Privacy Policy

Who processes this data

This page and the rest of 101migrant are run by the party named on the Imprint page, which also carries the contact details for official correspondence. You can only sign in through Telegram — we never ask for a separate registration, password, or email address.

What we collect and why

Data is tied to an internal account id rather than stored on its own:

• Account and sign-in: your Telegram id, username, first and last name (as Telegram reports them), your chosen interface language, when you last visited, and a flag recording that you blocked the bot — otherwise a notification queue cannot tell a message never arrived. Sign-in is proven by a session; only an irreversible hash of the sign-in token is stored, never the token itself.
• Discussion: the text of comments and submitted ideas, what language they are written in, where they came from — the website, the bot, or the Mini App — and their moderation status. Machine translation of that text into other languages is produced by an outside service — see "Who else processes it". A comment, or an issue that grew out of someone’s idea, publicly shows the author’s first name, profile photo when we have one, and links that name to their Telegram profile when they have a public username — or, when they have none, prints their numeric Telegram id beside it, so authors stay distinguishable.
• Saved: which issues and posts you saved, when, whether you muted notifications, and — if you arrived through a paid ad — the click parameters (utm_source, utm_campaign, Google's gclid), recorded once at the moment you saved it.
• An ad click before you sign in: if you tapped an ad but have not opened the bot yet, those same parameters (utm_source, utm_campaign, gclid) are held separately for up to a day, tied only to the issue itself, not to you personally — opening the bot turns that record into your save; if you never open it, the record is deleted automatically and is never linked to anyone.
• Message delivery bookkeeping: Telegram chat and message identifiers, used only to work out which discussion your reply to the bot belongs to; which comment a notification still owes you; and, while you are mid-reply to the bot, which issue or idea your next message will attach to.
• Invitations: if you arrived through another member's invitation link and created an account, we record whose link it was, which of the three ways you arrived (the bot, the Mini App, or the website), when, and — if the link named one — which issue. The member whose link it was sees your first name, when you arrived, and your numeric Telegram id in their own list of invitations — never your username, never a link to your profile, and never an avatar. If you invite someone yourself, your own invitation code (eight random characters) is generated the first time you open the invite form and is tied to your account the same way the data in the first bullet is.
• Activity rating: your public profile (/u/{id}) shows your name, avatar, total score, rank, and a history of what earned it — but it names the target only for a comment, an idea published as an issue, or a like you received, since those are already public under your own name. What you saved, what you liked, and who you invited are never named there, only the action and when it happened. A revoked entry (after you unlike something, for instance) is visible only to you, in settings — it is removed from the public profile entirely.

What we don't collect

There is no password, email address, or payment data on this site — identity comes from Telegram alone. We never ask for your phone number, and we never see your messages beyond what you send the bot or write in a discussion yourself.

Who else processes it

Some data reaches other services — only the ones the site actually needs to run:

• OpenAI — every comment and every issue or post body is sent to this service for translation into other languages and for moderation review. This is a transfer of text you wrote to a third party outside the European Union.
• Telegram — sign-in and notification delivery both go through it; it is our identity provider and delivery channel.
• Hetzner — the hosting provider whose servers physically run the site and the database.
• Umami — visit statistics, but self-hosted by us rather than a third-party cloud service: traffic data never leaves our own infrastructure, and the counter itself sets no cookie.

Cookies, and why there's no consent banner

The site sets at most three cookies, and all of them only in response to something you explicitly did: `101m_session` appears when you sign in with Telegram, `101m_locale` appears when you switch the interface language with the switcher, and `101m_return` appears for a few minutes the moment you press "Sign in" on a page — it exists only to bring you back to that same page once sign-in finishes, and is deleted as soon as it does. An anonymous visit where you never sign in and never touch the language switcher sets no cookie at all.

Umami's counter uses no cookie at all, and an ad-click record is not tied to a cookie either — it is simply written to the database once, at the moment you arrive. All of the site's cookies are therefore strictly necessary for a feature you asked for yourself (signing in, returning to a page after signing in, or choosing a language), and the law does not require a consent banner for that. We do not show one, because there is nothing for it to ask permission for.

If that ever changes — for example, if advertising analytics starts to need a cookie — this page and a real consent mechanism will be updated before that cookie is ever set.

How long data is kept, and how to have it deleted

We do not delete data automatically — it is kept for as long as the account exists. To request a copy of your data, or to have it deleted, use the contact details on the Imprint page; requests are handled manually.