Barsik Privacy Policy

December 29, 2025

Summary

Our Barsik app is built to operate within the Telegram ecosystem. We strive to be as transparent as possible about the data we process.

We do not sell your personal data. We collect the minimum set of information necessary to provide you with the app's services, including authentication via Telegram and processing transaction confirmations made by you in Telegram (Telegram Stars).

You can manage your data and request its deletion by contacting our in-app support or via Telegram.

1. Who We Are

The controller of your personal data is:
"KARTOMIN.COM" LTD EOOD (KARTOMIN.COM LTD EOOD), a legal entity registered in the Republic of Bulgaria.

Our principle is to collect only the information strictly necessary for the app to function.

Contact Information:

For general inquiries: [email protected]
For privacy and data deletion requests: [email protected] (or via in-app support)
Website: https://kartomin.com/
Legal address: Bulgaria, Sofia 1404, Zh.K. Manastirski Livadi, bl. 89B, ap. 7.

2. What Data We Process

We process data you provide directly and data we receive automatically when you use the app.

2.1. Data for Authentication and Account Operation

To log in and use the app, we use authentication via Telegram. As a result, we receive and process the following data from Telegram:

Your Telegram ID (a unique numerical identifier).
Username and/or first and last name from your Telegram profile.
Any other information you voluntarily provide via Telegram within the app's functionality.

These data are necessary to create and secure your unique account in our app, link your actions to the account, and enable functionality related to social interaction.

2.2. Technical Data (Automatically Collected)

When you use the app, we automatically collect some anonymized and aggregated data:

IP address of your device (may be considered personal data).
Device type, operating system version.
Data on app events and actions (e.g., screen opened, level completed) for analytics.
Anonymous data on crashes and errors for stable operation.

This information helps us understand how the app is used, find and fix errors, and improve performance.

2.3. Data Related to Payments (Telegram Stars in Telegram)

Barsik does not include built-in payments and does not process purchases inside the app itself. Purchases (if available) are made by you in Telegram using the Telegram Stars payment system (for example, via a Telegram bot or other Telegram interface).

We DO NOT collect, process, or store your bank card details or other financial credentials. All payment transactions are processed entirely by Telegram. From Telegram, we only receive:

confirmation of a successful transaction (or its status),
information about the virtual good/service you purchased (e.g., purchase type, number of Stars),

which is necessary to activate the corresponding feature or content in your Barsik account. Please review Telegram's privacy policy for information on payment data processing: https://telegram.org/privacy

2.4. Account and Identity Data

Depending on how you create your account, we store the identifiers and profile details needed to run it:

Your email address, name, phone number (if you provide one), and country/region code.
A generated internal reference code that uniquely identifies your account in our systems.
Provider sign-in identifiers, depending on the method you use to log in: your Telegram ID (as described in Section 2.1); your Apple account identifier and the email address Apple shares with us (which may be an Apple private-relay address); and/or your Google account identifier and email address.
For authentication, we issue access and refresh tokens (JWTs) to your device. These are held on your device; we do not keep them in our database.

We store only the identifiers for the sign-in methods you actually use.

2.5. Subscription, Billing and Payment Data

To provide and manage paid access, we store:

Your subscription details (plan, status, start and expiry dates, and whether auto-renewal is on).
Your orders and payment records (amount, currency, payment type, and status).
Store-specific purchase identifiers used to validate your purchase and prevent duplicate or fraudulent charges: for Apple, the original transaction and related transaction/product identifiers; for Google Play, the purchase token and related order/product identifiers; for Telegram Stars, the payment reference described in Section 2.3.
A reference to the fiscal receipt issued for your purchase by our fiscalisation provider, where required for tax and accounting purposes.

As stated in Section 2.3, we never collect or store your bank card number or full payment credentials — those are handled entirely by the relevant app store or payment provider.

2.6. VPN Service Data

BarsikVPN is a VPN service, so this section explains what we do — and do not — keep about your connection.

To deliver the service, we create for each of your devices a VPN configuration and a per-device digital certificate that assigns your device a private internal address inside the VPN tunnel (for example, 10.0.0.x, together with a matching internal IPv6 address). We also record which of our server hosts holds your configuration.

We do NOT log, monitor, or store the contents of your VPN traffic. We do not keep your browsing history, the websites or apps you visit, the destination servers you connect to, or your DNS queries. Like any VPN, our servers must process this information in memory momentarily in order to route your packets, but it is never written to disk, logged, or retained.

To operate and secure the connection, we keep only minimal service metadata: whether a device is currently connected, the network address your device connects to us from, and the time of your most recent connection.

2.7. Support and Family Data

If you contact us for support (through in-app chat, Telegram, or email), we process the messages and information you choose to send us so that we can respond and assist you.
If you use a family or group plan, we store the associations between the group owner, the group members, and the linked subscriptions so that shared access works correctly.

2.8. How We Detect a Previously Used Free Trial

We offer one free trial per person. To enforce this fairly and to prevent abuse — for example, deleting and re-creating an account to obtain repeated free trials — we use a privacy-preserving check:

When a free trial is granted, we take your sign-in identifiers (such as your email address, Telegram ID, and/or Apple or Google account identifier) and compute a one-way, keyed cryptographic hash (an HMAC) of them. We store only the resulting hash — never the identifier itself.
This hash cannot be reversed to recover your identity, and it cannot be used to contact you.
When someone requests a new free trial, we hash the incoming sign-in identifiers in the same way and compare them against the stored hashes. A match tells us that this identity has already used a free trial, so the new trial is declined. Paid subscriptions remain fully available in that case.

As explained in Section 4, this hash is retained even after your account is erased, on the legal basis of our legitimate interest in preventing abuse. See Section 4 for retention details.

3. Legal Bases for Processing Data

Contract Performance: Processing your Telegram ID, name, and purchase confirmation data is necessary to provide you with the core features of the app, fulfill our obligations (e.g., granting paid access/content), and support your account.
Legitimate Interest: Processing technical data (IP, crash analytics) is necessary to ensure security, stable operation of the app, its improvement, and protection against fraud.
Consent: In cases where it is explicitly required (e.g., for additional marketing communications, if any), we will request your separate and informed consent.
Legitimate Interest (fraud and abuse prevention): Enforcing our one-free-trial-per-person policy — including retaining a non-identifying hashed check of sign-in identifiers, as described in Sections 2.8 and 4 — is based on our legitimate interest in preventing abuse of the free trial.

4. Data Retention Periods

Your account data (Telegram ID, name, action history) is stored until you request its deletion.
Technical logs and aggregated analytical data may be stored in anonymized form for statistics and analysis for a longer period.
You can request the deletion of all your personal data by contacting our support: via the in-app chat, writing to us on Telegram, or sending a request to [email protected].

To prevent repeated sign-ups for the free trial, we retain a one-way, non-identifying cryptographic hash of your sign-in identifiers (such as your email address or linked social-account ID) even after your account is erased. This hash cannot be used to recover your identity or to contact you; it is processed solely to enforce our one-free-trial-per-person policy. Legal basis: our legitimate interest in preventing abuse.

5. Your Rights

In accordance with applicable legislation, including the General Data Protection Regulation (GDPR), you have the right to:

Request access to your personal data.
Rectify inaccurate data.
Delete your data ("right to be forgotten").
Restrict the processing of your data.
Receive your data in a structured, machine-readable format (right to data portability).
Withdraw previously given consent.
Lodge a complaint with the data protection supervisory authority in Bulgaria (Commission for Personal Data Protection).

To exercise any of these rights, please contact us at [email protected].

6. Data Transfers to Third Parties

We do not transfer your personal data to third parties for their independent marketing purposes.

We may transfer data to the following categories of recipients:

Service Providers (Processors): For example, our hosting provider Amazon Web Services (AWS) for our servers. Data is stored in the EU (for example, Sweden). These partners process data strictly according to our instructions.
Telegram: As described in Section 2.3.
By Legal Requirement: If required by applicable law, court, or competent government authorities.

7. Security

We take reasonable technical and organizational measures to protect your data from unauthorized access, alteration, disclosure, or destruction. However, no method of data transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Age Restrictions

Our app is not intended for children under 13. We do not knowingly collect personal data from users under the age of 13. If you are a parent or guardian and believe your child has provided us with their data, please contact us to have it deleted.

9. Policy Changes

We may update this Privacy Policy from time to time. The current version will always be available via the link provided in the app stores and on our website. Material changes will take effect upon publication of the updated policy. We recommend periodically reviewing this page.

Contact Us: For any questions regarding this policy and your data, please write to: [email protected] or contact support through the app.