Privacy Policy (English)

Игротека (Igroteka), igroteka24.ru and the Telegram bot @igroteka_events_bot. Version of November 1, 2026. This is a translation of the Russian text above.

1. Data we collect

• Telegram data: user ID, name and username that Telegram passes to the bot and the mini app.
• Payments: plan, amount, date and payment number. Card details are entered on the side of the payment service Prodamus; we do not receive or store them.
• Games: what the host and guests enter or send during a game (names, answers, photos, videos, audio recordings) and technical data about game launches (time, device type).
• Host's parties: dates and types of parties the host added in the "My parties" section.
• Google Calendar data, only if the host connects it (see section 3).

2. How we use the data

• to give access to the games after payment and to run games at parties;
• to answer questions and send messages in the bot about access, payments and tips for the host's upcoming parties;
• to find and fix errors in games and improve the service using aggregated statistics.

We do not sell data, do not share it with advertising networks and do not use it for advertising.

3. Google Calendar

A host may optionally connect Google Calendar in the bot section "📅 My parties", so that the bot learns about the host's parties and sends suitable games two days before each party.

• We request read-only access to calendar events (scope calendar.events.readonly) and read only the host’s primary calendar, 60 days ahead. We never create, modify or delete anything in the calendar.
• From events we use only the date and title to determine whether an event is a party and of what type (wedding, birthday, corporate party, etc.). We store only events that look like parties: date, type and title. We do not store descriptions, locations, attendees, phone numbers or addresses from events.
• To keep access we store the token issued by Google. The host can disconnect the calendar at any time with a button in the bot or in Google Account settings (myaccount.google.com/permissions). After disconnection the token and all data received from the calendar are deleted.
• Data from Google Calendar is not transferred to third parties, is not used for advertising or for training artificial intelligence models, and is not read by humans unless the user asks for help or it is required by law.
• Igroteka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Retention

• photos, videos and recordings from games are deleted one day after the game ends;
• detailed records of in-game actions are kept for no longer than one year, for statistics;
• account data, payments and parties are kept while you use the service and can be deleted on request.

5. Storage

Data is stored on a server in Russia (Saint Petersburg). Only the owner of the service has access to the server.

6. Your rights

You can ask what data about you is stored, ask to correct or delete it, and withdraw your consent. Write to the email or Telegram above; we reply within 10 days.

7. How we protect your data (data protection mechanisms)

• The website, the bot and the games work only over encrypted HTTPS (TLS) connections. All requests to Google APIs are made over HTTPS.
• The Google Calendar access token (OAuth refresh token) is stored on the server encrypted at rest (AES via the cryptography library, Fernet). The encryption key is stored separately from the database, in a restricted server configuration file.
• We request the narrowest scope needed: read-only access to events of the primary calendar. From events we store only the date, type and title of parties.
• Server access is limited to the service owner, over the encrypted SSH protocol. The admin panel is password-protected and does not display calendar data.
• Database backups are kept on the same protected server.
• Calendar data is processed automatically and is not read by humans. When the host disconnects the calendar, the token is revoked at Google and deleted together with all data received from the calendar.