The short version
KeeperBots reads the messages in the group chats you connect it to, so it can write summaries of them. Those messages are stored for 90 days by default and then deleted automatically.
Anyone in your group can send /optout in the chat. From that moment they are never named in anything the bot writes and their messages are never sent to the model. /optin reverses it.
We do not sell your data, and we do not use your messages to train any model.
What we collect
Group messages. The text of messages in chats your bot is a member of, along with the sender's display name, username and numeric user ID, the timestamp, the topic, and what a message was replying to. Stickers are recorded as a reference and an emoji, not as images.
Your account. Your email address and a hashed password. Passwords are stored using scrypt and cannot be read back by us.
How you found us. We count visits to our public pages per day and per source, with no IP address, device details or visitor ID attached. If you arrive from a link carrying a ref tag, or from another website, we remember that source in a cookie for 30 days, and if you create an account we record it on the account. We use it only to learn which of our links and listings work.
Google Analytics. Our website uses Google Analytics to measure how many people visit and what they look at. Google sets its own cookies for this and receives your IP address, device and browser details and the pages you view, under Google's privacy policy. Signed-in pages use it too, but report only the kind of page — “a bot's members page” — never the bot's name, your group's name, search terms or anything you type, so nothing about your account's contents or your groups is sent to Google. You can block it with any browser privacy setting or extension without losing anything on our site.
Google Ads. The same Google tag also reports to Google Ads, so we can tell which of our ads lead to sign-ups and purchases. Google may set its own advertising cookies for this, under Google's privacy policy; on signed-in pages it receives the same scrubbed page type as Google Analytics, never your bot's name or anything about your groups. You can block it the same way, and you can manage ad personalisation in your Google account's ad settings.
Ad clicks. If you arrive by clicking one of our ads, the ad platform adds a click identifier to the link (for example Google's gclid). We keep it in a cookie for 90 days and, if you sign up, on your account, together with which steps you reached — signing up, connecting a bot, subscribing — and when. We may send that identifier and those steps back to the platform that showed you the ad, so it can measure the ad. We never send your email address, your messages or anything from your group.
Your bot's credentials. The bot token you provide for each platform, which is required to operate the bot on your behalf.
Join requests, if the group owner switches verification on. When someone asks to join a group that uses it, we record their user ID, username and display name, when they asked, and whether they completed the check. If they reply to the bot we also record that they did — because on Telegram a bot may only message someone who has messaged it first, and the group owner may later use that to contact members (for example to share a new invite link if the group is lost). Anyone can stop this at any time by blocking the bot, and blocking it takes effect immediately and permanently. Verification is off unless a group owner turns it on, and no such record is kept for groups that do not use it.
Members who message the bot. When a member of a connected group messages the bot privately — to catch up, set an alert, or by tapping a link the group owner shared — we record their user ID, username, display name and when they first did, for the same reason: it is what allows the bot to message them later. The group owner can see this list of names in their dashboard. What anyone watches with an alert is never shown to them.
The shared KeeperBots bot. A group owner can use our own bot instead of making one. It is in every group that chose it, but each group's messages are kept only for that group, exactly as with a bot of their own; anything it sees in a group that isn't connected to an account is discarded unread. So that a private message reaches the right group's bot, we keep each member's user ID with the group they last spoke in, asked to join, or came from by link — nothing else, and never their messages.
Bans and pinned messages. So a group can be rebuilt if it is lost, the bot records who the group's admins banned (when the bot is itself an admin, the only time Telegram tells it) and the text of pinned messages. The group owner can use them to re-ban the same people and re-pin the same messages in a new group, and can download the group's text history in a format Telegram can import. Members who opted out are left out of that download.
Answers to join questions. A group owner can ask people who want to join a few questions, such as an email address. The answers are recorded, shown to the group's owner in their dashboard and available to them as a download, and the person is told this before they answer. They are kept until the owner deletes them or removes the bot. If the owner turns them on, the bot sends one reminder to someone who stopped answering, and declines a join request that goes unanswered for the time the owner chose; the person is told the deadline in the first message and can always ask to join again.
Photos, if the group owner turns on photo protection. For 48 hours the bot keeps Telegram's reference to each photo posted in the group (not the image itself), its caption and who posted it — the only window in which Telegram lets a bot replace a message. Where protection is on, the bot downloads the photo, blurs part of it and/or adds the owner's watermark, reposts it credited to the person who posted it, and deletes the original. Location and camera details are removed from the copy. The image is processed in temporary storage and deleted straight away; we never keep photos. The owner's uploaded watermark is stored with their bot.
Seller reputation, if the group owner turns it on. When someone posts a photo in the topic the owner chose and tags one person, the bot records who posted it, who was tagged and when (not the photo). Those records make up the tagged person's score, which the bot shows in the group and the owner sees on the website with the poster's name. They are kept until the owner removes them or deletes the bot, are included in the owner's export, and the score of anyone who has opted out is never shown.
Announcements. A group owner can send one private announcement a day to members who have messaged the bot — for example a new invite link if the group moves. Each one says it comes from the group's admins, and replying STOP stops them for good (RESUME starts them again). Nobody who hasn't messaged the bot can ever receive one.
What the bot posted. Copies of the summaries the bot posts in the group are kept so the owner can read past digests on the website, and are deleted on the same schedule as the messages they summarize. A summary a member asks for privately is not kept.
Operational records. A log of administrative actions on your account (sign-ins, settings changes, bots created or deleted) with the IP address they came from.
We do not collect message attachments, photos, voice notes, or files. We do not read chats your bot has not been added to.
How it is used
Message content is used to generate the summaries, digests, analytics and keyword counts that the bot posts into your own group, and to answer commands your members run.
Message text is sent to a third-party AI provider to produce those summaries, and to answer when someone talks to the bot. Today that is DigitalOcean's inference service. Only what's needed is sent — the window being summarised, or for an answer the recent conversation, the message being answered and any older messages it relates to — and messages from anyone who has opted out are excluded before it leaves us.
Decisions. Unless the group owner turns it off, each day's messages are also used to write down what the group decided, so members can look it up later. Personal matters such as health are deliberately left out. These records are deleted on the same schedule as the messages they came from and never name anyone who has opted out.
Private questions. A member can also message the bot privately for a summary of, or an answer from, the group's messages. It answers only people who are currently members, and the same opt-out exclusions apply.
Keyword alerts. A member can ask the bot, in a private chat, to message them when a word is mentioned. We store the words they chose and send them the matching message with a link to it. Alerts only go to people who are currently members of the group, are removed when they leave, and never forward anything written by someone who has opted out. The words a member watches are not shown to the group owner and are not included in exports.
Your email is used to contact you about your account and the service. Your bot token is used only to operate your bot.
How long it is kept
Group messages are deleted automatically once they are older than your retention setting — 90 days unless you change it. You can lower it at any time in your dashboard and the next nightly job enforces the new value.
Deleting a bot stops it immediately and removes it from your account. Its stored messages are set aside and then destroyed; ask us and we will destroy them immediately.
Account records and administrative logs are kept while your account exists, and deleted when you close it.
Who can see it
You can see the data belonging to the bots on your own account, and nobody else's. Accounts are isolated from one another, and each bot's messages live in a database of their own.
The operator of KeeperBots can access stored data where it is necessary to run, support or repair the service. We do not read your group's messages for any other reason.
We do not share your data with anyone other than the AI provider described above, and only for the purpose of generating your summaries. If you subscribe, payment is handled by Stripe: your card details go directly to Stripe and never reach our servers. We receive and keep your Stripe customer and subscription identifiers, your plan and its renewal date, and Stripe holds your email address and billing details under its own privacy policy.
Paying in crypto. If you pay in USDC on Solana, the payment goes directly from your wallet to ours on a public blockchain. We record the transaction's identifier, the paying wallet address and the amount against your account, to credit the payment and for our accounts. Anything on the blockchain is public by its nature and can't be deleted by us or anyone else.
Your choices
Anyone in a connected group can opt out with /optout and be excluded from everything the bot writes, without needing an account here.
Account holders can change retention, pause the bot entirely, turn features off, or delete a bot and its history from the dashboard at any time.
You can ask us for a copy of the data associated with your account, or ask us to delete it. Ask through the contact form at keeperbots.com/contact and we will act on it.
Telling your group
If you connect a bot to a group, you are responsible for making sure the people in it know that their messages are being recorded and summarised, and that they can opt out. The bot announces itself when it joins, but that is not a substitute for telling them.
Security, honestly
Traffic to this site is encrypted. Passwords are hashed with scrypt. Each customer's messages are stored in a separate database, and backups are taken nightly and verified.
This is a beta service running on a single server. It has not been independently audited. Do not connect a group whose history you could not stand to lose or to have exposed.
Changes and contact
If this policy changes in a way that affects what we collect or who we send it to, we will tell account holders before it takes effect.
Questions, requests and complaints: the contact form at keeperbots.com/contact.