, or is refunded — we store the transaction ID and the resulting subscription state. We do NOT receive your Telegram wallet balance, payment-card details, or any other financial data. Refund requests for Stars payments go through Telegram Support (typically a 21-day window per Telegram policy).

Creator-owned bots

DIRTY Pro+ users can register their own Telegram bot through their DIRTY account. The bot is created and owned by the creator via @BotFather. DIRTY is the configuration provider — we manage webhooks, store the bot token encrypted at rest, and run feature handlers (AI-Replies, Tips, PPV, Broadcasts) on the creator's behalf.

Data we store for each creator-bot:

• Bot token (AES-256-GCM encrypted)
• Bot username, Telegram bot ID, feature toggles
• Subscriber list (fans who started the bot) — for broadcast targeting
• Tip ledger + PPV purchase ledger — for the creator's analytics dashboard
• Webhook event audit log (for idempotency + debugging)

The creator is the data controller for content on their bot (subscriber DMs, broadcast bodies, PPV media). DIRTY is the data processor on their behalf — see our DPA on request.

Stars payments inside creator-bots

When a fan tips a creator or buys PPV content via the creator's bot, Stars go directly to the creator's Telegram wallet. DIRTY does not receive or hold the Stars — we only record the transaction ID for the creator's dashboard. DIRTY's revenue from this feature is the SaaS subscription (Pro/Plus/Studio) the creator pays us — never a commission on bot transactions.

Your rights (GDPR)

You can request access, correction, export or deletion of your personal data at any time. Email privacy@dirty.app and we will respond within 30 days. Deleting your account triggers automatic deletion of all personal records on our side; backups age out within 35 days.