Do you have a Privacy Policy?
Yes. The policy is published in full at telegram.org/privacy, and unlike most policies of its kind it is written to be read rather than to be scrolled past.
What it actually tells you
- What is stored. Cloud chats, contacts you chose to sync, and the basic account details needed to deliver messages to your devices.
- What is not stored. Secret Chat content never reaches a server in readable form, because the keys stay on the two devices involved.
- Who can request it. The conditions under which any data could be disclosed, and the transparency reporting around those requests.
- How long things live. What is deleted when you delete a message, a chat, or the whole account.
The rights you can exercise today
- Export everything. Open Settings, then Advanced, then Export Telegram Data. You choose which categories to include and receive a browsable archive.
- Delete the account. Deleting removes your messages from the cloud along with the account itself. This cannot be undone.
- Set an inactivity timer. Settings, Privacy and Security, Delete My Account If Away For. If you stop using Telegram for the period you pick, the account removes itself automatically.
Cloud chats and Secret Chats are not the same promise
This is the part people most often miss. Ordinary cloud chats are encrypted in transit and at rest, and they sync to every device you own, which is why they can be restored when you get a new phone. Secret Chats are end-to-end encrypted, tied to one device, and leave nothing behind on a server. If your threat model requires that no copy exists anywhere but the two handsets, you want a Secret Chat, not a cloud chat.
The GDPR section is worth reading if you are in the European Union. It sets out the legal basis for each category of processing and how to contact the data protection representative.