PR Agents Privacy Policy

Applies to

The PR Agents Telegram bot and its companion Telegram Mini App

Operator

Arpan Patra, an individual developer

Contact

thispc119@gmail.com

1. Who runs this service

PR Agents is built and run by Arpan Patra, an individual developer, not a company. The service is free, takes no payments, and is in early release. For the purposes of India's Digital Personal Data Protection Act 2023 (DPDP) and the EU GDPR, the operator is the data fiduciary / controller for the data described here.

PR Agents is a Telegram bot and a companion Telegram Mini App that let you record and retrieve your own daily life: work you have done, private notes, reminders, money in and out, meals with estimated nutrition, and personal goals. The main way to use it is your voice: you speak, the words are transcribed, and the interpretation is shown to you for confirmation before anything is saved.

2. Your identity and account

There is no separate signup, no password, and no email address. Your identity comes from Telegram. The service stores your Telegram numeric user ID, your first name, your last name if you have set one, and your username if you have set one.

The Mini App signs you in by validating the signed initData that Telegram provides, and then issuing its own session that expires after a limited time.

Your records are strictly scoped to your own Telegram identity. Every read and write is filtered by owner, and this is covered by automated tests. No user can read another user's records.

3. What the service stores

Things you deliberately choose to record:

Two of those deserve to be called out plainly. Financial entries are personal financial information and meal records are health adjacent information. They are stored because you asked the service to remember them, they are visible only to you, and they are covered by the same export and deletion controls as everything else.

The service also keeps a small amount of operational data to work at all:

• your preferences, including your timezone and digest settings;
• your application sessions;
• Telegram chat IDs and message IDs, used to schedule tidying up of processed messages; the message contents are not stored for this purpose, only the identifiers;
• assistant run records: a one way hash of the request, which provider and model handled it, the status, timestamps and a coarse error category. The raw text of what you said is not stored in these logs;
• counters used for rate limiting.

4. What it never stores

• No password (there isn't one).
• No email address and no phone number.
• No payment details. The service is free and takes no payments.
• No location data.
• No advertising or analytics identifiers.
• No voice audio. See section 5.

5. Voice notes and your audio

When you send a voice message, this is the whole life of that recording:

• the audio file is downloaded from Telegram into temporary storage;
• it is sent to Groq for transcription (Whisper);
• it is deleted immediately afterwards, including when transcription fails.

Only the resulting text is kept, and only as part of a record you chose to save. The audio itself is never retained by this service.

6. How the AI reads your requests

Your request is interpreted by a large language model, which proposes an action. That capability is deliberately bounded:

• the model can only propose actions from a fixed allowlist: creating, reading, editing or deleting your own records;
• it cannot send messages to other people, make payments, browse the web, or reach any external service;
• anything that writes or deletes data is shown to you for explicit confirmation before it happens;
• interpretation can be wrong. The confirmation step exists precisely for that reason, so please do read what it proposes before you accept it.

7. Nutrition estimates

Calorie and protein figures are produced by a language model from an ordinary description of a meal. They are approximations, not measurements, and they are not medical or dietary advice. Please do not rely on them for medical decisions, and speak to a qualified professional for anything that matters to your health. The service shows you the assumptions behind each estimate so you can judge how far to trust it.

8. Who else your data reaches

No personal data is sold, rented, or shared for advertising. There is no advertising in this product. Each provider above processes data under its own privacy policy and its own terms.

9. How long data is kept

• Your records are kept until you delete them or delete your account. There is no automatic expiry of your own content.
• Processed Telegram messages are queued for deletion from the chat about an hour after processing, unless you pin them. This tidies the conversation; it does not delete the stored record.
• Operational metadata, such as completed delivery and cleanup rows, is pruned on a rolling window, currently 30 days.
• Temporary voice audio is deleted immediately after transcription.

10. Your rights

You have the right to access, correct, export and erase your data, and to withdraw your consent. Here is how to actually use each one:

Deletion requires a recent authentication, so that nobody can wipe your data from an abandoned session.

11. Legal basis and consent

Processing is based on your consent, which you give by choosing to send a message to the bot and to save a record. That consent is specific to operating this service for you (recording, retrieving and managing your own entries), and it is withdrawable at any time by deleting your account.

In particular, by using the service you are consenting to the purposes described in section 3 and to the transfer of your voice and text to the AI provider described in sections 5, 6 and 8. That transfer is the part most worth being deliberate about, which is why it is stated in three places rather than buried once.

12. Age requirement

This service is not intended for anyone under 18. Under the DPDP Act, processing a child's data requires verifiable parental consent, which this service does not implement. Please do not use PR Agents if you are under 18.

13. Security

What is actually in place:

• traffic is served over HTTPS;
• the Telegram webhook is authenticated with a secret header;
• Mini App sessions are signed and expire;
• records are scoped per user at the database query level, with automated tests that check one user cannot reach another's data;
• the bot only operates in one to one chats and refuses group chats, so your records cannot be printed into a shared conversation;
• secrets are held as masked environment variables, not in source control.

No service can guarantee absolute security, and this one does not pretend otherwise.

14. Service reliability

PR Agents runs on free hosting tiers and is in early release. Reminders and scheduled summaries are best effort and can be delayed. Please do not depend on this service for time critical or safety critical reminders, such as medication, medical appointments, or anything where a missed or late message would cause harm.

15. Changes to this policy

If this policy changes, the updated version will be published at this same address with a new "Last updated" date. Material changes will also be announced through the bot.

16. Contact and complaints

Questions about this policy or about your data:

If you are not satisfied with how a request has been handled, you may complain to a regulator. If you are in India, that is the Data Protection Board of India under the Digital Personal Data Protection Act 2023. If you are in the EU or EEA, it is your local supervisory authority.