What Your Telegram Metadata Reveals About You
Every message has two parts. There is what it says, and there is everything around it: who sent it, to whom, at what time, from which network, and how often the same two people have written to each other before. The first part is the content. The second part is called metadata, and it travels even when the content is hidden.
Step 005 showed that encryption protects the content on its way between places. Metadata is the envelope, and the envelope has to be readable for the letter to arrive. Who, when and how often can say a great deal about a person without a single word of what they wrote. This step lists what the envelope contains on Telegram, who gets to read which part of it, and the few settings that make it thinner.
What you will be able to do after this step
- check_circle Name the kinds of metadata your account produces, apart from the messages themselves.
- check_circle Say which of it the other person, a group, Telegram and your network can each see.
- check_circle Reduce the parts you control, and know which parts no setting can remove.
drafts What is on the envelope
None of the following is the text of a message. All of it can exist without anyone reading one.
- Who you talk to. The list of people, groups and channels you exchange messages with, and which of them you write to most. Telegram keeps a rating of the people you message often so it can show them at the top of search.
- When and how often. The time of each message, the rhythm of a conversation, the nights it runs late, the weeks it goes quiet. For calls, when they happened and how long they lasted.
- Where from. The network address your app connects from, which points to a country and often a city, and the devices and apps you use. Telegram's privacy policy says it may collect this for security and anti-spam purposes and keep it for up to twelve months.
- What you belong to. The groups and channels you are in. Every member of a group can see who else is in it, unless the admins hide the member list.
- Who is in your phone. If you allowed contact sync, the names and numbers in your address book, stored so Telegram can tell you when one of them joins.
- What your profile shows. Your phone number, username, photo, bio and last seen time, each to the audience your privacy settings allow.
Each item on its own looks harmless. Put together, they answer questions nobody wrote down: who you are close to, where you were last week, what hours you keep, which communities you are part of.
What the content says, and what the envelope says
The left column is all that encryption hides. The right column is what is left over.
lock The content
"Can we move tomorrow to the afternoon?"
One sentence. It names no person, no place and no reason.
In a Secret Chat, not even Telegram's servers could read it.
visibility The envelope
Sent at 23:48, to the same person you have written to every night this month.
From a hotel network in a city you do not live in.
Followed by a call that lasted forty minutes.
Both of you are members of the same three private groups.
The sentence says almost nothing. The envelope tells a story the sentence never mentions.
Who can read which part of the envelope
Metadata is not one pile that someone either has or does not. Each audience sees a different slice. Pick one.
Everything about the conversation itself
The person you write to always knows that you wrote, when, and from which account. Beyond that, they may see when you were last online, whether you read their message and when, and the typing indicator while you write, which also shows that you started a reply and stopped.
Last seen and read times are yours to limit, under Last Seen & Online in your privacy settings. Both work in both directions: hide yours from someone and, unless you pay for Premium, you stop seeing theirs. The typing indicator cannot be switched off.
The other person is the one audience no setting removes. They were there.
Your membership, and everything you post
Joining a group tells its other members that you are in it. They can see your name, photo and username, and in smaller groups, who has read a message for a while after it was sent. Anything you post there carries your name and time, and in a public group it stays readable by anyone who finds it.
Membership is also a clue on its own. Someone who opens your profile can see the groups the two of you share. A list of the communities a person belongs to often says more about them than anything they post.
Before joining a group under your main account, ask who else will see you there.
What the service needs to deliver, and what it keeps
To deliver anything, Telegram's servers must know which account is sending to which, and the network address the app connects from. The privacy policy says Telegram may collect metadata such as your IP address, devices and apps used, and the history of username changes, and keep it for up to twelve months. Synced contacts are stored as names and numbers only.
Secret Chats change this picture more than people expect. Telegram says it keeps no logs for messages in Secret Chats, so after a short time it no longer knows who you messaged there or when. The policy also says that on a valid court order in certain criminal cases, Telegram may disclose an IP address and phone number, and publishes such cases in a transparency report.
Telegram sees the routes of your cloud chats, and much less for Secret Chats.
That you use Telegram, when, and how much
Your mobile carrier, your home internet provider or the Wi-Fi at a cafe can see that your device is talking to Telegram, at what times and how much data moves. Because the connection is encrypted, they cannot see who you are messaging or what you send.
A proxy or VPN moves this slice to someone else: the network sees you connect to the proxy, and the proxy operator sees you connect to Telegram. That helps where Telegram is blocked or watched. It does not change what the other person, your groups or Telegram see.
A proxy chooses who watches the line; it does not make the envelope disappear.
visibility_off What you can make thinner, and what you cannot
Some metadata is optional. Telegram asks before syncing contacts, lets you limit who sees your number and last seen time, and lets you turn off the frequent-contacts rating. Other metadata is the price of the service working at all: a message cannot be delivered without an address, and a conversation cannot happen without the other person knowing it happened.
That split decides what to do. Settings can shrink the audience for your profile. They cannot hide the shape of your conversations from the people in them. When the shape itself is sensitive, the protection is choosing where the conversation happens and under which account, not a switch in Settings.
- Deleting messages does not delete the pattern. An auto-delete timer removes the text; the other person still knows you talked, and anyone who saw a notification still saw it.
- A second account separates groups of people, not devices. Step 005 of the Account track covers when a separate account actually keeps two parts of your life apart.
- Forwarding carries your name. A forwarded message shows who wrote it. The Forwarded Messages privacy setting controls whether that name links back to your account.
touch_app Try it now — ten minutes
Every one of these lives under Settings > Privacy and Security. On iPhone, Settings is the tab at the bottom; on Android and Telegram Desktop, open the menu first.
- Choose who sees your last seen time Open Last Seen & Online. Decide between Everybody, My Contacts and Nobody, and add exceptions for people who should always or never see it. Consider Hide read time if you choose to hide it.
- Close both phone number doors Under Phone Number, choose who can see your number, and, when you pick Nobody, who can find you by it. The second question matters more.
- Review contact sync on your phone On a phone, open Data Settings. If you do not need Telegram to know your address book, turn off Sync Contacts and delete the synced contacts from the server.
- Turn off the frequent-contacts rating Suggest Frequent Contacts is in the same place. Turning it off stops the People row in search and clears the rating.
- Look at your profile as a stranger Check Profile Photos, Bio and Forwarded Messages. Each one can be limited to your contacts.
How the last seen options work, why hiding yours hides theirs, what "recently" and "within a week" mean, and how to answer the questions that make people watch each other's status.
help Questions
Does a Secret Chat hide my metadata?
Partly. Telegram says it keeps no logs for Secret Chat messages, so after a short time it no longer knows who you messaged there or when. Your account, your device's connection and your network address still exist, and the other person still sees everything about the conversation. A Secret Chat hides a lot from the service, and nothing from the person you are talking to.
Can Telegram see my exact location?
Not from ordinary use. A network address usually points to a country and often a city, not a street. Your precise location is shared only when you send a location or a live location yourself. Calls are a separate case: a direct connection can show the other person your network address, which Beginner Basics Step 31 explains.
Can a stranger see which groups I am in?
There is no list of your groups that anyone can open. Members of each group can see that you are in that group, unless the member list is hidden, and anyone who opens your profile can see the groups you have in common with them. Public groups are visible to anyone who joins them.
If I delete my contacts from Telegram, will my chats disappear?
No. Deleting synced contacts removes the names and numbers Telegram stored from your address book. Your conversations stay where they are. People who are no longer in your synced contacts may be shown by their Telegram name instead of the name you saved for them.
The envelope is readable
Who can read which part of the envelope around your messages: the other person, your groups, Telegram and your network. Tap to open it at full resolution.
