Privacy Policy

This policy explains what Miss Lucy stores, why, who can see it, how long it is kept, and how to delete it. It applies to the Telegram bot @MissLucy_bot, its Mini App, the web console at app.misslucytg.com, and this website.

Miss Lucy is operated by Chris Watson (“we”, “us”). For any privacy question or request, write to @MissLucySupport.

This policy replaces Telegram’s Standard Bot Privacy Policy for Miss Lucy. Telegram’s own Privacy Policy covers what Telegram itself does.

The short version

• Lucy protects Telegram groups from spam. She stores what she needs to spot spam, to show admins why she held someone, and to keep a record of moderation decisions.
• Lucy does not keep an archive of your group’s messages. She keeps a copy of a message only when she removes it or when a member reports it, and only for 90 days.
• Lucy never bans anyone on her own. She mutes and holds. A person decides.
• We do not sell data, show ads, or use your messages to build datasets or train AI models.
• You can delete your data at any time: send /deletemydata to @MissLucy_bot.

Who this policy covers

• Members of Telegram groups where Lucy is an admin.
• Admins who manage groups with Lucy, in Telegram, in the Mini App, or in the web console.
• People who pay for Premium.
• Visitors to misslucytg.com.

What Lucy stores, and why

Your Telegram profile

When you join or write in a group where Lucy is active, or when you message Lucy directly, she receives your Telegram user ID, name, username, language, and whether you have Telegram Premium. She can also read your bio and how many profile photos you have.

Why: new or empty accounts are a common sign of spam, and admins need to see who Lucy held.

Detection records

For each join, message, or reaction that Lucy checks, she stores the score and the reasons for it. A reason can include a short fragment, such as the address of a link or a phrase that matched a spam pattern. She also stores a one-way fingerprint (hash) of message text. A fingerprint cannot be turned back into the message. It lets Lucy recognize the same spam message posted in several groups.

Why: to explain every hold to admins and to catch repeated spam.

Lucy does not store the full text of ordinary messages.

Evidence of holds and reports

When Lucy holds a member, or when a member reports a message, Lucy stores:

• A copy of the message text that she removed or that was reported.
• Details about any attached media: its type, size, duration, file name, and Telegram file ID. She does not store the media file itself.
• The score, the reasons, any note the held member sent, and the admin’s decision.

Why: admins need the evidence to decide, and to undo a decision later.

Lucy sends admins an evidence card. The card can show the member’s profile photo, name, username, ID, bio, the reasons, and the removed message or a small preview of its media. Media that Lucy flags as adult content is blurred on the card. Lucy creates these images when she sends a card and does not keep them. Telegram keeps the sent card in the admins’ chats.

Moderation records

Lucy stores the warnings, mutes, bans, and releases that admins decide, who decided them, the reason they picked, and any note they typed. She keeps an audit log of admin actions in each group.

Why: groups need a record of their moderation, and members can only be released or unbanned if that record exists.

Reputation across groups

When admins confirm a moderation action against someone, Lucy can count it toward that person’s standing across Lucy’s groups. Automated holds and CAPTCHA results never count. Other groups see counts and reason categories, such as “spam”. They never see the other group’s name or the admin’s note. A group can turn reputation sharing off.

You can see your own standing: send /status to @MissLucy_bot.

Why: a known spammer who moves from group to group can be held sooner.

Guilds

Admins can link groups into a guild and share bans across them. A guild ban carries the reason category, the admin who made it, and the group where it started.

CAPTCHA and the location check

• Picture puzzles: Lucy stores which puzzle you got, your answers, and how long you took.
• Location check: a group can allow or block members by country. If it does, Lucy asks you to share a location in a private chat. She converts it on her own server into a country and region code and stores only those codes. She never stores the coordinates. Your shared location message stays in your private chat with Lucy, and you can delete it there.

Group activity statistics (Insights)

Lucy counts activity in each group so admins can see how the group is doing: messages per hour by type, reactions by emoji, joins and leaves, and which invite link each member used to join. For each member she stores daily counts: messages sent, reactions given and received, and the times of their first and last message that day.

These statistics hold numbers only, never message text. Only the group’s admins can see them.

Admins and app sessions

For admins, Lucy stores which groups they manage, their settings, and their notification and language choices. When you sign in to the web console, Lucy stores a session record: a hashed token, your user ID, and timestamps. The Mini App and the web console keep your session token and language choice in your browser’s local storage. They use no cookies.

AI tools that admins connect

An admin of a Premium group can connect an AI tool, such as Claude Code, Codex, or Claude, to Lucy. When you do, Lucy sends that tool the same group data that the console shows you. Your AI provider then handles that data under your own agreement with the provider. Lucy does not keep the inputs or outputs of the tool. Lucy keeps a record of each connection (who connected it, its scopes, and the times) until 30 days after the connection ends. /deletemydata deletes these records.

Why: admins can manage their groups from the tool they prefer, and can see and end every connection.

Payments

Premium is paid in Telegram Stars. Lucy stores the payment and subscription IDs, the payer’s user ID, the group, the amount, the dates, and any refund. We never see card or bank details. Telegram handles the payment.

Links, referrals, and usage

• If you start Lucy from a campaign link, Lucy stores which link it was, and the group you add her to inherits it. This tells us which links bring new groups. It never affects detection or reputation.
• If you join the affiliate program, Lucy stores the commissions you earn from the groups you referred.
• If we invite you to label messages, Lucy stores your user ID and your labels.
• For features that use an AI model, Lucy stores which feature ran, for which group and user, and its cost. She does not store the content.

Questions to Lucy

When you use /ask, Lucy sends your question to an AI model to write the answer. She does not store your question.

The website

misslucytg.com sets no cookies and has no analytics or tracking. Our hosting provider, Cloudflare, can process your IP address to deliver the site and protect it from attacks.

Datasets

Earlier versions of Lucy kept copies of held and reported messages, and an optional sample of ordinary messages, to test her spam detection. We stopped this collection. The copies that remain are deleted within 90 days of this change. We do not use your messages to build datasets or to train AI models.

Automated decisions

Lucy scores members and messages automatically, and she can mute and hold a member on her own. She cannot ban. Every ban comes from a person, and every hold can be released by an admin.

Services that process data for us

We send data to other services only when a feature needs it:

These services process the data to give us a result. Their own terms govern how they handle it. We do not ask them to keep it.

We also share data:

• With the admins of a group, about that group’s members, as this policy describes.
• With Telegram, because Lucy runs on Telegram.
• When the law requires it, in response to a valid legal request.

How long we keep data

Deleted data can stay in our database backups until those backups are replaced.

Your rights

• Delete your data. Send /deletemydata to @MissLucy_bot. Lucy deletes your cached profile, detection records, fingerprints, activity statistics, CAPTCHA and location data, AI tool connections, and any dataset copies at once. She keeps two kinds of data:
  • Moderation records about you (holds, reports, warnings, bans, and reputation) until their normal period above ends, because groups rely on them to stay safe.
  • Payment records, because tax law requires them.
• Get a copy of your data. Write to @MissLucySupport. We answer within 30 days.
• Correct or object. Write to @MissLucySupport if something is wrong, or if you object to how we use your data.
• Remove Lucy from your group. If you are an admin, removing Lucy stops all collection in that group. Its settings and statistics are deleted 60 days later.
• Complain. You can complain to the data protection authority where you live.

Security

Only the operator can access the servers and the database. The app checks that you are an admin of a group before it shows you anything about that group. Session tokens are stored as hashes. If a breach affects your data, we tell you as the law requires.

Age

Miss Lucy is for people who meet Telegram’s age requirements.

Changes to this policy

When we change this policy, we update the date at the top. For significant changes, we tell group admins through the bot or the app before the change applies.

Contact

Write to @MissLucySupport on Telegram. In the bot, send /privacy to see this policy.