Poncho Telegram

Poncho → Privacy Policy

Privacy Policy

Effective 4 October 2026.

This policy covers the Poncho Telegram bot (@PonchoBSCChain) and this website. It explains what we store about you, why, where, for how long, and what you can ask of us. It is written for the Swiss Federal Act on Data Protection (FADP) and, for users in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR).

The short version

  • The bot stores your Telegram user ID and username, your wallets with their private keys encrypted, your settings, and a record of every transaction it sends for you.
  • Everything you do on the blockchain is public and permanent. Nobody can delete it.
  • Our servers and database are in the United States.
  • This website sets no cookies and loads nothing from other companies.
  • There is no way to delete your account inside the bot today.

Who is responsible

Poncho is responsible for your data. Write to [email protected] about anything in this policy.

What the bot stores

Your Telegram account. Your Telegram user ID, your username if you have one, your Telegram language setting, when you first and last used the bot, and whether you asked for access, were approved or were blocked.

Your wallets. Each wallet's address, its private key encrypted with AES-256-GCM, the name you gave it, its folder, whether Poncho created it or you imported it, and when you last exported its key.

Your settings. Slippage, buy and sell amounts, whether trades need a confirm screen (1-Tap Mode), your gas setting, and the trading fee rate that applies to you.

What you do. Every transaction the bot sends for you: its hash, the addresses, the tokens and amounts, its status and its receipt. The fees charged, the positions you hold and what they cost. The tokens you launched, and the launches you were building: name, ticker, description, the image you sent, links and creator settings. Your reinvest settings.

Links to the bot. A code for your own link to the bot, and, if you started the bot through another user's link, whose link it was. Also records of any payments the bot makes to you.

Abuse limits. The time and kind of actions that count toward rate limits, such as launches per hour.

Messages. The bot reads the messages you send it in order to act on them. It does not keep a transcript of your chat. It keeps the details it needs from them, listed above. When you import a key, it deletes your message straight after reading it. When it shows you an exported key, it stores the message's ID only until it deletes that message, 5 minutes later.

Server logs. What the bot did and when, including your Telegram user ID, wallet addresses, tokens, transaction hashes and errors. Private keys and seed phrases are removed before anything is written.

What is public by design

Your wallet addresses, balances and every transaction on BNB Smart Chain are public and permanent. So is everything about a token you launch: its name, ticker, description and links are written to the chain, and its image is stored on public IPFS. Before an image is uploaded, Poncho removes location and camera data from PNG, JPEG and WebP files.

Why we use it

  • To run the bot for you: create and hold your wallets, send the transactions you ask for, show your balances and positions. Legal basis under the GDPR: performance of our contract with you.
  • To protect Poncho and its users from abuse and loss: logs, rate limits, access approval, backups. Legal basis: our legitimate interest in running the service and protecting it.
  • To keep records the law requires, such as fees charged. Legal basis: legal obligation.

We do not sell your data, use it for advertising or build profiles about you.

Who else processes it

  • Telegram carries every message between you and the bot. Telegram's own privacy policy applies to your use of Telegram.
  • A cloud hosting provider runs our servers and database, and stores our encrypted backups, in the United States.
  • A node provider connects the bot to BNB Smart Chain. It receives the wallet addresses and transactions the bot reads and sends.
  • BNB Smart Chain's own public endpoints, run by Robinhood, receive transactions the bot sends and some of the reads it makes.
  • BSC (ponsfamily.com) receives a wallet address when the bot reads the creator fees owed to it.
  • Blockscout, the BNB Smart Chain explorer, receives a wallet address when the bot reads that wallet's token balances.
  • An IPFS pinning service stores launch images and token details on public IPFS.
  • Price and token-data services answer price and token-data questions. They are never sent your Telegram account or your wallet address.
  • Cloudflare hosts this website.

For our own infrastructure we name the category rather than the company. If you need the specific provider for a data protection request, write to [email protected] and we will name it.

Data outside Switzerland and the EU

Your data is stored and processed in the United States. Where the law requires it, we rely on the safeguards our providers offer for such transfers, such as standard contractual clauses or their certification under the EU-U.S. or Swiss-U.S. Data Privacy Framework.

How long we keep it

  • Your account, wallets, settings and activity: for as long as Poncho runs. There is no deletion feature in the bot today.
  • Server logs: kept in files that rotate by size. When a new file starts, the oldest is deleted, so how long a line lasts depends on how busy the bot is.
  • Backups: encrypted, and deleted automatically within 30 days.
  • The blockchain: forever. Nobody can delete it.

How we protect it

Private keys are encrypted with AES-256-GCM before they are stored. Logs remove anything that looks like a private key or a seed phrase. Backups are encrypted. No system is perfectly secure, and the Risk disclosure says plainly what would happen if ours were compromised.

Cookies and this website

This website sets no cookies and stores nothing on your device. It loads nothing from other domains. Cloudflare, which hosts the site, processes each request, including your IP address and browser details, to deliver the page and protect the site, and gives us counts of visits. The bot runs inside Telegram and sets no cookies either.

Children

Poncho is not for anyone under 18.

Changes

We may change this policy. The current version is always on this page, with its effective date.