Privacy policy
Version 0.2 · 3 November 2026 · Operated by Konstantin Prohorov. Contact: hello@lemma.company.
What the service processes
Gramote receives messages addressed to @gramote_ai through Telegram's official Bot API. Telegram includes a numeric user ID, private chat ID and potentially names, username, language and message metadata. Gramote uses the numeric user/chat IDs to route your requests; it does not persist your Telegram name, username, contacts or unrelated chats.
The backend stores your numeric Telegram IDs, a random device ID, a label you choose, creation time, credential verifiers and the selected-device mapping. Pairing records contain a random pairing ID, hashed code and secret, label, expiry and the claiming Telegram ID. Device and pairing secrets are generated with cryptographic randomness; only their hashes are stored in the backend database.
Messages and local data
Task text, limited progress messages, approval details (including commands or file diffs), and selected final results pass through Gramote memory and Telegram. They are not intentionally written to the backend database or application logs. The service does not upload or synchronise your repository or Codex authentication. However, messages and results can contain source-code excerpts or other sensitive content you or Codex include. Do not send passwords, keys or other secrets through the bot. Pattern redaction cannot identify every possible secret.
The companion stores its device credential, project path, thread ID, recently seen task identifiers and a bounded pending-results queue locally. Normal Codex processing, including information sent to its configured model provider, is governed by your Codex configuration and that provider's terms. Gramote does not change those arrangements.
Purpose and recipients
Data is processed to pair your account, authenticate your computer, route tasks and decisions, prevent replay and abuse, deliver results and diagnose service availability. Recipients include Telegram, the server hosting/infrastructure provider, and Konstantin Prohorov when investigating operational failures or responding to information you voluntarily send for support. We do not use advertising, tracking cookies or analytics SDKs. No payment processing or cloud execution mode is included in this release.
Diagnostics and retention
Connection IP addresses are processed transiently by the TLS proxy and application for routing and rate limits. Rate-limit buckets expire after one minute. HTTP access logging is disabled. Application logs contain coarse failure labels rather than request bodies, credentials or account IDs. TLS and operating-system diagnostics may contain network/error metadata; deployment logging is configured to retain diagnostics for at most seven days.
Unconfirmed pairings expire after five minutes and are removed during subsequent request/poll cleanup. Device mappings remain until you revoke them. Pending approvals expire after two minutes and are invalidated on disconnect. Backend result deduplication is memory-only and bounded to 2,000 entries; it resets on restart. A numeric Telegram update cursor is kept to prevent replay. The backend persists no message bodies or full Codex transcripts. Database pages and provider-level backups/snapshots may have separate recovery lifetimes; this initial deployment configures no application backup or snapshot job. The operator must disclose any provider snapshot retention before enabling it.
Pending results on your computer are removed after acknowledgement or expire after 24 hours, with a maximum of 20 entries per profile; expiry cleanup runs when the companion is active. Up to 1,000 recent task IDs remain locally for replay detection. Codex maintains its own local history independently. Telegram retains its own messages according to Telegram's policy and your account settings.
Your controls
Use /revoke DEVICE or local gramote disconnect to revoke a pairing and remove its active server mapping. /delete_all removes all your paired-device mappings. Local disconnect also deletes companion session data for that profile. Delete bot messages separately in Telegram. Revocation does not erase Codex's local history. See support for help or to request access, correction or deletion.
Security
The companion initiates a TLS-verified WSS connection; it exposes no public local port. Pairing is short-lived, one-time and confirmed on the initiating computer. Every control is scoped to a paired account/device. Approvals bind the connection, run and exact pending request. Local credentials use private files and directories, and the backend runs under a dedicated unprivileged account. These measures reduce risk; no service can guarantee absolute security.
See Telegram's privacy policy. We will update this policy before materially changing data processing.
Gramote accounts and remote device management (0.2)
Normal sign-in uses official Telegram OpenID Connect. Gramote retains a successful welcome-delivery marker until account deletion to avoid repeated greetings; failed delivery leaves no success marker and can be retried after you open the bot. Gramote stores its own account identifier, Telegram subject and numeric user ID, and account creation time. It requests openid and profile scopes to verify identity and telegram:bot_access permission to send a welcome message and provide the bot service; it does not request your phone number or persist your name, username or photo from the ID token. Telegram credentials are entered only into Telegram. A separately provisioned reviewer account uses a salted scrypt password verifier and isolated sample data, with no MFA or real Telegram account.
Telegram login state, nonce and PKCE verifier are stored for up to five minutes and consumed once; upstream ID and access tokens are verified/used in memory and are not persisted. When you connect a plugin, Gramote processes OAuth client names and registered callback URLs, single-use authorization codes (two minutes), browser sign-in sessions (one hour), short-lived access tokens (15 minutes) and rotating refresh grants (up to 30 days). Token verifiers are stored instead of plaintext tokens. OAuth clients without active grants are removed after 30 days. Expired security records are removed during periodic cleanup. Replayed refresh grants revoke their token family.
MCP can create a five-minute pairing session, check pairing state, list your devices, check their current availability, and revoke access. Pairing requires browser approval of the exact local verification ID and Telegram identity, followed by local confirmation. Session status records are removed within 24 hours after expiry. Remote MCP never runs Codex, fetches repository files, reads shell history or retrieves authentication credentials from your computer.
Only bounded device names, opaque operation references and online/available state are returned to the connected OpenAI client. OpenAI processes those tool inputs and results according to your OpenAI settings. Technical logs record fixed MCP operation categories, success/error outcome and duration, without account identifiers, passwords, token values or tool contents. The existing seven-day diagnostic log retention applies.
Signing in at your account provides account deletion, which revokes linked devices and OAuth grants and removes account and pairing records. Device revocation also invalidates outstanding account enrollment sessions. Deleting a Gramote account does not delete Telegram or Codex histories. Accounts otherwise remain until deletion. The hosting provider, Telegram and OpenAI retain their independent roles described above.