Xentoryn Network

Privacy Policy

Last updated: 27 September 2026

Short version: We store your Telegram ID, name, username and profile photo as Telegram gives them to us, plus what you do in the app. We do not store passwords, emails, phone numbers, contacts, locations, IP addresses or device fingerprints in our database. Other users see your display name, photo, level and posts, but never your Telegram ID. Our ad partner Monetag receives your Telegram ID when you watch an ad. Questions or requests: xentorynnetwork@gmail.com.

This policy explains what personal data Xentoryn Network ("Xentoryn", "we", "us") processes when you use the Telegram Mini App and the bot @XentorynAppBot, why, and who else receives it. For this app, it applies instead of Telegram's Standard Privacy Policy for Bots and Mini Apps. Your use of Telegram itself is covered by Telegram's own privacy policy.

1. Who is responsible

Xentoryn Network is operated by Mert, an individual. It is not operated by a registered company. Mert is responsible for the processing described in this policy.

Contact for all privacy questions and requests: xentorynnetwork@gmail.com

2. Data we receive from Telegram

When you open Xentoryn, Telegram gives the app signed data about you. Our server checks the signature on every request to confirm the request really comes from you. From this data we store:

your Telegram user ID;
your username, if you have one;
your first and last name;
the address (URL) of your Telegram profile photo.

We do not receive your phone number, contacts or Telegram chats. When you send a message to the bot, we store only a technical update number and its type (to avoid processing it twice), not the message text. We use the language setting Telegram reports only to choose the language of the bot's reply; we do not store it.

3. Data created when you use the app

Your chosen app language and your notification preferences.
XTNR balance, total mined, XP (your Level is calculated from it), daily and longest streak, session start and end times, sync times and last activity.
Missions (progress, completion and rewards), Boosts (purchases, times and how they were obtained) and your equipped badge.
Your referral code, who invited you, when your referral qualified, and your invite counts.
Clan membership and role, join requests, and clan announcements you publish. Each clan membership also has a random reference number that the app uses for clan management; it is not derived from your Telegram ID.
Community posts, comments, likes, saved posts and reports (including the reason you give).
Notifications sent to you, whether you read them, and whether their delivery through Telegram succeeded.
Staff role (only for Xentoryn staff) and whether an account is banned.

Your trust status (New, Verified, Trusted, Elite) is calculated when needed from your account age, streak, missions and qualified referrals. It is not stored and is not used for automatic decisions.

4. TON wallet

If you connect a TON wallet, we store its address, its public key and when it was verified. Verification works by a signature from your wallet (ton_proof). We never ask for, receive or store a recovery phrase or private key. If you disconnect the wallet, its address is removed from your profile. Premium payment records (Section 5) keep the address that paid.

5. Premium payments

For each Premium order we store the order ID, the pass and its duration, the price, the payment reference, the treasury address, your verified paying wallet address, the order status and its timestamps. When a payment arrives we also store the transaction hash, logical time and message hash, the blockchain timestamp, the amount received, the sender address and our verification attempts.

We also keep payment events (including the transaction comment and which data provider reported it), the resulting pass (start, end, bonuses and status), daily Sovereign credits, and an audit log of each grant, review and status change. We do not receive card or bank details. TON transactions are public on the blockchain by their nature, independently of Xentoryn.

6. Rewarded ads

Monetag's ad script is loaded only when you choose to watch an ad. When you do, we create a one-time record with a random identifier, your Telegram ID, the purpose (mission or Boost), status and timestamps.

Monetag then confirms the view to our server. The confirmation contains our random identifier, zone and sub-zone IDs, event types, a request variable, an estimated price and your Telegram user ID, which Monetag's script reads from the Telegram app environment. We store this confirmation, without its security token, to verify the reward and prevent fraud. While the ad is shown, Monetag's script runs on your device and may process device and network data under Monetag's own privacy policy.

7. What we do not collect

Our database does not store your IP address, device fingerprint, device model, location, email address, phone number or contacts. When your device connects to any server, the server necessarily sees your IP address for that connection. This applies to our hosting providers and to the services listed in Section 9.

The app uses no cookies. It keeps one small flag in your browser storage (whether today's daily-goal message was shown), and the TON Connect library keeps your wallet connection session there.

8. Why we use your data

To provide the service you ask for: your account, sessions, rewards, missions, Boosts, clans, community, leaderboards and notifications. Where laws such as the GDPR apply, the legal basis is performance of our agreement with you (the Terms of Use).
To verify payments and deliver Premium Passes, and to keep payment records: performance of our agreement, and legal obligations where they apply.
To verify ad rewards and prevent fraud, multiple accounts and referral abuse: our legitimate interest in a fair and secure service.
To moderate content and enforce our Terms: our legitimate interest in a safe community.

We do not sell personal data, and we do not build advertising profiles ourselves. We make no automated decisions that have legal or similarly significant effects on you.

9. What other users can see

Community posts and comments: your display name, profile photo, Level, equipped badge and staff role, plus anything you post.
Leaderboards: your display name and score.
Clans: your display name, profile photo, Level, clan role and contribution, shown to members of your clan. If you ask to join a private clan, its leader and co-leaders see your display name, photo and Level.
Referrals: the person who invited you sees your display name, your streak and whether your referral qualified.

Your display name is your Telegram first and last name (or your username if you have no name set). Other users do not receive your Telegram user ID or your referral code from our app.

10. Services that process data for us

Telegram runs the Mini App and bot, provides your identity and delivers the bot messages we send you.

Supabase hosts our database and server functions. It holds all the data described in this policy.

Vercel hosts the app's files. It receives connection data such as your IP address and browser request.

TON Connect and the wallet you choose connect your wallet, sign the verification and send payments. They handle your wallet address, the signed proof and payment transactions.

TON Center and TONAPI are read by our server to check payments on the public blockchain. They receive the treasury address and public transaction data, not your profile.

Monetag provides rewarded ads. See Section 6.

Links to X, WhatsApp, Facebook or Reddit are used only if you tap a share button, and they open those services directly.

These providers may process data outside your country.

11. How long we keep data

We have not set fixed retention periods yet. Until we do, this is how it works today:

There is no automatic account deletion, and user records are not deleted automatically just because time has passed.
We keep records only as long as they are needed to run the service, keep it secure, process and account for payments, prevent fraud and abuse, meet legal obligations, and handle disputes or legal claims.
Posts and comments you delete are hidden from everyone, but they stay in our database for moderation and abuse handling.

The only automatic deletion that exists today: expired wallet-verification challenges are removed, a like or save is removed when you undo it, and your clan membership is removed when you leave or are removed from a clan.

You can ask for your data to be deleted at any time (see Section 12).

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, and to receive a copy of it (portability).

In the app today you can:

see your profile and activity;
change your app language and notification preferences;
disconnect your TON wallet;
delete your own posts and comments.

Your name, username and photo come from Telegram. Change them in Telegram and they update the next time you open Xentoryn.

By email: there is no "delete account" or "export data" button in the app. To ask for access to your data, a correction, a copy (export) or deletion, email xentorynnetwork@gmail.com.

Every request is reviewed and handled manually by the operator. Nothing is deleted automatically when a request arrives.
We may ask you to confirm the request through your Telegram account, so that nobody else can obtain or delete your data.
We cannot promise that every record will be deleted in every case. Some records may have to be kept because of legal obligations, fraud or security prevention, payment and accounting records, disputes or legal claims.

You may also complain to your local data protection authority.

13. Security

Every request from the app is authenticated with Telegram's signature. Our database blocks all direct access from the app; only our server functions can read or write data. Secret keys are kept only on our servers, never in the app.

14. Children

Xentoryn does not set its own minimum age. Use by children is subject to Telegram's terms and the law that applies to them. A parent or guardian who wants a child's data deleted can ask us at xentorynnetwork@gmail.com; such requests are handled as described in Section 12.

15. Changes to this policy

When we change this policy we update the "Last updated" date above and announce material changes in the app.

16. Contact

Operator: Mert (individual, not a registered company).

Email: xentorynnetwork@gmail.com
Official channels: X · YouTube · Telegram