Privacy Policy

Last updated: July 9, 2026

This Privacy Policy describes how APYbot ("we", "the Service") collects, uses, stores, and protects your personal data when you interact with the @DeFi_APY_bot Telegram bot and associated web endpoints at apybot.io.

We are strictly committed to data minimization, transparency, and full compliance with international data protection laws, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

1. Data We Collect

We collect only the minimal technical data strictly required to operate and maintain the Service:

Data Type	Source	Purpose
Telegram User ID	Telegram API	Unique identifier to link your account and settings
Telegram Username	Telegram API	Displayed in admin status/digest logs and support interactions
Watched Assets List	User input (`/watch`)	Stored in DB to deliver personalized APY spike alerts
Alert Threshold Setting	User input (`/settings`)	Personalizes alert trigger sensitivity (e.g., 5% or 10% change)
Subscription Tier & Expiry	Payment flows	Enforces Free vs. Paid plan limits and access durations
On-Chain Transaction Hashes & Sender Addresses	Alchemy Webhook / Viem	When paying with cryptocurrency (EVM/TRON), public `txHash` and `from` address are logged to verify payment and prevent replay attacks
Telegram Stars Payment Records	Telegram API	Verification of in-app subscription status and renewals
Sent Alert History	Automated engine	Tracks delivered notifications to enforce 24-hour cooldowns and prevent spam

Data We NEVER Collect

Your real name, physical address, email address, or phone number
Private keys, seed phrases, or custodial access to your crypto wallets
Your personal Telegram message history, chat lists, or contacts outside of direct bot commands
Location data or IP addresses during bot interaction

2. How We Use Your Data

We process collected technical data exclusively for the following operational purposes:

Delivering automated DeFi yield alerts when market APY fluctuates above your configured threshold
Managing user quotas, rate limits (5 commands per 10 seconds), and subscription eligibility
Preventing alert duplication via our 24-hour pool throttling engine
Verifying incoming cryptocurrency transfers and Telegram Stars receipts
Performing technical diagnostics, uptime monitoring, and error reporting (Sentry, Grafana metrics)

We never sell, rent, monetize, or transfer your personal data to advertisers or data brokers.

3. Data Retention and Deletion

Data Category	Retention Policy
Account Profile & Watchlist	Retained while active; permanently wiped upon `/delete`
Alert History (`sent_alerts`)	Automatically purged after a 90-day rolling window
Pool APY History (`pool_apy_history`)	Automatically purged after a 30-day rolling window
Payment Records (`crypto_payments`)	Retained for up to 2 years strictly for tax, accounting, and anti-fraud verification

4. Third-Party Processors and Infrastructure

To deliver reliable real-time monitoring, APYbot integrates with secure, industry-standard infrastructure providers:

Neon PostgreSQL (Serverless Database): All user watchlists and settings are stored in encrypted PostgreSQL databases (neon.tech/privacy).
DeFiLlama API: Public DeFi yield and pool statistics are queried continuously (defillama.com). No user data is ever transmitted to DeFiLlama.
Alchemy Webhooks: Used to monitor incoming on-chain cryptocurrency transfers (USDC/USDT) to verify paid subscriptions (alchemy.com/privacy).
Telegram Platform: Bot interactions operate within Telegram's encrypted messaging network (telegram.org/privacy).

5. Security Measures

We employ robust technical controls to secure your data against unauthorized access:

All database and external API communications use industry-standard TLS/SSL encryption.
Bot API tokens, database connection strings, and webhook secrets are injected via secure environment variables (.env) and never committed to source code.
Direct database access is strictly firewalled and limited to production compute nodes.

6. Your Rights Under GDPR & CCPA

If you reside in the European Economic Area (EEA), United Kingdom, or California, you hold complete control over your data:

Right to Erasure ("Right to Be Forgotten"): You can instantly and permanently delete your entire account, watchlist, custom settings, and alert history by sending the /delete command to the bot at any time. This action is self-service, immediate, and irreversible.
Right to Access & Portability: You may request an exported JSON summary of your account profile and watched assets via our support contact.
Right to Rectification: You can modify your watched assets (/unwatch, /watch) and threshold preferences (/settings) autonomously inside the bot.
Right to Object / Restriction: You may pause automated processing or notifications at any time by sending /cancel or stopping the bot.

7. Cookies and Web Tracking

APYbot operates primarily as a Telegram bot and minimal static web portal. We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral analytics on our landing or payment pages.

8. Children's Privacy

The Service is intended solely for individuals aged 18 and older. We do not knowingly collect or solicit data from minors under 18. If you believe a minor has accessed the Service, please contact support for immediate account removal.

9. Policy Updates

We reserve the right to revise this Privacy Policy periodically to reflect infrastructure or regulatory changes. Material revisions will be broadcast to active users inside the bot. Continued interaction with the bot after notification signifies acceptance of the updated terms.

10. Contact and Compliance Inquiries

For data subject access requests, GDPR/CCPA inquiries, or privacy-related questions:

Telegram Privacy & Support: @DeFi_APY_bot
Website: https://apybot.io/privacy