Privacy Policy

Effective October 28, 2026

Hkimori (“the app”, “we”) is a private Telegram bot and Mini App at @hkimori_bot and bot.softgridlabs.org. It is operated by its owner for personal use and responds to a single Telegram account. This policy explains what data the app handles and why.

Data we access

Telegram: your numeric Telegram user ID, used to confirm that requests come from the owner, and the messages you send to the bot.
Gmail (read-only, optional): when you connect a Gmail account, the app uses the gmail.readonly scope to read the email address of the account and, for new messages in the inbox, the message labels, the From and Subject headers and the short preview text (snippet). The app never sends, deletes, modifies or labels email.
Computers (optional): devices you register send a periodic “I am online” signal. The app stores the time of these signals to show when each device was online.
Server monitoring: the status of servers you operate, read from your own monitoring service.

How we use it

Data is used only to provide the app's features to you: deciding whether a new email should be forwarded (it is marked Important by Gmail or comes from a sender on your list), sending you that notification in Telegram, and showing server and device status in the Mini App.

What we store

Connected Gmail addresses and their OAuth refresh tokens, encrypted at rest.
A Gmail history marker per account (so only new mail is checked) and a counter of forwarded messages.
Email content is not stored. The sender, subject and preview of a matching message are sent once to your Telegram chat and are not kept by the app.
Registered device names and their online history (deleted automatically after 60 days).

Data is stored on a server in Germany operated by the owner.

Sharing

We do not sell, rent or share your data with anyone. The only transfer is the delivery of notifications to your own Telegram chat through the Telegram Bot API. Data is not used for advertising and is not used to train AI or machine learning models.

Artificial intelligence

Hkimori does not send Google user data to any AI or machine-learning service, does not use it to develop, improve or train AI models, and does not generate images, video or any other content from it.

Google API Services User Data Policy

Hkimori's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

Removing a Gmail account in the app revokes its token with Google and deletes it from our database immediately.
You can also revoke access at any time at myaccount.google.com/permissions.
Removing a device deletes its online history.

Security

All traffic uses HTTPS. OAuth tokens are encrypted at rest, the Mini App verifies Telegram's signature on every request, and server access is restricted to key-based authentication.

Children

The app is not directed to children under 13 and is not used by them.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Questions about this policy: contact@softgridlabs.org.