What we keep and what we don't
About you
- Your Telegram ID, username and language — to send alerts to you, in your language.
- What you watch and how: positions, filters, quiet hours, the alert limit.
- Which alerts we sent, and the marks you left on finds.
- Steps in the bot: started, created a filter, topped up. That is how we see where the service is unclear. The text of your messages is not there.
- Your credit balance, top-ups, charges and subscription.
- Payments: how many Stars, how many credits and the Telegram payment number.
- Your webhook address, if you set one, and whether it answers.
We never see your phone number, email or card: Telegram takes the Stars payment and tells us only that it happened. Other users cannot see your filters or finds — only how many people watch a position, without names.
The account page on the site
You sign in to the site with Telegram: we receive only your Telegram ID and set one session cookie for 30 days. Scripts on the page cannot read it. Signing out ends the session on all your devices.
IMEI check
The number you check is matched against the open registry and never written down — not to the database, not to server logs. We count checks, not numbers.
About sellers
We keep what a listing shows everyone: model, price, description, photos, city, date — and the seller's public marketplace profile: name, sign-up date, whether it is a business account and how many listings it has. The profile is how we judge the risk of a deal. The name appears on the find card exactly as it does in the listing.
We do not collect sellers' phone numbers or addresses: the marketplace gives out a number only on a separate request, and we never make it. Find photos are deleted after 30 days. A seller who wants their name, photos or listing removed from our cards and site: write to hello@trofey.app and we will remove them.
Cookies and browser storage
- Session cookie — only if you signed in to the account page.
- Colour theme, and whether you have already seen the app's hints, — in browser storage on your device. It never reaches us.
- A sign-in key lives in the tab while you sign in with Telegram and is gone when the tab closes.
- Cloudflare, which serves the site, may set technical cookies that protect it from bots.
- Visit statistics — Cloudflare Web Analytics: no cookies, no browser fingerprint, only totals.
There are no advertising or tracking cookies — which is why there is no consent banner.
IP address
Like any server, the site sees the IP address of a request. We do not record it: not in the database, not in a visit log — the server keeps none. The rate limiter holds the address in memory for up to a minute. Only when a request fails does the address land in the web server's error log, and we empty that log every week.
Who else sees the data
- Telegram — delivers messages and takes Stars payments.
- Cloudflare — serves the site, stores find photos, counts visits.
- Oracle Cloud — the server the site passes through.
- Backblaze — stores encrypted database backups.
Their servers may be outside Ukraine, including the EU and the US. We do not sell data and do not pass it to advertisers.
How long we keep it
- Account, settings, balance — while you use the service.
- Find photos — 30 days.
- Application logs — 14 days, without IP addresses.
- Web server error log — up to 7 days.
- Session cookie — 30 days.
- Database backups — up to 5 weeks. What is deleted from the database leaves the backups within that time.
Your rights
You can ask us to show what we keep about you, correct it, delete it or stop processing it. These are your rights under Article 8 of the Law of Ukraine «On Personal Data Protection». Write to hello@trofey.app or to @trofey_app_bot — we answer within 30 days. If you believe we have violated your rights, you can complain to the Ukrainian Parliament Commissioner for Human Rights.
Deletion
The /reset command in the bot erases all your filters. To delete the whole account, write to @trofey_app_bot or hello@trofey.app. Within 30 days we delete everything except anonymous totals and payment records we are required to keep for accounting.
Who is responsible
Trofey processes the data. Privacy questions — hello@trofey.app. We announce material changes to this page in the bot in advance; the date of the last edit is at the top.