Back

Privacy Policy

Last updated October 12, 2026

TG Backup saves a copy of your Telegram contacts, handles and chat list so you can restore them into a new account if yours is ever taken. This page says exactly what we collect, why, who handles it, and how to delete it.

What we save

  • Your own profile: your name, username and bio, kept with your backup and deleted with it.
  • Contacts: name, username and bio, and when you last contacted each person (the date of the latest message only). We do not save phone numbers: contacts come back by username, so people with no username can't be restored.
  • Handles: the username and name of people you chat with who are not saved contacts.
  • Chats: the name, type and public username of the groups and channels you are in.
  • Folders: your folder names and which chats are in them.
  • Telegram bot (optional): if you connect our bot, pressing Start means you agree to its messages: reminders about your own backup (before an unsaved backup is deleted, when it is time to refresh, when a restore finishes), your referral link and when a friend joins with it, a request for feedback, and occasional TG Backup news. We keep the id of your chat with the bot, and anything you write to it. What you write is read by the TG Backup team. Send /quiet to stop the news, /stop to end all messages, or turn it off on the site. All of it is deleted with your account. These messages never contain sign-in codes or secret links.
  • Account details: your email address, your Telegram account's name and username, and payment status.

What we never copy

We never read or store your messages, photos, videos or files. From each chat we use only the date of the most recent message, to show when you last spoke to someone. We also keep how each chat is set up in your chat list (pinned, archived or muted), how many members a group or channel has, and whether you created or administer it, so a restore can put things back in a sensible order. For private groups and channels you administer, we also save the invite link that already exists (we never create one), so a restore can rejoin them. Anyone holding an invite link can join, so it is stored like the rest of your backup and deleted with it. For private groups we can't rejoin by link, we also save the names and usernames of the group's admins, exactly as Telegram shows them to any member, so we can tell you who to ask to add you back. We keep your own notes on each group (asked, back in, skipped). All of it is deleted with your backup or your account.

How we connect to Telegram

You link TG Backup the same way you link Telegram Desktop: by scanning a code on a computer, or, on a phone, by entering your phone number and the login code Telegram sends to your Telegram app. We use the number once, to ask Telegram for that code, and never save it. We use the connection only while a backup or restore is running. When it finishes we sign out of your Telegram account ourselves, confirm the sign-out worked, and delete the saved login. You can check at any time in Telegram under Settings, Devices. If you have two-step verification, the password you type goes straight to Telegram, is used once, and is never stored.

Restoring

When you restore, you connect your new Telegram account the same way. We add your saved contacts, rejoin public chats and recreate your folders in that account, then sign out of it. Unless you untick it on the confirm screen (it is on by default), we also save a short draft message in your chats with people you have spoken to. A draft is never sent: it waits in your own message box and only you can send it. We email you when a restore starts and finishes. A restore that starts from a device we have not seen before waits for a short period, and the email we send has a link to cancel it.

How long we keep it

  • If you have not paid, we keep your backup for 7 days and then delete it.
  • If you have paid, we keep it until you delete it. You can refresh it at any time with a new scan.
  • "Delete everything" in your vault removes your backup, your account and everything linked to it straight away. We keep only the payment record, unlinked from you, because our payment processor and the law require it.

Where it is stored and who handles it

Your backup is stored in a protected database that only our servers can read. The database is encrypted at rest. Your backup is not encrypted with a key that only you hold, because our servers need to read it to show you your people and to restore it for you. Telegram login sessions are encrypted with our own key and deleted when a job ends. If you want a copy you control, you can download your backup as a file that your browser locks with a password you choose. We never see that password and can't recover it, and we email you a code before the download. The format is open and described at /export-format. We use these services to run TG Backup:

  • Supabase: database and sign-in.
  • Railway: the server that talks to Telegram.
  • Vercel: the website.
  • Stripe: payments. We never see your card number.
  • Resend: sending our emails. If you leave your email in the box on our homepage, we email you a confirmation first, and only a click on that link adds you to our email list. Once you confirm your email address, it is also kept in our email list there (the address only, never your Telegram data) so we can send occasional emails about TG Backup. Every such email has an unsubscribe link, and deleting your account removes the address.

We do not sell your data and we do not use it for advertising or advertising trackers. For page counts we use Vercel Web Analytics (Vercel already hosts the website): it sets no cookies and records which page was visited, the country and device type, and where the visitor came from, without names, emails or Telegram data. Pages that carry a private link are never counted.

Cookies and similar storage

We use a sign-in cookie, a random device cookie (used only to tell whether a restore comes from the same browser that made the backup), and your browser's local storage for your light or dark choice and a friend's referral code. We count steps on our own site (for example "backup finished") to find and fix problems. These counts contain no names, phone numbers or message content.

Advertising measurement. To learn which ChatGPT ads bring customers, we report two things to OpenAI: when a payment is made (its amount, currency and an order number) and when a backup finishes, together with OpenAI's own ad-click identifier if you arrived from one of its ads. This happens only for visitors outside the EU, the EEA, the UK and Switzerland who have not sent a Global Privacy Control or Do Not Track signal. Our server never gives OpenAI your email, phone number or Telegram data. We also run OpenAI's measurement pixel in your browser, which counts page visits and presses of the "Back up my Telegram" button. If you type your email into the "lock in the price" box on the home page, the pixel may send OpenAI a scrambled (hashed) copy of that address, which OpenAI can use to match you to an ad. That is the only field it may read: the pixel switches itself off as soon as you click into any other field (such as your phone number, a login code or a password), and it never runs on sign-in, admin or unsubscribe pages.

Your choices

You can delete everything yourself at any time from your vault. You can ask us what we hold about you, or ask for a correction, by emailing sean@tgbackup.xyz. TG Backup is not for children under 16.

Contact

Questions about this policy: sean@tgbackup.xyz. TG Backup is not affiliated with or endorsed by Telegram.

Privacy · Terms