Contents
At a glance
- We do not use third-party analytics tools, advertising pixels or fingerprinting; visit statistics are kept only in our own database.
- Visit records are deleted automatically after 180 days, password reset requests after 90 days and support messages after 2 years.
- Your password is stored only as an irreversible hash; we will never ask you for it.
- We do not sell your personal data or use it for third-party advertising.
- The names, links and IDs of the groups in our network are never published on the site; only aggregate figures are shown.
1.Scope and data controller
This policy applies to the public pages of tghub.co (all language versions), the member dashboard and the support form. In this policy, “tghub”, “we”, “us” and “our” refer to the party that operates the tghub.co website and member dashboard, and “you” and “your” refer to any person who visits the site or uses the service.
tghub is the data controller for your personal data. To contact us or request information about the business, please use the Support page.
Cryptomus, which you use for payments, and Telegram, where your posts are forwarded, are governed by their own privacy policies with respect to their services.
2.Data we collect
We collect only the data we need to provide, secure and improve the service. The list below is the complete set of data our system actually records today.
2.1Visit information (all visitors)
We keep one record for each page view on our public pages and in the member dashboard:
| Information | Details |
|---|---|
| Visitor ID | A randomly generated ID that is not derived from your device, stored in the tghub_vid cookie. |
| Time and page | When the page was viewed and its address (without the query string; record IDs in the member dashboard are masked). |
| IP address and country | Your country is taken from the country code that our content delivery provider, Cloudflare, adds to the request. |
| Device and browser | Device type (mobile, tablet, desktop), browser and operating system family, and your browser's identification string (User-Agent, up to 400 characters). |
| Language and screen | The site language shown and your screen size (for example, 390×844). |
| Referral source | The address of the external site that referred you (recorded only on the first page of a visit; search terms are not stored) and the campaign tags in the link (utm_source, utm_medium, utm_campaign). |
| Automated traffic flag | Records identified as coming from search engine bots or other automated tools are flagged and excluded from statistics. |
| Account link | Your account, if you are logged in. When you sign up, your earlier visits from the same browser are also linked to your account. |
Admin pages and background requests are not included in these records.
2.2Account information
- What you provide: email address, username, password (stored only as an irreversible bcrypt hash), optional Telegram username and full name, and the time you accepted the Terms of use and this Privacy policy.
- Recorded automatically at sign-up: IP address, country, device, browser and operating system, browser identification string, site language and visitor ID, plus the referral source, the first page you opened and the campaign tags from your first visit.
- On each login: login time, IP address, country and site language. While you use the site, your last-seen time is updated at most once every 5 minutes.
- Optional short survey (you can skip it): what you want to promote, your monthly budget range and how you heard about us.
- Preferred language: the site language you signed up or last logged in with, or the language you last chose in the member dashboard, is saved to your account so that the dashboard is shown in your language.
2.3Balance, payment and campaign information
- Your balance (USD) and every balance transaction: type, amount, resulting balance and description.
- Payment records: amount, status, the provider's transaction ID, the payment page link and the notification data Cryptomus sends to confirm the payment (for example, the amount and cryptocurrency paid, the network, the sending wallet address and the blockchain transaction ID).
- Your campaigns: post link (and backup post link, if any), post title, package and duration, price breakdown, network size and estimates at the start, status and dates.
- A summary of your post's content: content type, whether it has a link preview, text length, and the number of links, hashtags and emoji. We use this summary to determine which groups your post can be forwarded to.
- The Telegram view counts of the posts you check and of your campaign posts (at the time of the check and every day during the campaign).
- The extra group links you add, and forwarding logs showing which groups your post was forwarded to each day, the result and, where applicable, the reason for any error.
- Groups you add that are not in our network are added to our group catalog along with their publicly visible Telegram information (such as name, link, member count and group permissions); this information is not linked to your account.
- Orders for other packages offered in the dashboard: package name, price, quantity, target (if any) and order status.
2.4Support messages
- What you provide: name, email address, optional Telegram username, topic and message (up to 4,000 characters).
- Recorded automatically: IP address, country, site language, the time the message was sent and, if you are logged in, your account.
- Added by our team: the message's status (new, read, done), an internal note, and which admin handled it and when.
2.5Password reset requests
- The account the request belongs to, the time of the request, IP address and language; who created the link (you or our support team), its expiry and when it was used.
- The reset link itself is not stored; only an irreversible hash of it (SHA-256) is kept. Each link can be used only once, and a new link invalidates any older ones.
- Our site does not send automatic emails: your request is reviewed by our support team, and once your identity has been verified, the link is sent through your registered contact channel (for example, Telegram).
3.Why we process your data and on what legal basis
We process your personal data only for the purposes below and on the stated legal bases (Article 6 of the EU General Data Protection Regulation (GDPR), where it applies, and the equivalent provisions of other applicable data protection laws):
| Purpose | Data | Legal basis |
|---|---|---|
| Providing your account and the service: login, campaigns, balance, responding to support requests | Account, campaign and payment information; support messages | Entering into and performing a contract |
| Security and abuse prevention: detecting multiple or abusive accounts, rate limits, payment disputes, account recovery | IP address, country, device information, visitor ID, login information, reset requests | Legitimate interests (security of the service and of other users) |
| Understanding and improving the site: which pages, languages and devices are used, and where sign-ups come from | Visit information, sign-up source, survey answers | Legitimate interests (first-party, pseudonymous and aggregated statistics only) |
| Proving acceptance of our terms | The time you accepted the terms | Legal obligation and legitimate interests |
| Accounting and legal obligations | Payment and balance records | Legal obligation |
We do not sell your personal data or use it for third-party advertising, and we do not make automated decisions about you that produce legal effects.
6.Who can access the data
- Only tghub administrators can access your data, through the admin panel and only as their duties require (support, security, statistics); administrative actions require an administrator session.
- The public site shows only aggregate network figures (groups, members, online) and anonymized examples. No visitor's data is published, and neither are group names, links or IDs.
7.Retention periods
| Data | Retention period |
|---|---|
| Visit records | 180 days, then deleted automatically. |
| Password reset requests | 90 days, then deleted automatically. |
| Support messages | 2 years (730 days), then deleted automatically. You can ask us to delete them sooner. |
| Account, campaign and order information | For as long as your account exists; deleted when your account is deleted. |
| Payment and balance records | For as long as accounting and tax laws require. |
| Post checks not tied to a campaign | The link to the post you checked, its view count and the time of the check are kept separately and are not deleted automatically with your account; we delete them on request. |
8.Security
- Passwords are stored as bcrypt hashes; reset links are kept only as hashes.
- The session cookie is signed, and your account permissions are verified against our database on every request.
- Failed login attempts, sign-ups and form submissions are subject to time-based rate limits.
- Payment confirmations are verified with the payment provider's signature before anything is added to your balance; the same payment cannot be credited twice.
- The connection between the site and your browser is encrypted with HTTPS.
No system is entirely risk-free. If we become aware of a security breach affecting your data, we will make the notifications required by applicable law.
9.Your rights
Under this policy and applicable data protection laws, including the GDPR where it applies, you have the right to:
- find out whether we process your data and request a copy of it;
- request the correction of inaccurate or incomplete data;
- request the deletion of your data or the restriction of its processing;
- object to processing based on legitimate interests (for example, visit statistics);
- receive your data in a portable format, where applicable;
- lodge a complaint with a data protection authority, in particular the one in the country where you live.
9.1How to exercise your rights
- In the member dashboard, you can view and update your profile information, change your password and review your balance, order and campaign records.
- For any other request, use the form on the Support page, preferably with the email address registered to your account. We may ask for additional information to confirm that the request is yours.
- We respond to requests within a reasonable time and in any case within 30 days.
- There is no self-service account deletion button in the dashboard; deletion requests are handled manually by our support team. When your account is deleted, your password reset requests are deleted; your visit records and support messages are unlinked from your account and deleted at the end of the retention periods above.
10.Children's privacy
Our service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If we become aware of such data, we delete it.
11.Changes to this policy
We update this policy as our service or the way we process data changes. The current version takes effect as soon as it is published on this page; the effective date is shown at the top of the page.
12.Contact
For privacy questions and requests, use the form on the Support page and choose “Privacy & data request” as the topic.
Back to topEffective date: September 29, 2026