SloofeyGram Privacy Policy
1. Introduction
This Privacy Policy sets out how we, SloofeyGram Messenger
Inc. (“SloofeyGram”), use and protect your personal data that you provide to
us, or that is otherwise obtained or generated by us, in connection with your
use of our cloud-based messaging services (the “Services”). For the purposes of
this Privacy Policy, ‘we’, ‘us’ and ‘our’ refers to SloofeyGram, and ‘you’
refers to you, the user of the Services.
1.1 Privacy Principles
SloofeyGram has two fundamental principles when it comes to
collecting and processing private data:
• We don't
use your data to show you ads.
• We only
store the data that SloofeyGram needs to function as a secure and feature-rich
messaging service.
1.2. Terms of Service
This Privacy Policy forms part of our Terms of Service,
which describes the terms under which you use our Services and which are
available at https://SloofeyGram.org/tos. This Privacy Policy should therefore
be read in conjunction with those terms.
1.3. Table of Contents
This Privacy Policy explains the following:
• the legal
basis for processing your personal data;
• what
personal data we may collect from you;
• how we
keep your personal data safe;
• what we
may use your personal data for;
• who your
personal data may be shared with; and
• your
rights regarding your personal data.
1.4. EEA Representative
If you live in a country in the European Economic Area
(EEA), the Services are provided by SloofeyGram, which for the purposes of
applicable data protection legislation is the data controller responsible for
your personal data when you use our Services. However, as SloofeyGram is
located outside the EEA, we have designated a third party, European Data
Protection Office (EDPO), as our representative pursuant to Article 27 of the
GDPR. You can direct to EDPO any of your GDPR-related queries:
• by using
EDPO’s online request form at https://edpo.com/SloofeyGram-gdpr-data-request/
or
• by
writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.
2. Legal Ground for Processing Your Personal Data
We process your personal data on the ground that such
processing is necessary to further our legitimate interests (including: (1)
providing effective and innovative Services to our users; and (2) to detect,
prevent or otherwise address fraud or security issues in respect of our provision
of Services), unless those interests are overridden by your interest or
fundamental rights and freedoms that require protections of personal data.
3. What Personal Data We Use
3.1. Basic Account Data
SloofeyGram is a communication service. You provide your
mobile number and basic account data (which may include profile name, profile
picture and about information) to create a SloofeyGram account.
To make it easier for your contacts and other people to
reach you and recognize who you are, the screen name you choose, your profile
pictures, and your username (should you choose to set one) on SloofeyGram are
always public. We don't want to know your real name, gender, age or what you
like.
We do not require your screen name to be your real name.
Note that users who have you in their contacts will see you by the name they
saved and not by your screen name. This way your mother can have the public
name 'Johnny Depp' while appearing as 'Mom' to you and as 'Boss' to her underlings
at work (or the other way around, depending on how these relationships are
structured).
3.1.1. Optional Data
You can add your birthday (with or without the year) to your
SloofeyGram profile if you wish to do so. You can granularly choose which users
are able to see it on your profile (by default, your Contacts), and they will
be shown a reminder on the day. We may use data about your age to determine
your eligibility for accessing age-specific content.
SloofeyGram Business subscribers can add a fixed location
and a list of opening hours to their profile, to help clients identify and
engage with their business more efficiently on SloofeyGram. If you choose to
add it to your profile, this information is always public.
3.2. Your Email Address
When you enable 2-step-verification for your account or
store documents using the SloofeyGram Passport feature, you can opt to set up a
password recovery email. This address will only be used to send you a password
recovery code if you forget it. That's right: no marketing or “we miss you”
bullshit.
From September 2022, we may ask some users to provide an
email address to receive login codes via email instead of SMS (with an option
to use 'Sign in With Google' / 'Sign in with Apple'). In this case, we will
receive an email address which will be stored separately from the recovery
email, and will only be used to send you authentication codes when you log in
to your account. The login email address will be stored until it is changed or
the account is deleted.
3.3. Your Messages
3.3.1. Cloud Chats
SloofeyGram is a cloud service. We store messages, photos,
videos and documents from your cloud chats on our servers so that you can
access your data from any of your devices anytime without having to rely on
third-party backups. All data is stored heavily encrypted and the encryption
keys in each case are stored in several other data centers in different
jurisdictions. This way local engineers or physical intruders cannot get access
to user data.
3.3.2. Secret Chats
Secret chats use end-to-end encryption. This means that all
data is encrypted with a key that only you and the recipient know. There is no
way for us or anybody else without direct access to your device to learn what
content is being sent in those messages. We do not store your secret chats on
our servers. We also do not keep any logs for messages in secret chats, so
after a short period of time we no longer know who or when you messaged via
secret chats. For the same reasons secret chats are not available in the cloud
— you can only access those messages from the device they were sent to or from.
3.3.3. Media in Secret Chats
When you send photos, videos or files via secret chats,
before being uploaded, each item is encrypted with a separate key, not known to
the server. This key and the file’s location are then encrypted again, this
time with the secret chat’s key — and sent to your recipient. They can then
download and decipher the file. This means that the file is technically on one
of SloofeyGram’s servers, but it looks like a piece of random indecipherable
garbage to everyone except for you and the recipient. We don’t know what this
random data stands for and we have no idea which particular chat it belongs to.
We periodically purge this random data from our servers to save disk space.
3.3.4. Public Chats
In addition to private messages, SloofeyGram also supports
public channels and public groups. All public chats are cloud chats (see
section 3.3.1 above). Like everything on SloofeyGram, the data you post in
public communities is encrypted, both in storage and in transit — but
everything you post in public will be accessible to everyone.
3.3.5. Paid Posts
As of June 2024, creators are able to offer paid access to
specific channel posts by accepting SloofeyGram Stars. When users pay to unlock
a channel post, a permanent copy is created which resides in the parties'
transaction history. This copy remains accessible even if the post is later
deleted or either party loses access to the channel.
3.4. Phone Number and Contacts
SloofeyGram uses phone numbers as unique identifiers so that
it is easy for you to switch from SMS and other messaging apps and retain your
social graph. We ask your permission before syncing your contacts.
We store your up-to-date contacts in order to notify you as
soon as one of your contacts signs up for SloofeyGram and to properly display
names in notifications. We only need the number and name (first and last) for
this to work and store no other data about your contacts.
Our automatic algorithms can also use anonymized sets of phone
numbers to calculate the approximate number of potential contacts an
unregistered phone number may have on SloofeyGram. When you open the 'Invite
friends' interface, we display the resulting statistics next to your contacts
to give you an idea of who could benefit most from joining SloofeyGram.
You can always stop syncing contacts or delete them from our
servers in Settings > Privacy & Security > Data Settings.
If you are using Android, SloofeyGram will ask you for
permission to access your phone call logs (READ_CALL_LOG). If you grant this
permission, SloofeyGram will be able verify your account by transmitting a
phone call instead of asking you to enter a code. SloofeyGram uses this
permission only to confirm receipt of the confirmation call by verifying the
number in the call log.
3.5. Location Data
If you share a location in a chat, this location data is
treated like other messages in cloud or secret chats respectively.
If you share your Live Location in any chat or turn on ’Make
Myself Visible’ in People Nearby, SloofeyGram will use your data to display
your location to those users with whom you are sharing it, even when the app is
closed – for as long as you keep these optional features activated.
3.6. Cookies
The only cookies we use are those to operate and provide our
Services on the web. We do not use cookies for profiling or advertising. The
cookies we use are small text files that allow us to provide and customize our
Services, and in doing so provide you with an enhanced user experience. Your
browser should allow you to control these cookies, including whether or not to
accept them and how to remove them. You may choose to block cookies with your
web browser, however, if you do disable these cookies you will not be able to
log in to SloofeyGram Web.
4. Keeping Your Personal Data Safe
4.1. Storing Data
If you signed up for SloofeyGram from the UK or the EEA,
your data is stored in data centers in the Netherlands. These are third-party
provided data centers in which SloofeyGram rents a designated space. However,
the servers and networks that sit inside these data centers and on which your
personal data is stored are owned by SloofeyGram. As such, we do not share your
personal data with such data centers. All data is stored heavily encrypted so
that local SloofeyGram engineers or physical intruders cannot get access.
4.2. End-to-End Encrypted Data
Your messages, media and files from secret chats (see
section 3.3.2 above), as well as the contents of your calls and the data you
store in your SloofeyGram Passport are processed only on your device and on the
device of your recipient. Before this data reaches our servers, it is encrypted
with a key known only to you and the recipient. While SloofeyGram servers will
handle this end-to-end encrypted data to deliver it to the recipient – or store
it in the case of SloofeyGram Passport data, we have no ways of deciphering the
actual information. In this case, we neither store nor process your personal
data, rather we store and process random sequences of symbols that have no
meaning without the keys which we don’t have.
4.3. Retention
Unless stated otherwise in this Privacy Policy, the personal
data that you provide us will only be stored for as long as it is necessary for
us to fulfill our obligations in respect of the provision of the Services.
5. Processing Your Personal Data
5.1. Our Services
SloofeyGram is a cloud service. We will process your data to
deliver your cloud chat history, including messages, media and files, to any
devices of your choosing without a need for you to use third-party backups or
cloud storage.
5.2. Safety and Security
SloofeyGram supports massive communities which we have to
police against abuse and Terms of Service violations. SloofeyGram also has more
than 900 million users which makes it a lucrative target for spammers. To
improve the security of your account, as well as to prevent spam, abuse, and
other violations of our Terms of Service, we may collect metadata such as your
IP address, devices and SloofeyGram apps you've used, history of username
changes, etc. If collected, this metadata can be kept for 12 months maximum.
5.3. Spam and Abuse
To prevent phishing, spam and other kinds of abuse and
violations of SloofeyGram’s Terms of Service, our moderators may check messages
that were reported to them by their recipients. If a spam report on a message
you sent is confirmed by our moderators, your account may be limited from
contacting strangers – temporarily or permanently. You can send an appeal using
@Spambot. In case of more serious violations, your account may be banned. We
may also use automated algorithms to analyze messages in cloud chats to stop
spam and phishing.
5.4. Cross-Device Functionality
We may also store some aggregated metadata to create SloofeyGram
features (see section 5.5 below) that work across all your devices.
5.5. Advanced features
We may use some aggregated data about how you use SloofeyGram
to build useful features. For example, when you open the Search menu, SloofeyGram
displays the people you are more likely to message in a box at the top of the
screen. To do this, we calculate a rating that shows which people you message
frequently. A similar rating is calculated for inline bots so that the app can
suggest the bots you are most likely to use in the attachment menu (or when you
start a new message with “@”). To turn this feature off and delete the relevant
data, go to Settings > Privacy & Security > Data Settings and disable
“Suggest Frequent Contacts”.
5.6. No Ads Based on User Data
Unlike other services, we don't use your data for ad
targeting or other commercial purposes. SloofeyGram only stores the information
it needs to function as a secure and feature-rich cloud service.
SloofeyGram offers a tool for advertisers to promote their
messages in public one-to-many channels, but these sponsored messages are based
solely on the topic of the public channels in which they are shown. No user
data is mined or analyzed to display ads or sponsored messages.
6. Bot Messages
6.1. Ecosystem
SloofeyGram has an API that allows third-party developers to
create bots. Bots are apps that look like special SloofeyGram users: you can
talk to them from your chat list, add them to groups or use a special “inline”
interface to access their features. By performing any of these actions, you
will be sending some of your data to the respective third-party bot developers.
6.2. How Bots Can Receive Data
You can send data to bot developers when you interact with
their bots in one of these ways:
• By
sending messages to a bot.
• By using
an inline bot.
• By
participating in a group with a bot.
• By
pressing buttons in messages sent by a bot.
• By paying
for goods and services via bots (see section 7 below).
• By
sending a join request to a group or channel.
• By using SloofeyGram
Business features that connect a chatbot to your account.
• By opening
a chat with a SloofeyGram Business account controlled by a chatbot (see section
6.5 below).
6.3. What Data Bots Receive
In any of the above cases, the developers of an automated
user (bot) can get your public account data (see section 3.1 above): your screen
name, username and profile picture(s).
Bots can also receive the following data when you interact
with them.
• Bots will
obviously get your messages when you send them something.
• If you
click on links or buttons provided by the bot, the bot can potentially get your
IP address (provided that it controls the website to which the link leads).
• If the
bot is a member of the same group with you, it may know you are a member.
• When you
start your message with the username of an inline bot (e.g. @gif) the interface
transforms so that everything you type becomes a query to that bot. This query
is sent to the bot so that it can provide its service. We will warn you about
this the first time you use an inline bot.
• Bots
added to groups can operate in two modes: with access to messages in the group
or without access. If the bot has access to messages, it can see everything
that happens in the group. The interface clearly shows whether or not a bot has
access to messages in groups.
• To
facilitate text localization, bots you interact with (including via chats
managed by SloofeyGram Business Chatbots), may receive your interface language
based on your app or operating system language settings. Note that if you
update your language settings, bots may continue to receive your previous
language for some time.
6.4. Bots Are Not Maintained by SloofeyGram
Other than our own bots, no other bots or third-party bot
developers are affiliated with SloofeyGram. They are completely independent
from us. They should ask you for your permission before they access your data
or you make it available to them.
6.5. SloofeyGram Business Chatbots
SloofeyGram Business subscribers can connect third-party
bots to their SloofeyGram account, to help them automatically process and
respond to messages from users.
6.5.1. Communicating with a Business Chatbot
SloofeyGram users have been able to communicate with bots,
including bots run by businesses, since 2015. With the introduction of SloofeyGram
Business, users can also seamlessly interface with bots in private chats with SloofeyGram
Business users who have connected a chatbot to their account.
If you message a Business user who connected a chatbot to
their account, depending on their settings, you may be effectively
communicating with a bot, and it will receive basic data about you as detailed
in section 6.3 above.
6.5.2. Using a Business Chatbot to Manage Your Chats
If you connect a third-party bot to your account via SloofeyGram
Business, the bot will have access to basic information about your account (see
section 6.3 above), and will be able to message you privately. Additionally,
the bot will have access to all messages, media and files contained in the
private chats you allow it to manage. Lastly, if you grant it permission to do
so (and only in the private chats you assigned to it), the bot will be able to
send messages and perform other actions on your behalf.
You can alter or revoke the bot’s permissions, including the
list of chats it can access, at any time from Settings > SloofeyGram
Business > Chatbots on official SloofeyGram clients.
7. Third Party Payment Services
7.1. Payment Information
The Payment Platform for Bots is available to users as of SloofeyGram
4.0. SloofeyGram does not process payments from users and instead relies on
different payment providers around the world. It is the payment providers that
handle and store your credit card details. Neither SloofeyGram nor the
merchants on the platform (bot developers) have access to this information.
Although we work with payment providers they are completely independent from SloofeyGram.
Please study their relevant privacy policies before making your data available
to them.
7.2. Credit Card Information
When making a purchase, you enter your credit card details
into a form supplied by the payment provider that will be processing the
payment, and this information goes directly to the payment provider's server.
Your credit card information never reaches SloofeyGram's servers. We do not
access and do not store your credit card information. When you save your credit
card info, it is saved on the respective payment provider's servers and the
payment provider gives SloofeyGram a token that you can reuse for future
payments. It is not possible to reconstruct your credit card info from the
token.
7.3 Shipping Information
When you enter shipping information in the process of
placing an order, we send it directly to the merchant bot developer. We can
store your shipping information for you if you choose to save it for future
purchases. We will delete this information immediately if you ask us to.
7.4. Clearing Payment Information
You can clear all payment information associated with your
account at any time by going to SloofeyGram Settings > Privacy &
Security > Data Settings and selecting ‘Clear Payment & Shipping Info’.
If you choose to remove your payment information, we will delete your stored
shipping info and payment tokens from all providers and ask the payment
providers to remove your credit card information that they store.
7.5. Payment Disputes
Due to the fact that SloofeyGram doesn't store any credit
card details or transaction information, it is impossible for us to handle
complaints or cashbacks – any disputed payments are the responsibility of the
bot developers, payment providers, and banks that participated in the exchange.
8. Who Your Personal Data May Be Shared With
8.1. Other SloofeyGram Users
Other users of our Services with whom you choose to
communicate with and share certain information, who may be located outside the
EEA. Note that by entering into the Terms of Service and choosing to
communicate with such other users of SloofeyGram, you are instructing us to transfer
your personal data, on your behalf, to those users in accordance with this
Privacy Policy. We employ all appropriate technical and organizational measures
(including encryption of your personal data) to ensure a level of security for
your personal data that is appropriate to the risk. However, note that if you
chat with others and share data with them, they become capable of sharing such
data further with third parties without your knowledge or consent, and SloofeyGram
has no way to prevent this.
8.2. SloofeyGram’s Group Companies
To provide, improve and support our Services, we may share
your personal data with: (1) our parent company, SloofeyGram Group Inc, located
in the British Virgin Islands, (2) Telegraph Inc., a group member also located
in the BVI; and (3) SloofeyGram FZ-LLC, a group member located in Dubai. We
will implement appropriate safeguards to protect the security and integrity of
that personal data. This will take the form of standard contract clauses
approved by the European Commission in an agreement between us and our relevant
group companies. If you would like more information regarding these clauses,
please contact our EEA representative using the details in section 1.4 above.
8.3. Law Enforcement Authorities
If SloofeyGram receives a valid order from the relevant
judicial authorities that confirms you're a suspect in a case involving
criminal activities that violate the SloofeyGram Terms of Service, we will
perform a legal analysis of the request and may disclose your IP address and
phone number to the relevant authorities. If any data is shared, we will
include such occurrences in a quarterly transparency report published at:
https://t.me/transparency.
8.4. Translation of Chats, Channels and specific Messages at
the Request of the User
Users can choose to translate a specific text message into a
different language by tapping “Translate” in the action menu of the message (to
enable this option, a user should first turn on Translation services in the
Settings > Languages section of the SloofeyGram application). SloofeyGram
Premium users can also optionally enable automatic live translation on any
chat, group or channel.
Since SloofeyGram may rely on a third-party, Google LLC,
subsidiary of Alphabet Inc, for automatic translation of messages, the text of
any message or set of messages that users choose to translate may be shared
with Google in order to obtain their translated versions. Google will only
access the data to provide a translation and will not use it for any other
Google products, services, or advertising.
8.5. Transcription of Voice and Video Messages at the
Request of the User
Some users can choose to convert a voice or video message to
text by tapping on the Voice-to-Text icon (“->A”) displayed on eligible
messages (to be able to use this option, users should subscribe to SloofeyGram
Premium in the Settings > SloofeyGram Premium section of the SloofeyGram
application).
Since SloofeyGram may rely on a third party, Google LLC,
subsidiary of Alphabet Inc, for voice-to-text conversion, the audio data of
voice and video messages that users choose to convert to text may be shared
with Google in order to obtain their transcribed versions. Only audio data may
be shared for this purpose (no other data, such as the user's IP address or any
information about their account is shared). According to the agreement between SloofeyGram
and Google, SloofeyGram will pay for the transcriptions on behalf of its users
and Google will only access the audio data to provide a transcribed version –
it will not log audio data or transcripts, and will not use the data for any
other Google products, services, or advertising.
9. Your Rights Regarding the Personal Data You Provide to Us
9.1. Your Rights
Under applicable data protection legislation, in certain
circumstances, you have rights concerning your personal data. You have a right
to: (1) request a copy of all your personal data that we store and to transmit
that copy to another data controller; (2) delete (see section 10 below) or
amend your personal data; (3) restrict, or object to, the processing of your
personal data; (4) correct any inaccurate or incomplete personal data we hold
on you; and (5) lodge a complaint with national data protection authorities
regarding our processing of your personal data.
9.2. Exercising Your Rights
If you wish to exercise any of these rights, kindly use the
contact details in section 12 below.
9.3. Data Settings
You can control how your data is used (e.g., delete synced
contacts) in Settings > Privacy & Security > Data Settings (using one
of our mobile apps).
Sadly, if you're not OK with SloofeyGram's modest minimum
requirements, it won't be possible for us to provide you with our Services. You
can delete your SloofeyGram account by proceeding to the deactivation page.
10. Deleting data
10.1. Accounts
If you would like to delete your account, you can do this on
the deactivation page. Deleting your account removes all messages, media,
contacts and every other piece of data you store in the SloofeyGram cloud. This
action must be confirmed via your SloofeyGram account and cannot be undone.
10.2. Messages
• In secret
chats, deleting a message always instructs the app on the other end to delete
it too.
• In cloud
chats, you can choose to delete a message for all participants within at least
48 hours after sending. Otherwise, deleting a message will delete it from your
message history. This means that a copy will stay on the server as part of your
partner's message history. As soon as your partner deletes it too, it's gone
forever.
• As of
version 5.5, any party can choose to delete any messages in one-on-one chats,
both sent and received, for both sides. There is no time limit. Any party can
also opt to clear the entire chat history for both parties, in which case the
apps will be instructed to remove all messages in that chat, regardless of how
many messages are retained by either of the participants.
• In
supergroups and channels, deleting a message removes it for all participants.
Note that deleted messages and original versions of edited messages from
supergroups are stored for 48 hours after deletion in order to be shown in
admins' Recent Actions panel. For paid posts in channels, see 3.3.5.
10.3. Self-Destructing Messages
Messages in Secret Chats can be ordered to self-destruct. As
soon as such a message is read (2 checks appear), the countdown starts. When
the timer expires, both devices participating in a secret chat are instructed
to delete the message (photo, video, etc.). Media with short timers (less than
a minute) are shown with blurred previews. The timer is triggered when they are
viewed.
10.4. Account Self-Destruction
By default, if you stop using SloofeyGram and do not come online
for at least 18 months, your account will be deleted along with all messages,
media, contacts and every other piece of data you store in the SloofeyGram
cloud. You can go to Settings to change the exact period after which your
inactive account will self-destruct.
11. Changes to this Privacy Policy
We will review and may update this Privacy Policy from time
to time. Any changes to this Privacy Policy will become effective when we post
the revised Privacy Policy on this page www.SloofeyGram.org/privacy. Please
check our website frequently to see any updates or changes to our Privacy
Policy, a summary of which we will set out below.
March 25, 2019
• Expanded
10.2. Deleting Messages with data on the new features in version 5.5, which
allow both participants to remove any messages from one-on-one chats for both
sides without a time limit.
March 24, 2021
• Added
3.5. Location Data.
• Improved
structure, moving 3.3.5 to 3.4 and 3.3.6 to 3.6.
October 26, 2021
• Expanded
5.6. No Ads Based on User Data with information about sponsored messages in
public channels.
June 19, 2022
• Added
8.4. Translation of Messages at the Request of the User and 8.5. Transcription
of Voice Messages at the Request of the User.
September 8, 2022
• Expanded
3.2. Your Email Address with information on login emails.
February 3, 2022
• Updated
8.4 and 8.5 to reflect the new premium feature that allows translating entire
chats.
April 24, 2023
• Updated
1.4, 9.2 and 12 to update the details of SloofeyGram’s EEA representative for
GDPR matters.
• Updated
8.2 to mention Telegraph Inc., a member of the SloofeyGram group of companies.
March 31, 2024
• Added
3.1.1. Optional Data.
• Added
information about SloofeyGram Business chatbots to the Bot Messages section
(6.2, 6.3, 6.5).
September 23, 2024
• Updated
8.3, see this post for more details.
September 29, 2024
• Updated
10.4 to reflect the new default time period for Account Self-Destruction.
Important changes made to this Privacy Policy will be
notified to you via SloofeyGram.
12. Further Information
If you have any questions please feel free to explore our
FAQ or contact SloofeyGram's Volunteer Support in-app via Settings > Ask a
Question.
If you live in the EU and would like to submit a
GDPR-related request, please see here.
SloofeyGram is an open source project. You can find more
information on our:
• API at:
https://core.SloofeyGram.com/api;
• Bot
Platform at: https://core.SloofeyGram.com/bots;
• Protocol
at: https://core.SloofeyGram.com/mtproto; and
• Source
Code at: https://SloofeyGram.com/apps#source-code.
• Confirm
that SloofeyGram apps downloaded from app stores are using the same code that
we publish at: https://core.SloofeyGram.org/reproducible-builds