Privacy Policy

Effective date: 23 August 2026

Applies to: the Bileli Android app (kg.bileli.app), the Bileli iOS app, the Bileli web app (app.bileli.kg) and the website bileli.kg.

Bileli is operated by ИП Сарыев Нурумбет Маматисакович (individual entrepreneur, Kyrgyz Republic), publishing on Google Play and the App Store as Bileli ("Bileli", "we", "us"). Privacy questions: admin@bileli.kg.

This policy is published in Kyrgyz, Russian and English. If the versions differ, the Russian text prevails.

1. What Bileli is — and why this policy has two halves

Bileli is a learning platform for students and teachers in Kyrgyzstan. Our mobile apps are unofficial third-party Telegram clients: they are built on the Telegram API and are part of the Telegram ecosystem. They are not made by, affiliated with, or endorsed by Telegram.

This means the app does two different things with your data:

Messaging — chats, groups, channels, calls, contacts, stories, media you send, location you share — goes to Telegram's servers, exactly as with the official Telegram app, and is governed by the Telegram Privacy Policy.
Learning — courses, lessons, progress, practice, reviews, purchases, your Bileli profile — goes to Bileli's servers and is governed by this policy.

When you use messaging features, Bileli does not receive or store your messages, contacts, or call data. They go directly from your device to Telegram, protected by Telegram's MTProto encryption. We cannot read them.

2. Data we collect for the learning platform

2.1 Account data

When you sign in to Bileli through your Telegram account, Telegram hands us a signed profile and we store:

Telegram user ID
first name and last name
Telegram @username (if you have one)
profile photo (mirrored into your Bileli profile)
language code

If you sign in on the website with a phone number instead, we store your phone number and the one-time codes we send to it (codes are deleted after use or expiry).

We do not receive your Telegram password, your phone number from Telegram sign-in, your contacts, or your messages.

2.2 Learning data

courses and cohorts you enrol in, and the date you joined
lessons you complete and your progress through each course
answers to quizzes and practice questions, including which ones you got wrong (this powers spaced-repetition review)
study streaks and experience points
courses you mark as favourites
reviews and ratings you write
comments and replies you post in course discussions
approval records when you ask to join a course space

2.3 Purchase data

When you buy a course:

the payment itself is processed by Finik (a licensed payment provider in the Kyrgyz Republic) or, where offered, by Google Play or Apple. They handle your card or wallet details. We never see or store card numbers.
we store the order (course, cohort, amount, currency, time, payment status), the provider's transaction reference, the fiscal receipt, and any refund.
if you are a teacher who receives payouts, we store the bank or wallet details you give us for payment.

2.4 Technical data

your IP address, used for security and rate-limiting and recorded in server logs
app version, device type and operating system, sent with requests
error reports when something breaks (see Sentry under section 4)
a push-notification token — registered with Telegram's servers, not ours, because push notifications in a Telegram client are delivered by Telegram. The content of a push is encrypted with a key that never leaves your device.

2.5 Data stored only on your device

your Telegram session keys (so you stay signed in)
your Bileli sign-in tokens, stored in the Android Keystore / iOS Keychain
cached media, downloaded lessons, and app settings

This data stays on your device. Deleting the app deletes it.

3. Why the app asks for so many permissions

Because Bileli is a full Telegram client, it requests the same device permissions as Telegram. Every one is optional and is only used when you use the feature:

Camera, microphone — sending photos, videos and voice messages; voice and video calls
Contacts — finding people you know on Telegram (you can decline; the app still works)
Location, including background — sharing your location or live location in a chat, only when you choose to
Photos, videos, files — sending and saving media
Phone state — Telegram's "confirm by phone call" sign-in option (you type the digits yourself; the app does not read your call log)
Notifications — new messages and lesson reminders
Bluetooth — audio routing during calls
Biometrics — locking the app with fingerprint or face
Billing — in-app purchases, if and when offered

Bileli's learning features need none of these beyond internet access.

4. Who we share data with

We do not sell your data and we do not show ads. We share data only with the services that run the platform:

Telegram — messaging, sign-in verification, push delivery. Receives everything in the messaging half, a signed sign-in proof, and your push token.
Finik — course payments. Receives the order amount and reference; your payment details go to Finik directly, not through us.
Google Play / Apple — in-app purchases, where offered. They process the payment and send us a receipt; we never see your card details.
Google (Firebase Cloud Messaging, Play Services) — push-notification transport, maps for location sharing, on-device translation, sign-in protection (Play Integrity / reCAPTCHA). Receives your push token (via Telegram), device-integrity signals, and the map tiles the app requests.
Bunny.net — hosting and streaming lesson videos. Receives your IP address and which videos you stream.
Cloudflare — protects and accelerates our servers. Receives your IP address and request metadata.
Vercel — hosts this website (bileli.kg). Receives your IP address and request metadata when you visit the site.
Railway — hosts our servers and database. Holds all learning-platform data at rest in its data centres.
Sentry — error monitoring. Receives error reports, which may include your user ID and the request that failed — never your messages or payment details.

We may also disclose data when the law requires it, or to protect the rights and safety of our users.

We do not use any Telegram data to train AI or machine-learning models, and we never will — Telegram's terms forbid it and so do we.

5. How long we keep data

Account and learning data — while your Bileli account exists, then deleted within 30 days of a deletion request
One-time sign-in codes — until used, or 5 minutes
Sign-in tokens — access tokens 15 minutes; refresh tokens 30 days or until you sign out
Orders, receipts and refunds — as long as the tax and accounting law of the Kyrgyz Republic requires, even after account deletion
Server logs and error reports — up to 90 days
Anonymised statistics (e.g. how many students finished a course) — indefinitely; they no longer identify you

Your Telegram data is kept according to Telegram's policy, not ours.

6. Deleting your account

To delete your Bileli account and the data listed in section 2, email admin@bileli.kg with the subject "Delete my account", from the phone number or Telegram account you signed in with. We confirm the request and complete deletion within 30 days. (Deletion from inside the app is coming; until then, email is the way.)

Deletion removes your profile, learning data, reviews and comments. Purchase records are kept only as long as the law requires, then deleted.

Deleting your Bileli account does not delete your Telegram account. Your Telegram account, chats and contacts are separate and can be deleted at my.telegram.org/deactivate.

7. Your rights

You can ask us, at any time, to:

see the data we hold about you
correct it
delete it (section 6)
give it to you in a portable format
stop a particular use of it, or withdraw consent you gave earlier

Write to admin@bileli.kg. We answer within 30 days. If you believe we are mishandling your data you may also complain to the data-protection authority of the Kyrgyz Republic.

These rights follow the Law of the Kyrgyz Republic "On Personal Information" (No. 58 of 14 April 2008). If you are in a country with stronger rules, you keep those rights too.

8. Security

all traffic between the app and our servers is encrypted with TLS
sign-in tokens are stored in hardware-backed secure storage on your device and are short-lived
messaging is protected by Telegram's MTProto encryption, end to end in secret chats
we never store payment card data
access to production systems is limited to the people who operate them and is logged

No system is perfectly secure. If we learn of a breach affecting your data, we will tell you.

9. Children

You must be at least 16 to use Bileli — the same minimum Telegram sets. If you are under 18, use Bileli with a parent's or guardian's knowledge. If we learn that a child under 16 has created an account, we delete it.

10. Changes

We will update this policy when our practices change, and update the date at the top. Significant changes are announced in the app. The current version is always at bileli.kg/privacy/en (English), bileli.kg/privacy (Kyrgyz) and bileli.kg/ru/privacy (Russian).

11. Contact

ИП Сарыев Нурумбет Маматисакович, Kyrgyz Republic — admin@bileli.kg