Privacy Policy

Last updated: 2026-05-19 · GDPR Art. 13 disclosure

1. Who we are

Kaching is an independent affiliate aggregator. We are the data controller for personal data processed via the Telegram bot @kaching_777_bot and the Mini App at app.kaching.gg. Contact: privacy@kaching.gg.

2. What we collect

• Telegram identity: Telegram user ID, username (if public), language code, premium status.
• Profile: country, language, age confirmation timestamp, VIP tier, push preferences.
• Activity: commands used, bonuses viewed, claims clicked (with bonus_id and operator), referral attribution, streak progress.
• Payments: Telegram Stars charge IDs only — we never see your card or bank details.
• Hashed IP: when you open the Mini App, your IP is one-way hashed for fraud detection. Raw IP is not stored.

We do not collect: phone number, real name, government ID, financial credentials.

3. Why we process it

• Contract: deliver bonus alerts and Mini App functionality you request.
• Legitimate interest: fraud prevention, abuse mitigation, service improvement.
• Consent: optional FOMO push, marketing messages (you can withdraw any time via /settings).
• Legal obligation: 18+/21+ age verification, sanctions screening, tax reporting where applicable.

4. Who we share it with

• Affiliate operators: when you click a Claim button, we pass a tracking ID (kaching_click_id) but no personal data.
• Telegram: messaging delivery is via Telegram's API. Telegram's own privacy policy applies to Telegram-side data.
• Cloudflare: our infrastructure provider. Data stays in Cloudflare's edge network.
• Sentry: error monitoring (sample-rate logged; no PII intentionally captured).
• DeepL: translation API for bonus content; no user-identifying data sent.

We do not sell your data. We never share for advertising targeting.

5. How long we keep it

• Profile + preferences: until you delete (see Section 7).
• Activity events: 6 months in hot storage, then archived 12 months.
• Payment records: 7 years (legal/accounting retention).
• Soft-deleted accounts: hard-deleted after 30 day grace period.

6. Where it lives

Cloudflare D1 (SQLite at edge). Storage region is automatically selected by Cloudflare; we have no direct geographic preference. EU residents' requests against EU GDPR may invoke applicable cross-border transfer safeguards (SCCs in place via Cloudflare).

7. Your rights (GDPR / UK GDPR / CCPA-aligned)

• Access: /my_data returns your full profile as a JSON dump.
• Delete: /delete_my_data initiates the 30-day grace soft-delete; ping privacy@kaching.gg for immediate hard-delete.
• Correct: change country, language, push preferences from /settings at any time.
• Object / portability: write to privacy@kaching.gg.
• Complain: your local data protection authority (ICO in UK, CNIL in FR, etc.).

8. Cookies and similar

The Mini App uses sessionStorage to hold a JWT for the duration of your Mini App visit. No persistent cookies are set by us. Telegram's own WebView may set platform-level cookies — see Telegram's policy.

9. Children

The Service is not for users under 18 (21 in US/JP). We do not knowingly collect data from minors. If you believe we have, contact us and we will delete immediately.

10. Changes

Material changes will be announced via the bot at least 14 days in advance.

← Back to Kaching · Terms · Responsible Gambling