BAIchat Privacy Policy

1. About BAIchat

BAIchat ("we", "our", or "the Service") is an AI character chatbot platform available as a Telegram Mini App and as a web application at baichat.app. BAIchat is an independent third-party service and is not affiliated with, maintained, or endorsed by Telegram.

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from users under 18. If we become aware that such data was provided, we will delete it and terminate the account. See the User Agreement for eligibility terms.

2. Information We Collect

2.1. Information from Telegram (Telegram users only)

When you use BAIchat through Telegram, we receive from Telegram:

Telegram User ID (used as your unique identifier)
First name and username (if set)
Language preference
Platform information (device type, Telegram version)

2.2. Information from Web Registration (Web users only)

When you register or sign in via baichat.app, we collect:

Email/password sign-up: email address and first name. Passwords are not stored by us — they are managed by WorkOS.
Google OAuth: email address and display name as provided by Google. We do not receive your Google password.
A session token (JWT) stored in the browser to maintain login state.

2.3. Information You Provide

Chat messages sent to AI characters
Custom characters and scenarios you create
Appearance descriptions and other content you enter
App settings and preferences

2.4. Automatically Collected Information

Usage statistics (features used, session duration)
Token balance and transaction history
Interaction counts with characters
Error logs and diagnostic data
IP address and browser/device information (web users)
Analytics identifiers (see Sections 2.5 and 5)

2.5. Analytics and Advertising Identifiers (Web)

On the web version we may collect or store:

Yandex Metrica ClientId
Yandex Direct click identifier (yclid), if present in the URL
Behavioral and technical data collected by Yandex Metrica and Amplitude (page views, clicks, bounce, device/browser data)

After you sign in, we may associate these identifiers with your account for analytics and advertising attribution.

3. How We Use Your Information

We use collected information to:

Provide and operate the Service (chats, history, account features)
Authenticate you and maintain sessions
Process and record token purchases and balances
Analyze usage, fix bugs, and improve the Service
Measure advertising effectiveness and attribute sign-ups or purchases (including via Yandex Metrica / Yandex Direct)
Provide user support

4. Data Storage and Security

Your data is stored on our servers. Measures include:

Access to user data limited to necessary system operations
Chat histories and personal information stored per user
Passwords managed by WorkOS, not stored by us
Web session tokens signed with a secret key and expiring after 7 days
Reasonable technical measures to protect data

Conversation data is stored to provide persistent chat history. Absolute security of data transmitted over the internet is not guaranteed. Additional risk allocation is set out in the User Agreement.

5. Data Sharing and Third Parties

5.1. No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their independent marketing.

5.2. Third-Party Services We Use

AI Processing: Your messages are sent to AI model providers to generate responses. Processing is performed to deliver the Service. Those providers process data under their own terms.
Authentication — WorkOS (web): Account creation and authentication. WorkOS may store your email and (for email/password accounts) a hashed password. See the WorkOS Privacy Policy.
Google OAuth (web, if you choose Google sign-in): Google shares email and name according to the permissions you grant. See Google's Privacy Policy.
Amplitude Analytics: Used to understand app usage and improve features. Analytics data does not include message contents. On the web, Amplitude is initialized after authentication.
Yandex Metrica (web): Used for usage analytics and advertising attribution. The counter may load on web pages before you sign in. It collects behavioral and technical data, sets its own cookies, and provides a ClientId. We may store ClientId and yclid (when available) and associate them with your account after sign-in. Processing by Yandex is governed by the Yandex Metrica Terms of Use and related Yandex privacy documents.
Payment Processing — Platega and Telegram: Card, SBP, cryptocurrency, and Telegram Stars payments are processed by the relevant payment provider. We do not store your full card details. Payment providers process payment data under their own rules. We store payment amounts, method, status, timestamps, and related transaction identifiers needed for your balance and support.

5.3. Legal Requirements

We may disclose your information if required by law, court order, or governmental request.

6. Cookies and Local Storage

The web version uses browser local storage and third-party cookies/technologies as follows:

Authentication session: signed JWT in local storage (up to 7 days)
Language and UI preferences: stored locally
Yandex Metrica: cookies set by Yandex; ClientId and (if present) yclid stored in local storage for attribution

You can clear local storage and cookies through your browser. Clearing them may log you out and reset analytics identifiers.

7. Your Rights

Access: Request a copy of personal data we store about you
Deletion: Request deletion of your account and associated data
Correction: Update information through app settings where available
Data Portability: Request a copy of your data in a machine-readable format (provided upon request if technically feasible for the Service)
Stop using: Stop using the Service at any time

To exercise these rights, contact us through the Telegram bot or at support@baichat.app (see Section 11).

8. Data Retention

We retain data while your account is active
You may request full account deletion at any time
Upon a deletion request, personal data is permanently removed within 30 days
Anonymized usage statistics may be retained for service improvement
Payment and legal records may be retained as required for accounting, disputes, or law

9. International Data Transfers

By using BAIchat, you consent to transfer of your data to servers that may be located outside your country of residence, including countries with different data protection standards.

10. Changes to This Policy

We may update this Privacy Policy by posting a new version on this page with an updated "Last Updated" date. Continued use of BAIchat after changes constitutes acceptance of the updated policy.

11. Contact Us

Through the Bot: /help in the Telegram bot
Email: support@baichat.app

We will respond to requests within 30 days. Copyright complaints: dmca@baichat.app (see User Agreement).