Privacy Policy

Last updated: 2026-07-08. This is a plain-language summary, not legal advice for your situation — if you need advice about your own rights, consult a lawyer in your jurisdiction.

Who we are

StickerKit operates the @stickerkit_bot Telegram bot and the StickerKit Mini App at app.stickerkit.app. The data controller for the purposes of this policy is [OWNER: legal entity name and registered address]. You can reach us at [OWNER: privacy contact email] or via /support in the bot.

What we process, and why

• Your photo. When you send a photo to the bot, we pass it to Google's Gemini API to generate your sticker pack. It's held only in server memory for the roughly 30–90 seconds generation takes, is never written to disk, and is deleted regardless of whether generation succeeds, fails, or is cancelled. We don't train any model on your photo and we don't keep a database of faces.
• A short-lived photo reference. After your pack is delivered, we keep the Telegram file ID (a pointer Telegram uses to refer to your photo, not a copy of the image) for up to 60 minutes, so you can regenerate the pack or continue in the Mini App without re-uploading. It's deleted automatically once it expires.
• Your share card. The shareable image made from your stickers is kept in server memory for up to 2 hours, then deleted.
• Account and usage data, stored in our database: your Telegram user ID; how many packs you've created and their set names; your regeneration credits and daily streaks; referral relationships (who invited whom); whether you've allowed the bot to message you, and your language; your subscription expiry date, if any; gift codes you've bought or redeemed; which link brought you to the bot from this website; and a log of product events (your user ID plus an event name, e.g. "pack_created"). We don't collect your name, phone number, or email address.
• Payments. Purchases are made with Telegram Stars. Telegram processes the transaction — we never see or store your card, bank, or wallet details.

Our legal basis for processing (GDPR)

• Your explicit consent (Art. 9(2)(a) GDPR) to process the photo you upload, since a photo of a face can be treated as biometric / special-category data. You give this consent by choosing to send a photo to the bot, and you can withdraw it at any time simply by not sending another one — this has no effect on packs already generated.
• Performance of a contract (Art. 6(1)(b)) to deliver paid packs, gift codes, and subscriptions.
• Legitimate interest (Art. 6(1)(f)) to prevent abuse of free previews and regeneration credits, and to understand product usage through the event log.

Where your data is processed

Telegram (messaging and Stars payments) handles data under its own privacy policy. Google's Gemini API processes your photo transiently to generate stickers, which involves a transfer outside the EU/EEA to the United States, covered by Standard Contractual Clauses. OVH hosts our database and application servers in France, within the EU. Cloudflare provides CDN/DNS for the Mini App and may process technical connection metadata globally as part of that service. We may in future use additional AI providers — for example for animated stickers — under equivalent contractual safeguards. We don't sell your data or use it for third-party advertising.

How long we keep things

Photo: deleted the moment generation finishes, in every case. Photo reference (file ID): up to 60 minutes. Share card image: up to 2 hours. Database records (user ID, counters, referrals, event log): kept for as long as you use the bot, so features like streaks, referrals, and credits keep working — deleted on request, see below.

Your rights

If GDPR applies to you, you can ask us to access, correct, delete, or export your data, or to restrict or object to processing, and you can complain to the data protection authority in [OWNER: country where the operator is established] or your own country. Because most of what we hold is a handful of counters and identifiers tied to your Telegram ID — your photo is already gone — there's usually little to export, but you're welcome to ask. If you're in Brazil, you have equivalent rights under the LGPD; if you're in Russia, the same commitments above apply to you. Send any request via /support in the bot; we process these manually and confirm once done.

Children and other people in your photo

You must meet Telegram's own minimum age to use the bot at all. If you're a minor where you live, please get a parent's or guardian's permission before using StickerKit. Only upload a photo of another person — or of a minor — if you have their consent, or a parent's or guardian's consent, to turn it into a sticker pack. Don't upload photos of people who haven't agreed to this.

Security

We use industry-standard measures — encrypted connections, memory-only photo handling, and automatic deletion — to reduce risk. No system is perfectly secure; if we learn of a data breach affecting you, we'll notify affected users and, where required, the relevant regulator, in line with applicable law.

Changes to this policy

We'll update the date above whenever we make changes, and flag significant ones in the bot.

Contact

Questions or requests: /support in the bot, or [OWNER: privacy contact email].