Privacy Policy

Effective November 8, 2026 · Version 3

1. Who is responsible

Turn Spotter ("we", "us") runs Bot City: turnspotter.com, the Bot City Telegram bot and its mini app (the "Service"). We decide how the information described here is used. Contact: message the bot at t.me/TurnSpotterbot.

2. What we collect, and why

• Telegram details, when you message the bot or open the app: your Telegram user ID, first and last name and username, as Telegram provides them. Used to know who is a member, to run your membership (start, end and reminder dates, which invite you used) and to reply to you.
• Payment records, when you check out: the amount and coin, the time, a random payment reference and, once you pay, the blockchain transaction ID. Used to confirm your payment, give you access, handle problems and keep accounts. A Solana transaction is public: anyone can see the sending wallet address on the blockchain. We don't collect your name, card or bank details: there aren't any.
• Your consent at checkout (the time, and the version of these documents you agreed to). Used as a record that you confirmed you're 18+ and accepted the Terms.
• Technical data. Like any website, our server sees your IP address and browser type when you connect. We use the IP address only in the server's memory, for a few minutes, to block abuse (rate limits); we do not write it to logs or keep it. Our server logs record errors, not visitors.
• Support conversations: the messages you send the bot, Ava's answers and the operator's replies, plus anything you choose to tell us. Used to help you. If Ava passes your chat to a person, the operator sees the recent conversation with your Telegram name and ID.
• Your bot team: every member has their own team of practice-money bots. We store its activity (the bots' simulated trades, learning and office chat), your settings for it (on/off, risk) and the messages and answers you send it in the app. Used to run your team and show it to you. Only you (and the operator, for support and maintenance) can see it.

We don't collect special categories of data, and we don't use your data for automated decisions about you, for advertising, or to build profiles.

3. On your device

• Sales page: remembers your open checkout in your browser's local storage, so you don't lose it when you switch to your wallet app and back. Nothing is sent anywhere else.
• Bot City app: uses one strictly necessary cookie that keeps you signed in for up to 12 hours after Telegram vouches for you, and local storage for your in-app settings.
• No analytics, advertising or tracking cookies, so there's no cookie banner.

4. Who else is involved

• Telegram carries your messages to the bot and opens the app; Telegram's own privacy policy applies to Telegram.
• DigitalOcean hosts our server in the United States. Cloudflare provides the domain's DNS (it doesn't see your traffic).
• The Solana network: to confirm a payment, our server asks a Solana RPC provider about your order's random payment reference. CoinGecko or Coinbase give us the SOL price. None of these receive your personal details from us.
• Inside the app, your device loads market data and tools directly from providers such as DexScreener, RugCheck, GeckoTerminal, Binance, Coinbase, jsDelivr and Google Fonts. Like any website, they see your IP address when your device contacts them, under their own policies.
• Anthropic (the Claude AI) powers Ava: when you message the bot, your message, the recent conversation and your membership status (member or not, end date) are sent to Anthropic's API to write her reply. Anthropic processes this under its commercial terms, which by default don't allow it to train its models on API data. The office chat inside the app is also written with Anthropic, from the bots' trading data only.

We don't sell or rent personal data, or share it for cross-context advertising. We may disclose data if the law requires it, to protect the Service or people's safety, or as part of a sale or reorganisation of the Service (the new owner would be bound by this policy).

5. How long we keep it

• Membership records: while you're a member and for 12 months after your membership ends, then deleted.
• Payment and consent records: as long as we need them for accounting, tax and legal reasons, up to 7 years.
• Checkouts that were never paid: deleted after about a day.
• Support conversations: deleted 90 days after the last message.
• Your bot team: kept while you're a member and paused (not deleted) when your membership ends, so it's there if you renew; deleted together with your membership record 12 months after your membership ends, or straight away if you ask us to delete your data.
• Server backups: overwritten after 14 days.

6. Your rights

You can ask us to show you the personal data we hold about you, correct it, delete it, or give you a copy. Message the bot and ask for a person (Ava passes privacy requests straight to the operator). We'll reply within 30 days. We may keep payment records where the law requires it, and deleting your data ends your access. Depending on where you live (for example under the GDPR in the EU/UK, or state laws such as the CCPA in California), you may have further rights, including to object to processing and to complain to your data protection authority. We won't treat you differently for using your rights.

Where the GDPR applies, our legal bases are: performing our contract with you (membership and payments), our legitimate interests (security and preventing abuse), and legal obligations (accounting and tax records).

7. Security

Connections use HTTPS. Only members signed in through Telegram can open the app or its data. The server stores only the public address of the wallet that receives payments, never a private key, so it cannot move funds. Access to the server is limited and protected. No system is perfectly secure, but we work to protect your data and will tell affected members promptly if a breach puts their data at risk.

8. Age

The Service is for people 18 and older. We don't knowingly collect data from anyone under 18; if we learn we have, we delete it.

9. International users

We run the Service from the United States. If you use it from elsewhere, your data is processed in the United States.

10. Changes

We may update this policy. The version and date are at the top; for a material change we'll also announce it in the bot.