1. Data Controller
The data controller for TG Downloader is:
- Legal name: XIANG LISHUAI
- Entity type: individual operator
- Country: China
- Privacy contact: support@tg-downloader.com
- Data Protection Officer: not appointed
This Privacy Policy explains how we collect, use, store, share, transfer, and delete personal information when you use the TG Downloader website, desktop application, account, license, membership, support, or payment services (the "Service").
2. Information We Collect
2.1 Information You Provide
- Account information such as email address, encrypted password, verification status, and profile information returned by Google sign-in if you choose that method.
- License and membership information, including plan, activation status, expiry date, quotas, and activation-code redemption records.
- Order and payment information such as order number, plan, amount, currency, payment method, payment status, provider transaction ID, coupon use, and refund or dispute records.
- Support communications, including emails, attachments, device IDs, order numbers, and diagnostic information you choose to provide.
2.2 Information Processed When You Use the Service
- Device and service data such as device identifier, device name, operating system, application version, heartbeat time, IP address, and anti-abuse or device-fingerprint signals.
- Usage and entitlement data such as features accessed, download or monitor activity counts, daily quota consumption, license status, and service errors.
- Website and server data such as request time, page or API requested, browser type, security events, error logs, and basic network information.
- Telegram account and session data stored locally by the desktop application. We do not receive or store your Telegram password.
2.3 Payment Information
Payments may be processed by Waffo Pancake, GMPay, or another provider shown at Checkout. The payment provider receives the information needed to process the transaction. We receive order and payment-status information but do not store complete card numbers on our servers. Blockchain transactions may be publicly recorded on the relevant network.
3. How We Use Information and Legal Bases
| Purpose | Legal basis |
|---|---|
| Create accounts, authenticate users, and provide the Service | Performance of a contract |
| Process orders, payments, refunds, and activation codes | Performance of a contract |
| Enforce licenses, quotas, device limits, and anti-abuse controls | Performance of a contract / legitimate interests |
| Provide support and respond to requests | Performance of a contract / legitimate interests |
| Maintain security, prevent fraud, and troubleshoot failures | Legitimate interests / legal obligations |
| Comply with tax, accounting, consumer-protection, and other legal duties | Legal obligations |
| Send service, security, billing, and policy notices | Performance of a contract / legitimate interests |
We do not currently send marketing email. If we introduce marketing, we will request consent where required and provide an unsubscribe method.
4. Cookies and Tracking
The desktop application does not use browser cookies. The website uses strictly necessary cookies and similar storage for account sessions, authentication, security, language preferences, and core checkout functionality. We do not currently use advertising pixels or non-essential behavioral analytics.
Infrastructure providers such as Cloudflare and Supabase may process technical data as necessary to deliver, secure, and monitor the Service. If we add analytics or marketing tools in the future, we will update this policy and provide any required consent controls.
5. Sharing and Disclosure
We do not sell your personal information, including as "sale" is defined under applicable laws such as the CCPA. We share information only as necessary with:
- Cloudflare for hosting, content delivery, network security, and server operations.
- Supabase for authentication, database storage, account management, licenses, orders, and service configuration.
- Waffo Pancake, GMPay, or another payment provider shown at Checkout for payment processing, fraud prevention, refunds, and billing disputes.
- Telegram and related network services when you choose to connect or download content.
- Email or communication service providers used to deliver account verification, security, support, or service notices.
- Professional advisers, regulators, courts, or law-enforcement authorities when legally required or necessary to protect rights and safety.
- A successor entity in a merger, acquisition, financing, or sale of assets, subject to continued privacy protection.
Payment card data is handled by the applicable PCI-DSS-compliant payment provider, including Waffo Pancake where used, and is not stored on our servers.
6. Data Security
- Data in transit is protected using TLS/HTTPS.
- Passwords are managed using Supabase authentication and are not stored by us in plain text.
- Access to production systems is restricted to authorized operators using least-privilege controls.
- We use service logs, audit records, rate limits, device checks, and other controls to detect abuse and security incidents.
- Telegram session files remain on the user's device. We do not store your Telegram password.
If a security incident affects your rights or interests, we will investigate and provide notices required by applicable law, normally within 72 hours of confirming a reportable incident. No method of transmission or storage is completely secure.
7. Retention Periods
| Data type | Retention period | After retention |
|---|---|---|
| Account and license data | While active, then up to 90 days after a verified deletion request | Delete or anonymize |
| Orders, payments, refunds, and tax records | At least 3 years after the transaction, or longer if required by accounting or tax law | Delete or archive securely |
| Activation code and redemption records | Until expiry, redemption, or 3 years after issuance | Delete or anonymize |
| Support records | Up to 2 years after the request is closed | Delete securely |
| Security and server logs | Up to 180 days, unless needed for an investigation | Delete or aggregate |
| Essential session cookies | Session duration or up to 30 days | Expire or delete |
8. Your Privacy Rights
Subject to applicable law, you may request to:
- Know whether and why we process your personal information.
- Access, correct, or complete your information.
- Delete your account or personal information.
- Restrict or object to certain processing.
- Withdraw consent where processing is based on consent.
- Request a portable copy of your information.
- Receive an explanation of automated decisions where required by law.
Contact support@tg-downloader.com to exercise a right. We normally respond within 30 calendar days and may ask you to verify your identity. You may also complain to a competent data-protection or consumer-protection authority.
9. Marketing Communications
We do not currently send marketing messages. We may send necessary service notices such as verification, security, order, refund, license, and policy updates. If marketing is introduced, it will be based on consent where required, and you will be able to unsubscribe without affecting service notices.
10. International Data Transfers
Our service providers, including Cloudflare, Supabase, Waffo Pancake, GMPay, and communication providers, may process data in countries or regions outside China. We use contractual, organizational, and technical safeguards required by applicable law, and transfer data only when necessary to provide, secure, or support the Service.
11. Minors
The Service is intended for users aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact us and we will take appropriate steps to delete it.
12. Third-Party Links and Services
The Service may link to or integrate with third-party websites, payment services, Telegram, download infrastructure, or other providers. Their privacy practices are governed by their own policies. We are not responsible for how a third party collects or uses information outside our control.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in law, technology, data processing, or the Service. We will publish the new version and effective date on this page. For material changes, we will provide notice through the website, email, or in-app notice at least 15 days before the effective date where required.
14. Contact Us
Data controller: XIANG LISHUAI, individual operator, China.
Privacy, support, billing, and data-rights requests: support@tg-downloader.com
Website: https://tg-downloader.com