Privacy Policy

Last updated: September 19, 2026

1. Introduction

Statiko ("Statiko", "we", "our", or "us") provides analytics for public Telegram channels. This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to everything we operate:

the website and dashboard at statiko.io (the "Service");
Creator Tools, the part of the dashboard that lets you schedule and publish posts to Telegram channels you manage;
the Statiko connector for AI assistants (the "Connector"), a Model Context Protocol (MCP) server at mcp.statiko.io that AI assistants such as Claude or ChatGPT can call on your behalf.

If you do not agree with this policy, please do not use the Service. Our Cookie Policy and Terms and Conditions form part of it.

2. Information we collect

2.1 Public Telegram channel data

We collect and analyse information that Telegram channels make public: channel names, usernames, descriptions and avatars; public posts, including their text, media references, edits and deletions; subscriber counts; and per-post view, forward, reply and reaction counts. We derive metrics from this data (growth, engagement, activity, trending topics, channel similarity, recaps).

This data is not collected from you. It may nevertheless contain personal data of the people who publish on Telegram (for example an author's name in a post). We process it in our legitimate interest, and the public interest, of providing transparency about publicly available content, including the history of edits and deletions, which is what the Service exists to show. Because it is public content processed for that purpose, we generally do not remove it at the request of the channel or its author. We review every objection individually (section 12) and remove or restrict data where the rights of the person concerned outweigh that interest — for example, a private individual's personal channel, or content that has since been unlawfully published.

2.2 Account and profile information

When you create an account we collect:

your email address and, if you set one, your display name and avatar;
with email sign-in, the one-time codes and magic-link tokens we send you (they expire within minutes);
with Google sign-in, your Google account id, email address, name and profile picture;
with Telegram sign-in, your Telegram user id, first and last name, username and profile photo. Telegram also asks whether our bot may send you messages; we use that permission only to deliver recaps and notifications you have enabled;
if you enable two-factor authentication, the secret and backup codes needed to verify it;
session records: a session token, the IP address and browser (user agent) of each sign-in, and its timestamps.

2.3 Organisations and members

If you create or join an organisation we store its name, logo and slug, the members and their roles, and the email addresses of people you invite.

2.4 Billing information

Payments are processed by Creem, our merchant of record. We never see or store card numbers. We receive and store from Creem a customer id, the plan you subscribed to, the subscription status and period, and order references. Creem may collect billing address and tax information under its own privacy policy.

2.5 Creator Tools

If you use Creator Tools we additionally store:

the token of the Telegram bot you register, encrypted at rest, plus the bot's id, username and status;
the Telegram channels you connect to it, their titles and the bot's membership status in them;
draft, scheduled, sent and recurring posts, including their text, formatting and settings;
media files you upload (images, video, documents), their metadata and previews;
tags, folders and other organisation you apply;
an audit log of actions taken in Creator Tools (who did what, when, to which post, channel, bot or file).

Posts you publish through Creator Tools are sent to Telegram through your bot and are then governed by Telegram's terms and privacy policy.

2.6 Content you create on Statiko

Collections of channels you assemble, channels you star, recap and alert preferences, and any other settings you save.

2.7 Usage and device information

When you use the Service we collect, directly or through PostHog (section 5):

pages and screens viewed, features used, buttons clicked, and search queries you enter in the catalogue and search pages;
device and browser type, operating system, language, screen size;
IP address and the approximate location derived from it (country/region);
error and crash reports, including the page you were on and the request that failed;
with your consent where it is required, session replays: a recording of how you interact with the page (mouse movement, scrolling, clicks). Text you type into inputs is masked.

Analytics is switched on only after you accept it in the consent banner in jurisdictions where consent is required; elsewhere it runs unless you opt out (section 8).

2.8 Communications

If you contact us by email or through the app we keep the correspondence and the information you provide in it.

3. The AI assistant connector

The Connector lets an AI assistant you use (for example Claude, ChatGPT, or any MCP-compatible client) query Statiko data on your behalf. This section explains exactly what flows through it.

3.1 Signing in

The Connector uses OAuth 2.1. When you add it to your assistant you sign in to your Statiko account and approve the assistant's request. The assistant receives an access token limited to the mcp:read scope (read-only access to Statiko data) and, if it asked for it, offline_access (a refresh token so you do not have to sign in again). No other scope is available: the Connector cannot change your account, your organisation, your billing or anything in Creator Tools.

We record the assistant application that connected (its client id, name and redirect URLs), the consent you gave, and the tokens issued. The Connector is available on paid plans, so on each request we check your plan and cache the result for up to one hour.

3.2 Tool inputs — what your assistant sends us

Your assistant decides which tools to call and with what arguments, based on your conversation with it. The only inputs the Connector accepts are:

Search Telegram channels — a free-text search query; optional category, language and activity filters; result limit.
Channel profiles & metrics — one or more channel usernames, ids or t.me links.
Similar channels — a channel identifier; result limit.
Channel timeline events — a channel identifier; optional event-type filter; page and limit.
Posts from a channel — a channel identifier; optional date range and filters; limit.
Interaction history of a post — a channel identifier and a post id.
Trending topics board — trend window and language.
Posts behind a trend — a trend keyword, window, language and limit.
Search Statiko / Fetch a Statiko document — a free-text query / a Statiko document id.

Together with each call we receive the standard request metadata: your user id (from the token), the assistant's client id, timestamp and IP address of the assistant's server. We do not receive your conversation with the assistant, your prompts, or any other files or data the assistant has access to.

3.3 Tool outputs — what we send back

Every tool returns only public Telegram channel data and metrics derived from it (section 2.1): channel profiles, subscriber and post counts, post text and engagement figures, timeline events such as edits and deletions, trending topics with sample posts, and statiko.io links to cite. Tool outputs never include your account data, your organisation's data, your Creator Tools content, or data about other Statiko users.

Once returned, outputs become part of your conversation with the assistant and are handled by the assistant's provider under its own privacy policy, including any retention or model-training practices it applies. Please review that policy.

3.4 What we keep from Connector use

We log each request (timestamp, user id, client id, tool name, response status and duration, and error diagnostics) to operate, secure and meter the Connector, and we keep the OAuth client, consent and token records for as long as the connection exists. We do not use tool inputs or outputs for advertising, do not sell them, and do not use them to train AI models. Search queries submitted through the Connector are processed to return results and are subject to the same retention as other request logs (section 6).

3.5 Disconnecting

You can remove the Connector at any time from your assistant's settings, which stops it from using the tokens it holds. To have us revoke the tokens and delete the consent record on our side, contact us (section 12) or delete your account (section 8).

4. How we use information

Each purpose lists the data it uses and, where the GDPR or UK GDPR applies, our legal basis.

Provide the Service — accounts, sign-in, dashboards, search, recaps, Creator Tools and the Connector. Uses account, organisation, Creator Tools, content, Connector and public Telegram data. Basis: performance of a contract.
Process payments and manage subscriptions — uses billing information. Basis: performance of a contract; legal obligation (tax, accounting).
Send transactional email — sign-in codes, invitations, receipts, security notices. Uses your email address. Basis: performance of a contract.
Deliver recaps and notifications you enabled, by email or Telegram bot message — uses email address, Telegram id and preferences. Basis: performance of a contract.
Understand and improve the product — uses usage and device information. Basis: consent where required, otherwise legitimate interest.
Detect, diagnose and fix errors and abuse; secure accounts — uses usage and device information, session records and request logs. Basis: legitimate interest.
Comply with law and enforce our terms — uses any of the above as needed. Basis: legal obligation; legitimate interest.

We do not use your data for automated decisions with legal or similarly significant effects, and we do not use your personal data to train AI models.

5. Who we share information with

We do not sell personal information. We share it only with the parties below, each of which processes it under a contract with us or under its own policy as an independent controller where noted.

Cloudflare (Workers, D1, KV, R2) — all Service data, for hosting, storage and delivery of the Service.
PostHog — usage, device, error and session-replay data, for product analytics and error monitoring.
Resend — email address and email content, for sending transactional email.
Creem (independent controller for payment data) — billing information, for payment processing, invoicing and tax.
Telegram (independent controller) — your Telegram id when you sign in with Telegram or receive bot messages; posts, media and bot token when you publish through Creator Tools.
Google (independent controller) — Google account data when you sign in with Google.
Your AI assistant provider (independent controller) — Connector tool inputs and outputs, because you chose to use Statiko through that assistant.
Organisation members — your name, email and role within a shared organisation you joined.
Authorities and professional advisers — what is legally required, for legal obligations and defence of claims.
A successor — Service data if Statiko is merged, acquired or sold; you will be notified.

6. How long we keep information

Account, profile, organisation, content and settings — for as long as your account exists, then deleted within 30 days of account deletion.
Sign-in codes and magic links — minutes; deleted on use or expiry.
Sessions — until sign-out or expiry; expired sessions are purged.
Connector OAuth clients, consents and tokens — for as long as the connection exists; expired tokens are purged; all deleted with your account.
Billing records — for as long as tax and accounting law requires (typically up to 10 years).
Creator Tools posts, audit log and bot/channel records — for as long as your account exists.
Creator Tools media — up to 365 days after upload unless you delete it earlier; trashed files are permanently removed after 90 days; unconfirmed uploads within 7 days.
Request and error logs — up to 30 days.
Product analytics and session replays — up to 12 months.
Public Telegram channel data — for as long as it is useful for analytics, including the history of edits and deletions; removed or restricted only where an objection succeeds (section 2.1).
Support correspondence — up to 2 years after the case is closed.

Where a shorter or longer period is required by law we follow the law. Backups are overwritten on a rolling schedule.

7. Data security

We use encryption in transit (TLS) and at rest, encrypt Creator Tools bot tokens with a key held separately from the database, scope access tokens to the minimum needed, verify Connector tokens offline against signed keys, and restrict staff access to production data. No system is perfectly secure; if we learn of a breach affecting you we will notify you and the relevant authorities as the law requires.

8. Your choices and rights

Self-service controls

Account deletion: Settings → General → Delete account removes your account and the data listed in section 6, and revokes any Connector access.
Profile, organisation, collections, recaps, Creator Tools content: edit or delete them from the dashboard at any time.
Analytics consent: accept or decline in the consent banner; to change your choice later, clear the analytics-consent cookie and site data for statiko.io in your browser and the banner will ask again. See the Cookie Policy.
Connector: disconnect it from your assistant's settings.
Emails and bot messages: turn recaps and notifications on or off in the dashboard. Transactional messages (codes, receipts, security notices) cannot be switched off while you have an account.

Rights under data protection law

Depending on where you live (including the EEA, UK, Switzerland, California and other US states), you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, to withdraw consent, and to lodge a complaint with a supervisory authority. We do not sell or "share" personal information for cross-context behavioural advertising and we do not discriminate against you for exercising your rights. Send requests to the address in section 12; we answer within 30 days (45 days where the law allows) and may ask you to verify your identity.

9. International transfers

Statiko is operated from the European Union. Our providers process data in the EU and the United States. Where personal data leaves the EEA or UK we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum) with the recipient.

10. Children

The Service is not directed to anyone under 16 and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post changes on this page and update the date at the top. For material changes we will also notify registered users by email or in the dashboard before they take effect.

12. Contact

Questions, requests about your data, or objections to the processing of public channel data:

privacy@statiko.io

13. Language

This policy may be provided in other languages for convenience. If the versions conflict, the English version prevails.