Privacy

What we record

Tibyar asks for no account, no name and no email. But running the site and protecting it require recording a few things:

Network address (IP)

We do not keep your network address. The moment it arrives we turn it into a short fingerprint using a secret key, and keep the fingerprint alone.

To be honest about it: a fingerprint is not fully anonymous. Whoever holds the key can match it against an address they already suspect. The real protection is how briefly we keep it, not the hashing — so we say that plainly rather than dress it up.

In the security log alone we also keep the network range (the first three parts of the address), because abuse cannot be reported from a fingerprint.

The Telegram bot

The bot (@Tibyar_bot) works inside Telegram. It asks for no account, no email and no phone number. Telegram sends us your name and username with every message; we neither read nor store them.

What we keep about a conversation: the chat id Telegram assigns it, the language you chose, the network you picked, a count of the scans you ran, the number of the message the keyboard is drawn on, and the time zone you set yourself with the "set my time" button — the time zone name alone, as your device reports it. No location and no network address.

Addresses scanned through the bot are stored as site scans are, but tied to the chat id instead of a visit cookie. When the chat record is deleted, its id is detached from those addresses and they are left without an owner — exactly what happens to site scans when the visit cookie is deleted.

Chat data is deleted in the first cleanup cycle after 30 days from your last use, exactly like a website visitor — and /forget deletes it at once. Inside the bot: it shows you what is about to be deleted, along with links to your paid reports so you can save them, then waits for your confirmation. On confirmation it wipes the chat record, detaches its id from every paid invoice, and deletes unpaid invoices outright — so the bot no longer knows you bought a report. The link stays, and whoever holds it can open it. The scan record itself stays, because deleting it would delete a paid report that may be in someone else's hands.

When you write to support

You have three routes: a message inside the bot from the "contact us" button, an email to support@tibyar.com, or the inbox on your account page (tibyar.com/account) once you have connected your wallet. All three reach support, and the reply comes back the way the message came.

For the bot and for email we store neither your message text nor its attachments. A bot message stays in Telegram, and an email stays with the mail provider that receives it for us, which keeps us one routing line: the number of the message that reached us, and where to reply — the chat number in Telegram, or your email address if you wrote by email — along with the subject line you typed.

Your email address is the one new thing we keep about you: we store it with the subject line as you wrote it (up to 200 characters) and the language you wrote in — no name, no message text, no network address. And the bot stores no subject at all. The routing line is deleted in the first cleanup cycle after thirty days, like everything else — after which a reply can no longer reach an older message, and the system says so plainly instead of appearing to have sent it.

The account-page inbox is the one place a conversation is stored: the messages you send and the answers you get are written down, under your public wallet address, so that you can open the page later and read the answer. They are deleted 90 days after they were written. That page stores no name, no email and nothing else about you.

The Telegram link is optional and one-directional in what it costs you: if you ask for it, we write your wallet address beside the chat id Telegram gives your conversation, so a support reply also reaches you in Telegram. It stays until you cut it from the same page, where the button to cut it sits under the one that made it. Nothing about the account page needs it.

/forget deletes the routing lines for your chat too, not only the chat record.

Why

The legal basis is our legitimate interest in running, protecting and improving the service: knowing when a scan fails, preventing anyone who tries to exhaust the service, and making sure every paid report reaches the person who paid for it.

We do not use this data to target ads at you, we hand it to no ad network, and we send no promotional messages based on it. The campaign tags above only tell us which of our announcements are worth repeating.

How long it stays

Ordinary visit records: 30 days.

Security records: 90 days, because an attack pattern is only readable across weeks.

The visit cookie in full: 30 days from the last visit, and the link between the visitor and the addresses they scanned goes with it.

Support messages written from your account page: 90 days, because they are your own record of the conversation rather than our routing convenience.

Your Telegram link: until you cut it. It carries no expiry on purpose — a link that disappeared by itself would be a surprise, and the button that removes it is on the page that made it.

These are ceilings, not exact moments of deletion: deletion runs as a cycle that wipes everything past its lifetime, rather than a timer firing the instant a single record expires. A record that expires days before the next cycle stays until that cycle — and no longer.

The campaign cookie (tb_src): 90 days in your browser; the campaign tags on your visit record go with that record after 30 days idle.

Reports: 12 months from the purchase, then the report is deleted. Save the PDF if you need it longer.

Invoices: they stay, because they are a record of a payment we received — the report they point to still goes at 12 months.

Who sees it

Only us. We share nothing with any third party for advertising, and the site carries no external analytics tool.

Service providers that run the site technically process data on our behalf, each for its own part only:

How to ask for deletion

Clear cookies in your browser: the link is cut at once, and the old record is deleted in the first cleanup cycle after thirty days.

Or write to us with the visitor id in the tb_vid cookie and we will delete everything it covers.

What we do not do