Privacy Policy
Last updated: May 12, 2026
What Unphurl is
Unphurl is a Telegram bot that checks links for scams before you click them. Send any link to @Unphurl_bot and it returns a report on what it found. Everything happens inside Telegram. There is no separate account registration, web dashboard, or login.
What we collect
Telegram ID: When you start the bot, your Telegram user ID is stored. This is a numeric identifier assigned by Telegram. We do not collect your name, username, phone number, or email address.
Usage data: We log which URLs were checked and when, keyed to your Telegram ID. This is used to track your monthly check count and produce your usage summary via the /stats command. We do not log full URLs with paths or query parameters in the reputation cache. The cache stores hostnames only (e.g., "example.com", not "example.com/page?token=abc").
Subscription data: If you upgrade to a paid plan, we store your plan tier, billing cycle, and credit usage. Payments are processed by Stripe. We do not store credit card numbers, bank details, or other payment credentials. Stripe's privacy policy governs how they handle payment data.
Technical data: Standard HTTP request metadata (IP address, user agent) is processed by Cloudflare as part of normal request handling. We do not store IP addresses in our database.
What we do NOT collect
- Email address or name. We have no signup form. No personal identification beyond your Telegram ID is collected.
- Page content. We do not download, store, or analyse the content behind a URL.
- Personal browsing history. We only analyse URLs you explicitly send to the bot.
- Advertising data. We do not use your data for ad targeting or sell it to third parties.
- Cookies. The bot and signal engine do not use cookies. The website uses Google Analytics (GA4), which uses its own cookies for anonymous traffic analytics.
The reputation cache
When a URL is checked for the first time, domain-level signals (age, SSL status, hosting infrastructure, DNS records) are cached so that subsequent checks return faster results without re-running the full pipeline. The cache stores:
- The hostname (not the full URL)
- Domain-level signals (not scores, which are computed per request)
- When the domain was first seen and last checked
- How many times the domain has been checked
Cache entries expire automatically based on domain age and risk level, ranging from 6 hours (brand new domains) to 7 days (confirmed high-risk domains). Clean results (score zero) are never cached. No personally identifiable information is stored in the cache.
How we use your data
- To operate the service (authenticate requests, track monthly check usage, deliver results)
- To improve the product (aggregate usage statistics, cache performance metrics)
- To process billing (Stripe handles payment, we store plan and credit state)
Data retention
Account data: Your Telegram ID, plan, and usage history are retained while your account is active. You can request deletion by contacting us at hi@unphurl.com.
Cache data: Domain signals expire automatically and are overwritten on subsequent checks. There is no permanent archive.
Analytics: Aggregate daily statistics (total URLs checked, pipeline runs) are retained indefinitely. These contain no personally identifiable information.
Third-party services
| Service | Purpose |
|---|---|
| Cloudflare | Hosting, CDN, DNS, database, email routing |
| Stripe | Payment processing |
| Telegram | Bot delivery and user interaction |
| Google Analytics | Anonymous website traffic analytics |
Data location
All data is processed and stored on Cloudflare's global network.
Your rights
- Access your usage data via the /stats and /account commands in the bot
- Delete your account and all associated data by contacting hi@unphurl.com
Children
Unphurl is not directed at children under 13. We do not knowingly collect personal information from children.
Changes
We may update this policy as the product evolves. Material changes will be noted with an updated date at the top of this page.
Contact
Questions about this privacy policy: hi@unphurl.com