Information that helps
moderate your group.
SautiLink Pilot processes messages delivered by Telegram to identify unapproved links, forwarded messages and long command codes according to the group’s settings, then apply its rules.
What we store
The bot stores the information needed for moderation: Telegram group and user identifiers, strike counts, the reason for an action, incident identifiers, and penalty status. This history is separate for each group.
Message text is examined when an event arrives. The moderation database does not store full copies of conversations. A member’s name may appear in the penalty announcement sent to the group.
Appeals and group tools
If you submit an appeal, we store your explanation and the admin’s decision for the review. These details are visible to you, the relevant group’s admins, and the service operators. Include only information needed for the review.
Group settings store URLs or domains an admin adds to the allowlist, command exceptions, welcome text, rule notes, additional announcement text, and tool choices. The link checker processes the address you provide without visiting the website or saving the submitted check text.
Command spam removal stores identifiers, timestamps and action outcomes without retaining the deleted code. Flood control stores message identifiers and timestamps for counting, without their text. For join requests, we store group and applicant identifiers, timing, review status and the short challenge answer when enabled. We do not store the applicant’s bio or invite link.
Reports and problem alerts go only to an admin who opted in, after checking their role again. Subscription choices, delivery records and a log of admin changes are stored to explain decisions and prevent repeats.
Service announcements
Groups using Pilot receive product updates and service announcements sent by the bot owner. We keep a registry of groups using the bot and their connection status to deliver these announcements to eligible groups.
The owner can view announcement history for the past 30 days. Older draft content and delivery records are removed in scheduled batches; clearing a large backlog may take longer. The group registry and connection state remain while a group is connected or its state is needed to operate the service. This does not store full copies of group conversations.
Language and the admin panel
We store your private-chat language choice and each group’s language choice. For an admin, we remember the last group selected in the private panel; this record does not grant admin access.
For moderation announcements, we store delivery status, attempt count, retry time, and the error category. When Telegram confirms delivery, we also store the message ID. These records help report status and avoid duplicate announcements.
Who can see this information?
Members can see the announcements the bot sends to their group. Service operators can access moderation records to run and troubleshoot the service. One group is not given another group’s strike history.
Before showing group details privately, the bot checks again that the person requesting them is still that group’s owner or an admin.
How long records are kept
The daily cleanup removes processed update records older than 7 days. Incident records and their delivery details are removed once the incident is older than 30 days. A saved admin group selection is removed after more than 30 days without an update.
Strike counts remain until an admin resets them. Language choices and group settings are kept so the service can continue operating. This cleanup does not delete announcements already sent to Telegram.
Appeals are removed 30 days after their last update. Admin change logs and action or delivery records are removed after 30 days; a corrected-strike marker remains until its incident is removed. Join requests are removed after 7 days. Flood counters use a short window of seconds, with old records removed as new messages arrive or during daily cleanup.
Known admin/group associations are cleaned up after 180 days without a new verification. Every use still checks current admin access. Settings, allowlist entries, report subscriptions and languages remain until changed so the service can continue operating.
Telegram and Cloudflare
Telegram delivers bot events and carries out message deletion and member bans. The service’s Worker and database run on Cloudflare. Those services also have their own policies for handling information.
Community tools
Reports submitted through /flag store the reason, an excerpt of up to 500 characters, the message ID and reporter identity for 30 days. Only current admins of the relevant group can review them. Reports do not impose penalties. Feature and problem feedback is visible only to the Pilot owner and retained for 90 days.
Schedules, events and highlights store content deliberately entered by an admin. RSVPs store each member’s response; other members see counts and only their own response. Completed schedule and event records are removed under the retention periods documented on GitHub; FAQ and community-page content remain until an admin changes or removes them.
A Community Hub starts private. An admin can make it public or unlisted; anyone with its URL can read a published page, and showing the FAQ is a separate choice. Configuration history is kept for up to 90 days, raid signals for 24 hours and raid alerts for 30 days. Integration tokens are scoped to one group, expire within 90 days and are stored only as hashes; their drafts are kept for 30 days. No directory of connected groups is published.
Admin decisions
The group owner and admins, anonymous admins, and automatic posts from the linked channel are exempt from the moderation rules. An admin can change a penalty and use the command that resets a member’s strike history in that group.
Questions or requests
For a group penalty, open the bot privately to view your cases and submit an appeal, or contact that group’s admin. For questions about the service or the information it stores, contact SautiLink through the official website.