Who we are
Bubblegram is a chat widget service that lets website owners receive visitor messages directly in Telegram. The service is operated by an individual developer ("we", "us", "our").
For data-related questions, contact us at bubblegram@protonmail.com.
What we collect
We collect only what is needed to run the service:
- Email address — provided by site visitors when sending a message, and by site owners when creating an account.
- Messages — the content visitors type into the chat widget.
- Session identifiers — short-lived tokens stored in your browser's localStorage to link messages to a session.
- Technical metadata — IP address (used for rate limiting only, not stored long-term) and browser type.
We do not collect names, phone numbers, payment card details, or any sensitive personal data beyond what is listed above.
Why we collect it
- To deliver messages from site visitors to site owners via Telegram.
- To associate replies from site owners back to the correct visitor session.
- To prevent abuse through rate limiting.
- To authenticate site owner accounts and secure API access.
Where your data is stored
All data is stored on servers located within the European Union. We do not transfer personal data outside the EU or EEA.
How long we keep your data
- Messages and session data are retained while the associated site owner account is active.
- When an account is deleted, all associated data is permanently removed within 30 days.
- IP addresses used for rate limiting are not stored beyond the current request window.
Third parties
We share message content with Telegram in order to deliver those messages to site owners. This is the core function of the service. Telegram's own privacy policy applies to data processed by their platform.
We do not sell, rent, or share your personal data with any other third party for marketing or profiling purposes.
Cookies and local storage
We use only essential session identifiers stored in the browser's localStorage. We do not use tracking cookies, advertising cookies, or any third-party analytics scripts.
Your rights (GDPR)
If you are located in the EU or EEA, you have the following rights under the General Data Protection Regulation:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on our legitimate interests.
To exercise any of these rights, email bubblegram@protonmail.com. We will respond within 30 days.
Security
Session tokens are cryptographically signed (HMAC). API keys are validated per request. Communications between the widget and our servers use HTTPS. We apply rate limiting to protect against abuse.
Changes to this policy
If we make material changes, we will update the date at the top of this page and notify site owners by email at least 14 days in advance.