Privacy Policy

Last updated: April 5, 2026

FanLock ("we", "us", "our") operates as a platform enabling creators to sell exclusive content via Telegram Stars. This Privacy Policy explains what data we collect, why, and how we protect it.

1. Data We Collect

When you use FanLock through Telegram, we collect:

• Your Telegram user ID, first name, and username (provided by Telegram)
• Telegram file identifiers (file_id) referencing media you post as a creator — the actual photo and video files are stored on Telegram's servers, not ours
• Your profile avatar image, if you upload one (stored on Cloudflare R2)
• Purchase records (amount in Stars, subscription status) — actual payment processing is handled entirely by Telegram
• Subscription and purchase history
• Bot token you provide to connect your bot (encrypted at rest using AES-256-GCM)

2. How We Use Your Data

• To provide and operate the FanLock service
• To process payments via Telegram Stars
• To deliver content to authorized subscribers
• To send service-related notifications via your bot

3. Data Storage

We use the following infrastructure to store your data:

• Supabase (EU region) — stores your account data, purchase records, subscription history, and Telegram file identifiers
• Cloudflare R2 — stores creator profile avatars. Cloudflare's infrastructure is used solely for this purpose
• Telegram's servers — your media files (photos, videos) are hosted by Telegram. FanLock only stores the file identifiers Telegram provides; we do not copy or re-host your media

Bot tokens are stored in our Supabase database, encrypted using AES-256-GCM, and used solely to operate your bot. We do not sell or share your personal data with third parties for marketing purposes.

4. Payments

All payments are processed entirely by Telegram's Stars payment system. We do not store credit card numbers or payment credentials. Telegram's own Privacy Policy governs payment data.

5. Content

Media posted by creators (photos, videos) is hosted on Telegram's servers. FanLock stores only the Telegram file identifiers needed to deliver content to authorized subscribers — we do not copy, upload, or independently host your media files. Creator profile avatars are an exception: these are stored on Cloudflare R2 and can be deleted by the creator at any time. Creators are solely responsible for ensuring they have rights to all content they post and that it complies with applicable laws.

6. Adult Content

FanLock may be used to distribute age-restricted content. By using the platform, creators confirm they are 18+ and that all persons depicted in content are 18+ and have consented. We reserve the right to suspend accounts that violate this policy.

7. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data by contacting us.

8. Your Rights

You have the right to access, correct, or delete your personal data. Contact us at the address below.

9. Third-Party Processors

We use the following third-party services to operate FanLock:

• Supabase — database and authentication (EU region)
• Cloudflare R2 — avatar image storage
• Telegram — messaging, payments, and media hosting

Each of these providers operates under their own privacy policy and data processing terms.

10. Contact

For privacy-related questions: privacy@fanlock.app

FanLock · Terms of Service