Privacy Policy

• Telegram account information (section 2).
• Task records: for each task you start, a record with the task ID and type, file names, file sizes, the source (a Telegram file reference, the link you sent, or a Google Drive file or folder ID and name), status, error messages, timestamps and the IDs of the messages the bot sent you.
• Your bot settings: language, caption template, custom thumbnail (stored as a Telegram file reference), upload mode and the channels you register for uploads (channel ID).
• Plan and payment records: your plan and its expiry, usage counters (tasks per day, total tasks) and, if you pay manually, the payment record (plan, amount option, status, dates) and a Telegram reference to the payment screenshot you send.
• Google account information, only if you connect Google Drive (section 3).
• Files you send or request, processed temporarily (sections 6 and 8).
• Technical logs: our servers keep operational logs that can include Telegram user IDs, task IDs, file names, error types and, for the website, IP addresses and browser user agents.

We do not collect your phone number, contacts or Telegram messages other than those you send to the bot.

When you use the bot, Telegram provides us with your numeric Telegram user ID, your username and your first name. We store these with the date you started using the bot and the time you last used it. They identify your account, apply your plan and limits, and deliver results to you. Messages and files you exchange with the bot are also stored by Telegram under Telegram's own privacy policy.

Public Google Drive links work without a Google account. If you choose to connect Google Drive for private files, we receive and store:

• your Google account email address and display name (read from the Drive API “about” endpoint), shown to you in the bot so you know which account is connected;
• an OAuth refresh token, stored encrypted (section 7);
• the granted scope, the connection date, the last token refresh date and the connection status.

We never receive your Google password.

Connecting Google Drive is optional. You start it from the bot (/drive). You are sent to Google's own consent page, where you choose whether to allow access. We request exactly one scope:

• https://www.googleapis.com/auth/drive.readonly: see and download your Google Drive files.

The scope is read-only: UnzipBot cannot create, modify, move, share or delete anything in your Drive. The sign-in uses PKCE and a one-time, 10-minute state value tied to your Telegram account, so an authorization can only be linked to the Telegram user who started it. If the read-only scope is not granted, the authorization is revoked immediately and nothing is stored.

• We access only the files and folders whose links you send to the bot, and, for a folder, the items inside it.
• We do not browse, index, search or scan the rest of your Drive.
• Public links are read with an API key; private items are read with your own authorization. One user's authorization is never used for another user's request.
• Files the owner has marked as not downloadable are respected and skipped; we do not bypass Google's sharing or download restrictions.
• All access uses the official Google Drive API v3.

Metadata (file name, type, size, checksum, modification time, download permission, and for folders the names and paths of the items) is read to show you what a link contains and to let you choose files. For folder selections, this listing is kept server-side in our private cache only while the task is open (at most about 2.5 hours). Drive IDs stay on the server: the file picker receives only names and sizes.

File content is downloaded to our server only when you ask for a download, ZIP or extraction. It is processed automatically (verified against Google's checksum, extracted, zipped or exported) and uploaded to your Telegram chat or to the channel you chose. No person at Galaxy Bots views your file contents as part of normal operation. Files sent to Telegram are then stored by Telegram, in your chat.

Archive passwords you send are used only to open that archive. While the bot waits for you to choose files, the password is kept in our private cache for at most 30 minutes and deleted when used. It is not written to our database. The message containing it remains in your Telegram chat unless you delete it.

• Your Google refresh token is encrypted with AES-256-GCM before it is stored in our database, using a key held separately in the server's configuration (not in the database). The encryption is bound to your account, so one user's token cannot be decrypted as another's.
• Short-lived access tokens are obtained when a task needs them, kept in memory for that task only, and never stored.
• Tokens are never included in Telegram messages, web pages, browser JavaScript or logs. Sign-in callback addresses are excluded from web server logs.
• If Google reports that your authorization was revoked or expired, we delete the stored token and mark the connection as expired.

• Each task gets its own temporary folder on our server. It is deleted as soon as the task finishes, fails or is cancelled.
• If a task is waiting for your input, its files stay until you answer: a file choice expires after 30 minutes, and an archive waiting for a password is closed after 1 day.
• An automatic cleanup runs every 10 minutes and deletes any temporary folder older than the configured limit (currently 2 hours), as a safety net.
• Temporary progress and task data in our private cache expires automatically, from 10 minutes to 24 hours depending on the item.
• A daily active-user count is kept for 100 days as a statistical sketch (HyperLogLog) from which individual user IDs cannot be read back.

• Account, settings, plan, payment and task records are kept while you use the service, so that limits, plans, history and support work. They do not expire automatically; we delete them when you ask (section 14).
• Google connection data is kept until you disconnect, or until Google tells us the authorization was revoked (the token is then deleted).
• A security audit log records Google Drive connections (including the Google email address), disconnections and expiries, and administrator actions. It is kept to protect the service and its users.
• Server logs rotate automatically by size; the worker activity log in our cache expires after 24 hours.
• Encrypted database backups are made nightly. Daily backups are kept 14 days and weekly backups 60 days on our server; an encrypted off-site copy is kept up to 180 days. Deleted data can therefore remain in backups until they expire.
• Files themselves are not retained after their task (section 8).

• Send /drive to the bot, open the Google Drive page and tap Disconnect. We revoke the authorization at Google and delete your stored Google connection (email, name and encrypted token).
• You can also remove UnzipBot at any time from your Google Account permissions page. The next time the bot tries to use it, it detects the revocation and deletes the stored token.
• Connecting a different Google account revokes the previous authorization.

• Telegram: delivers messages and stores the files the bot sends you.
• Google: Google Drive API and Google sign-in, when you use Drive links.
• Hosting: our application runs on a rented virtual private server; our database runs on a separate server reached over an encrypted (TLS) connection.
• Cloudflare: DNS for our domain.
• Websites you link: when you send a download link, our server fetches it from that website.

We use no advertising networks and no third-party analytics or tracking.

• HTTPS for the website and all Google API traffic; TLS to the database.
• Encryption of Google tokens and of stored Google API credentials; encrypted backups.
• The database and cache are not exposed to the internet.
• Telegram Mini App requests are verified with Telegram's signed data; every request is checked against the requesting user.
• The administration panel requires individual accounts with passwords, optional two-factor authentication, role-based permissions and an audit log.
• Temporary files are isolated per user and per task and deleted after use.

No system is perfectly secure, but we work to protect your information and will act promptly on any security issue reported to us.

• We do not sell, rent or trade your information, and we do not use it for advertising.
• Your files go only where you send them: your Telegram chat or a channel you registered.
• Authorized Galaxy Bots staff can see account and task records (for example file names, plan and Google connection status) in the administration panel, for support, billing and abuse prevention.
• We may disclose information if required by law, or to protect the service and its users from fraud or abuse.

You can ask us for a copy of the information we hold about you, to correct it, or to delete it. Email support@galaxybots.in from any address and include your Telegram user ID or username; we may ask you to confirm the request through the bot. On deletion we remove your account, settings, task, plan and Google connection records (and revoke any Google authorization). We may keep payment and audit records where needed for legal, accounting or security reasons, and backups expire on the schedule in section 9. You can disconnect Google Drive yourself at any time (section 10).

UnzipBot is not directed at children under 13.

Galaxy Bots · Email: support@galaxybots.in

We will post any change to this policy on this page and update the date at the top.

UnzipBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features you request: downloading, zipping, selecting, exporting and extracting the Drive files and folders you send.
• We do not transfer Google user data to others, except as necessary to provide those features (delivering the files to your Telegram chat), to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use or transfer Google user data for advertising, including personalized, retargeted or interest-based advertising.
• We do not sell Google user data.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models, and we do not use it to create AI-generated content, including non-consensual intimate imagery.
• People at Galaxy Bots do not read your Google user data unless you give us permission for specific data (for example, for support), it is needed for security purposes such as investigating abuse, or it is required by law.