Privacy
What Cookiebot stores, what it does not, and who is responsible for it
/privacyAlso /privacidade and /privacidad. The bot replies in chat with a link to
the policy for the deployment you are talking to.
This page describes what the software stores. Whoever runs a given deployment decides where that database lives and how long anything is kept — see Who is responsible.
What is stored
| Why | |
|---|---|
| Group settings | Everything on the configure page, per group |
| The group's own text | The welcome message and the rules an admin set |
| Group membership | Who is in the group, who is an admin, and when someone joined — the join time is what the media hold counts from |
| Accounts seen | Telegram id, username, display name, language, and a birthday if a member registers one |
| Media the group sent | Stored so features like /random can post it back, with a note of who uploaded it |
| Short-lived moderation state | Captcha challenges in flight, recent sticker counts. Minutes, not months |
| Activity metadata | One row per event: when, which group, which member, which command, whether it succeeded, how long it took |
What is not
- Message text. The activity rows record that a message or command happened, not what it said. The bot is not a logger and keeps no transcript.
- Anything from groups it is not in, and nothing from private chats beyond what is needed to answer the command you sent.
- Anything shared between groups. Settings, membership and moderation state are per group; someone removed from one group arrives in the next with a clean slate.
What leaves the deployment
Some features are lookups against someone else's service, and those calls carry what the feature needs to work:
| Feature | What is sent, and where |
|---|---|
| Talking to the bot | The text of the message that mentioned or replied to it, to the operator's configured model provider |
Voice replies and /transcribe | The voice note's audio, to the transcription provider |
| Music recognition | The voice note's audio, for fingerprinting — off unless the operator turned it on |
/searchsource | The image bytes, to the reverse-search service |
| Unknown commands | The words you typed, to Google Images |
/age, /gender | The name you typed, to agify.io / genderize.io |
| Joiner screening | The joining account's id, to the anti-spam services |
None of it is retained by the bot beyond the reply. Which providers those are is the operator's choice — see AI features.
Getting rid of it
- Remove the bot from the group. Its access ends immediately — it stops receiving updates the moment it stops being a member.
- Ask the group's operator. Deletion of what is already stored is theirs to
perform;
/privacypoints at the policy that says how.
Who is responsible
Cookiebot is self-hosted software. The operator who runs a deployment is the data controller for it: their infrastructure, their retention period, their jurisdiction. The bot's code cannot answer those questions, and this page does not try to.
Running a deployment yourself? The database schema is the honest answer to "what is kept" — it is in the repository, and the architecture page explains the shape.