Who is responsible
The controller of your personal data is Victor Araya Jiménez, a sole trader in Costa Rica, reachable at admin@telegramsyncer.com.
Costa Rican data protection law (Ley N.º 8968) applies to us. If you are in the European Economic Area or the United Kingdom, we will honour the rights the GDPR gives you, as set out below.
What we collect
- Account: your email address, your name if you give one, and a password stored hashed by our authentication provider — we never see it
- Telegram: your phone number, and a session that lets us read the channels you select
- Channels and messages: the identifiers of the channels you choose to copy, and the text of the messages posted in them
- Broker: the login, server and password of the MetaTrader account you connect. The password is not kept — see below
- Trading: the signals we detected, the trades we placed, their outcome, and the per-channel settings you chose
- Subscription: the email address you bought with and the status of your plan, from Hotmart
- Technical: ordinary server logs — IP address, timestamps, error traces — kept to run and debug the service
We do not ask for your address, your date of birth or any identity document. We do not build advertising profiles, and we have nothing to sell to anyone.
Your Telegram session and messages
The session we hold is the equivalent of a linked device. It lives in our database, which our provider encrypts at rest, and it is never returned by any endpoint — not to you, not to support, not to anything the app can call.
We read messages only in the channels you selected, and only while listening is switched on. We do store the text of the messages we processed: without it, a signal cannot be explained and a mistake cannot be investigated. Private chats are not read for any purpose.
Switching listening off stops the reading. Disconnecting deletes the session.
Your broker password
It is passed once, at the moment your cloud MetaTrader account is created, to MetaApi, which hosts the connection. It is not written to our database, and it is removed from the request before anything is logged.
We do keep the account number and the broker’s server name, because the app has to show you which account is which.
The connection can trade. It cannot move money.
AI processing
To work out whether a message is a signal, we send its text to OpenAI, which returns the instrument, direction and levels it found.
Only the message text is sent. Not your name, not your email, not your account number, not your balance.
We use the OpenAI API, which under OpenAI’s current policy does not use API inputs to train their models.
Why we process it
- To provide the service you paid for: reading channels, detecting signals, placing trades. Without this data there is no product
- To keep your account secure and prevent abuse
- To check your subscription is active, by matching the email you bought with at Hotmart
- To debug and improve — investigating a signal that was misread or a trade that failed
- To comply with the law where we must
Under the GDPR, the first three are performance of a contract, the fourth is our legitimate interest in a service that works, and the last is a legal obligation.
Who else sees it
We do not sell personal data and we do not share it for advertising. Each of these receives only what it needs to do its job:
- Supabase — database and authentication
- MetaApi — hosting your MetaTrader connection and executing trades
- OpenAI — reading message text to detect signals
- Telegram — you are connecting to your own account there
- Hotmart — payments and subscription status. They are the seller and hold your payment details; we do not
- Vercel and Render — hosting the site, the app and the backends
We may also disclose data where the law requires it.
Where the data goes
Our providers run in the United States and Europe, so your data is processed outside Costa Rica and, if you are in the EEA or the UK, outside your own country as well. Where such a transfer needs a legal basis, we rely on the providers’ standard contractual clauses.
How long we keep it
- Account data: while your account exists
- Telegram session: until you disconnect, or your account is deleted
- Broker password: not retained at all
- Signals, trades and activity: while your account exists — it is your history
- Subscription records: while your account exists, and afterwards where tax or accounting rules require
- Server logs: a short operational window
There is no self-service delete yet. Ask us and we will delete your account and everything we are not legally required to keep.
Security
Traffic runs over TLS. The database and the authentication system are managed by Supabase and encrypted at rest. Your broker password is not kept.
Every request to our backend is authenticated, and the account it can reach is derived from the signed token itself rather than from anything the browser can set.
No system is perfectly secure, and we do not claim otherwise.
Cookies
This site sets no advertising cookies and runs no analytics. The only cookie it sets is the one remembering your language. Your light or dark preference is kept in your browser and never sent to us.
The app sets the cookies needed to keep you signed in. Those are functional. There is no tracking in either place.
Your rights
You can ask us to:
- give you a copy of your data
- correct something that is wrong
- delete your account and its data
- restrict or object to some processing
- send your data somewhere else
Write to admin@telegramsyncer.com. We will answer within the period our law requires, and sooner where we can. A reasonable request costs you nothing, and exercising a right will never make your service worse.
In Costa Rica you can complain to PRODHAB. In the EEA or the UK, to your local supervisory authority.
Children
This service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor holds an account, tell us and we will remove it.
Changes to this policy
We may update this policy. The date at the top says when it last changed, and material changes will be announced before they take effect.
Contact
Privacy questions: admin@telegramsyncer.com
General support: Telegram, @apptelegramsyncer