Privacy policy

The short version

• There’s no account, no ads and no analytics, in the extension or on this site.
• Your chats, bot tokens and history stay in your browser.
• S2T Relay passes your messages on to Telegram and never stores or logs them.

In your browser

The extension keeps your chats, bot tokens, hashtags, settings and history in the browser’s extension storage on your device. They aren’t synced or sent anywhere else. Nothing you send from a private window is added to history.

With the password lock on, all of it is encrypted. The key is held in memory only, until the browser closes.

To delete it, remove a chat or clear your history in the extension’s settings, or uninstall the extension to remove everything.

When you send

With your own bot, the extension sends straight to Telegram’s Bot API at api.telegram.org, using your bot’s token. Nothing sits in between.

With S2T Relay, it sends to relay.s2t.dev, which hands the message to Telegram. Once delivered, your messages are covered by Telegram’s privacy policy.

What S2T Relay stores

For each browser linked to a chat, the relay keeps:

• A SHA-256 hash of the browser’s random token, never the token itself
• The browser’s name, such as “Chrome on macOS”
• The chat it sends to: its ID, title and type
• When it was linked and when it was last used
• While linking, a one-time code that expires. Links that are never finished are deleted every day.

Your messages aren’t stored or logged. The relay passes them to Telegram and keeps nothing. Request logging is off, and errors are logged by type only.

Your IP address is used only to limit how many requests one network can make in a minute. It isn’t written to the relay’s database.

The relay runs on Cloudflare Workers, so Cloudflare handles its requests. Its code is open source, and you can host your own.

Removing a browser from the relay

• Remove the chat in the extension’s settings.
• Or send /devices to @S2TRelayBot in the chat and unlink the browser there.
• Removing or blocking the bot deletes every browser linked to that chat.

Permissions

• Context menus adds Send to Telegram to the right-click menu.
• Storage keeps your chats, settings and history in the browser.
• Active tab and scripting read the page’s title, address and selected text, only in the tab you’re on and only when you open the popup or send.
• api.telegram.org is optional and asked for the first time you open a photo, video or file sent to your own bot. It lets the extension download it to show in the popup.

This website

s2t.dev sets no cookies and runs no analytics. It’s hosted on Cloudflare, which handles its requests like any web host.

Changes and questions

When this policy changes, the date at the top changes too, and the changelog says what changed. For questions, open an issue on GitHub.