Privacy Policy — YGIFT Checker
Last updated: 31 May 2026 · Service: @Ygift_bot · Mini App: giftcheckertg.com
YGIFT Checker is a Telegram bot and Mini App that values your Telegram collectible gift portfolio from public marketplace floor prices. It also offers an in-app Telegram Stars wallet, a gift ↔ Stars exchange, optional GRAM top-ups, prediction markets, and a referral program. This policy explains what data we collect, why, how it is stored, and the choices you have. Using the optional wallet, exchange, market, GRAM, and referral features is entirely up to you — if you only check valuations, the financial sections below do not apply to you.
1. Data we collect
When you open the Mini App or message the bot, Telegram passes us a signed initData payload containing:
- Your Telegram user ID and username (if set)
- Your first/last name as shown on your Telegram profile
- An authentication timestamp and a cryptographic HMAC signature (so we can verify the request genuinely came through Telegram)
To compute portfolio value, we additionally fetch from Telegram's API:
- Your collectible gifts list — gift IDs, numbers, traits (model / backdrop / symbol), resale/transfer timestamps
- Your regular gifts list — gift types and counts
Depending on which features you choose to use, we may also collect:
- Business Mode (opt-in): if you connect your account to the bot as a Telegram business connection and grant the "view gifts" right, the bot reads your full saved gift inventory — including gifts you have hidden from your public profile — solely to value them. This inventory is read on demand and cached in memory for at most 60 seconds; it is not written to our database. We persist only the connection metadata (the connection ID, which rights you granted, and timestamps). You can revoke the connection in Telegram at any time.
- Wallet & transactions: if you use the Stars wallet, prediction markets, the gift exchange, GRAM top-ups, or referrals, we keep your Stars balance and an append-only ledger of transactions — deposits, withdrawals, market bets and payouts, gift-exchange operations, fees, and referral earnings — each tied to your Telegram user ID.
- Blockchain data (GRAM top-ups): when you top up with GRAM, we store the TON wallet address you send from and the transaction hash, so we can match your on-chain payment to your account. We do not store destination wallet addresses for withdrawals.
- Bug reports (
/report): the text you write and any media you choose to attach (photo, video, document or GIF). Voice notes and audio files are not accepted as attachments and are not stored or transcribed. Attachments you send are stored on our own server so the operator can review them and are not sent to any external service.
We do not collect or store: your phone number, email address, message history (other than bug reports you send us), contacts, precise location, IP geolocation, biometric data, or your card/bank details. Stars and card payment rails are handled by Telegram; GRAM transfers settle on the public TON blockchain — we never see your card numbers or your TON private keys.
2. How we use the data
- Compute your portfolio value (Stars / GRAM / USD) against live marketplace floor prices
- Render the leaderboard (top portfolios by value) and the contributor list
- Operate the Stars wallet, prediction markets, gift ↔ Stars exchange, GRAM top-ups, and referral program — crediting and debiting balances, settling markets, and paying referral rewards
- Cache snapshots to serve future opens instantly (5-minute to 1-hour freshness)
- Rate limits and anti-abuse (per-user cooldowns on expensive operations)
- Review and fix issues you submit via
/report, including reading the attached media and captions
- Product analytics and stability monitoring (see §6)
3. Payments, Stars & blockchain
- The in-app wallet holds Telegram Stars. Stars purchases are processed by Telegram under Telegram's own terms; we receive a payment reference, not your payment-method details.
- GRAM top-ups: you send GRAM to our custody wallet together with a one-time memo we generate for you. We match the inbound transaction by its sender address and memo, then credit the equivalent Stars. GRAM transactions are recorded on the public TON blockchain and are visible to anyone — this is a property of the blockchain, not something we control.
- Gift ↔ Stars exchange: gifts you deposit are held in a dedicated custody account and recorded in our inventory ledger; withdrawals transfer a gift back to you over Telegram.
- All in-app balances are internal accounting entries, not separate bank or crypto accounts.
4. Where data is stored
- Frontend: Cloudflare static assets (global edge CDN). No user-specific data ever reaches the frontend layer — only public assets.
- Backend: one VPS located in Germany. Data is stored in SQLite (WAL mode) and PostgreSQL databases on that single server, including a separate financial database for wallet, market, exchange, and referral records.
- Bug-report media: stored as files on that same VPS, reachable only through an authenticated operator endpoint — never served publicly.
- Cache: Redis, in-memory, same VPS. Cache entries expire automatically (TTL 60 seconds to 1 hour).
5. Retention
- Portfolio snapshots are retained as long as the bot operates, so repeat opens are instant and leaderboard history is preserved. A new snapshot is created when your gift collection changes.
- The financial ledger (wallet, markets, exchange, GRAM deposits, referrals) is append-only and retained for the life of the service — accurate balances and accounting require a complete history.
- Bug-report text and any attached media are automatically purged after 90 days.
- Business-Mode inventory reads are transient — cached at most 60 seconds, never persisted.
- Other cache entries expire within 1 hour.
- System and error logs (telemetry, stuck-loading events) are stored for about 7 days.
6. Analytics & third-party services
To understand feature usage and keep the app stable, we use:
- Telegram Mini Apps Analytics SDK (tganalytics.xyz) — a third-party SDK loaded in the Mini App that processes in-app usage events together with your Telegram user ID.
- First-party analytics — we also record basic in-app events (for example, which screen you open) on our own server.
Other services involved in running YGIFT Checker:
- Bug-report attachments (photo/video/document/GIF) stay on our own server and are not sent to OpenAI or any external service. We run no speech recognition: voice notes and audio files are not accepted as attachments.
- TON Connect — if you connect a TON wallet, the TON Connect protocol shares your public wallet address with the app.
- Cloudflare — serves the frontend and terminates TLS at the edge.
- Telegram — the platform the bot runs on; your use is also governed by Telegram's own privacy policy.
We do not use advertising networks or data brokers, and we do not sell your data.
7. Sharing
We do not sell, rent, or trade your personal data. The leaderboard and contributor list display your public Telegram username and display name alongside publicly-derivable portfolio value — this is visible to every other Mini App user by design. No private fields are exposed. Beyond the service providers listed in §6 (used strictly to operate the service), we do not share your data with third parties.
8. Your rights
You can at any time:
- Delete your data: message @Ygift_chat with your Telegram username — we will purge your snapshot, inventory, leaderboard entry, and personal bug-report content within 7 days. We may retain minimal financial-ledger entries where needed to keep balances and accounting consistent and to prevent fraud.
- Stop using the service: simply close / block the bot. No further data will be collected. Existing snapshots can be purged on request as above.
- Request a copy: reply in the support channel and we will export everything we hold about your user ID.
- Revoke Business Mode: remove the bot connection in Telegram → Settings → Telegram Business → Chatbots.
9. Security
- All traffic between the Mini App, our API, and your device is TLS 1.3 encrypted (via Cloudflare).
- Authentication uses Telegram's HMAC-signed
initData — we cannot impersonate another user.
- Secrets (bot token, API keys) are stored in environment variables, never in code or logs.
- Bug-report media is access-controlled behind operator authentication and is never served publicly.
10. Children
The service is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used the service, contact us to have the data removed.
11. Changes to this policy
We may update this policy as the service evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced in @INTERNATIONALTOXIC.
12. Contact