Telegram Mini App data flow

What Telegram sends us — and what it does not.

Draft pending lawyer review. This document explains exactly which pieces of information Nashé receives from Telegram when you open our Mini App and place an order. The final version will be issued by our in-house counsel before we open the Telegram channel for direct-to-consumer orders.

What Telegram sends us

When you open our Mini App from inside Telegram, the platform automatically attaches a payload called initData to the requests our server receives:

• user.id — your numeric Telegram identifier (stable across sessions; this is the only field Telegram always supplies).
• Optionally: first_name, last_name, username — the same fields visible on your public Telegram profile. Note that username is a handle you choose; id is a separate, always-present numeric identifier. We treat them as distinct.
• auth_date — a Unix timestamp indicating when the Mini App was opened. We use it solely for a freshness check (a 24-hour window) so that captured payloads cannot be replayed against us. We do not retain it past the request lifecycle.
• query_id — a session-scoped identifier; not stored long-term.
• hash — an HMAC-SHA256 signature that we recompute and verify on every request.

What Telegram does NOT send us

Through the standard WebApp handshake we do not receive your phone number, email address, GPS location, contact list, photos, or any cloud-storage content from Telegram. When you place an order, your name, phone, and Nova Poshta delivery address are values you type into the checkout form yourself; we never read them from Telegram silently.

Authenticity check (HMAC)

Every order POST that reaches our server includes initData. Our backend recomputes an HMAC-SHA256 signature of that payload using our bot token and rejects the request if it does not match the hash field Telegram supplied. This proves the request originated inside Telegram, not from an external curl client. Two important nuances: (1) HMAC is an authentication signature — it does not encrypt the data, the fields above remain readable inside the request itself; (2) what HMAC guarantees is that nobody can fabricate or alter those fields without our bot token.

Where the data goes when you place an order

The verified initData fields plus the values you type into checkout (name, phone, Nova Poshta delivery address, items, optional notes) are sent to our manager in a private Telegram group via our bot, and optionally a confirmation email via Mailgun EU if an email address was supplied through another order channel. There are no other recipients. Payment data does not flow through this path — payments live in a separate process outside the scope of this document.

Telegram permissions we do not request

We do not call getContact, requestPhoneNumber, geolocation APIs, or any other elevated Telegram permission. The standard WebApp handshake is the only thing we use. The Mini App is hosted from the owner-operated Telegram channel; you do not have to be a member of any group or channel to use it.

How long we keep things

Order records are retained for 36 months in line with Ukrainian commercial-law requirements. Server logs rotate at 30 days via Docker compose log rotation. Full retention details are in our Privacy Policy.

How to opt out

Block our bot in Telegram and you will stop receiving messages from us. Existing order records remain on file for the retention windows above. To request deletion of your data, email [email protected]; the rights we honour are listed in the Privacy Policy.

Contact

Questions about the Telegram side of Nashé go to [email protected]. Our general usage rules live in the Terms of Use.