How Dripl protects your account and Telegram sessions

• Passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text, and must be at least 10 characters long.
• Session cookies are HttpOnly and SameSite=Lax, and marked Secure in production.
• Sign-in, sign-up and password-reset requests are rate-limited per IP address and email.
• Changing or resetting your password ends your other sessions, including “Remember me” cookies.
• Every change made while signed in must come from Dripl’s own pages: we check the Origin and Fetch-Metadata headers.

• Each connected account’s session is a separate file on our server that only the Dripl app can read.
• Session files and Telegram API keys are never returned by our API or shown in the dashboard.
• Removing an account logs its session out on Telegram’s side and deletes the session file.
• Each account has its own pace (daily and hourly caps, a minimum gap between messages and random jitter), so sending is spread out instead of bursting.
• On paid plans, each account can use its own SOCKS5, SOCKS4, HTTP or MTProxy proxy. Proxy passwords and secrets are never returned by the API.

• Card, Apple Pay and Google Pay payments run on Stripe’s hosted Checkout, so card numbers never reach our servers. Billing shows only what we read from Stripe: a card’s brand, last four digits and expiry date.
• Crypto payments run through DePay, and we verify the signature on every payment notification.

• When error monitoring is switched on, errors go to Sentry without cookies or authorization headers. Errors from our servers carry your user ID, so we can find what went wrong.
• Screen replays are recorded only around an error on signed-in pages, never for whole visits. The public pages never load the Sentry SDK.
• Our own analytics keeps only the name of an error in your browser, such as TypeError, never its message.

• Profile, password, team and billing changes go into an audit log that workspace owners and admins can view and export as JSON or CSV.
• Sent messages and forwarding logs are kept for 90 days on the free plan, 1 year on Pro, and for as long as you stay subscribed on Business. When a downgrade takes effect, or a plan or trial ends, sent messages and logs older than the new plan’s window are deleted at the next nightly cleanup. Audit entries are deleted after 12 months.
• The app runs in containers as a non-root user.

To delete your account and its data, email us from the address you sign in with. We act on requests within one month, as the GDPR requires, and delete your personal data except your invoices, which we keep for the legal retention period of 10 years, and our records of staff actions, which we keep for 6 years. Our server logs, which record requests to our site, are not deleted with your account: our web server’s access and error logs have no scheduled deletion, and our app server’s request log is overwritten as it fills. Nor are the records of visits you made while signed out that we never linked to your account: like all activity records, they are deleted 90 days after the last activity they record. Nor is the output of a test of our AI instructions that a Dripl admin ran on one of your AI Studio reports: it is deleted the first time that version of the instructions is tested more than 7 days after that test.

The privacy policy lists what we collect, who processes it and how long we keep it.