Privacy Policy

Effective date: November 9, 2026

This Privacy Policy explains how Maqsudjon Polatov (“Ferra”, “I”, “me”) handles information when you use the Ferra iOS app, Telegram Mini App, backend service and related website. Ferra is an AI-agent app; it is not a service operated by Apple, Telegram or OpenRouter.

1. Information Ferra collects

Account information

When you sign in with Apple, Ferra receives and verifies an Apple identity token. The backend stores your Apple user identifier, an internal account ID and your language preference. Your display name and email address are stored if Apple provides them; this can include an Apple private relay address. Ferra never receives your Apple password.

When you use Ferra’s Telegram Mini App, the backend verifies the signed Telegram initData using a server-held bot token. It stores your Telegram user ID, display name and language preference. Ferra does not receive your Telegram password, phone number, contacts or Telegram messages. Telegram’s own privacy terms apply to its platform and account processing.

Agents, conversations and selected images

Ferra stores the agent names, tasks, selected model IDs, chat threads, messages, AI responses, tool requests, approval decisions and native action outcomes needed to provide the app. Images you explicitly select are stored as message attachments on Ferra’s backend so they can be shown in the chat and sent to the model you selected. A report is linked to the reported AI response and includes the reason and any details you choose to submit.

Your OpenRouter key (BYOK)

If you choose to connect your own OpenRouter API key, it travels over HTTPS to Ferra’s backend, is validated with OpenRouter and is stored encrypted using a server-held encryption key. The plaintext key is not stored on your iPhone and is never returned by the API after you submit it. Ferra’s iOS app stores only its own session token in the device Keychain; the backend stores a cryptographic hash of that session token. The Telegram Mini App stores the Ferra session token in its browser or WebView’s local storage, not your OpenRouter key.

Usage and service information

Ferra records model IDs, request counts, prompt and completion token counts, model-reported cost, free-allowance usage and timestamps. The hosting service may process standard operational logs such as IP address, request time and requested route for security and reliability. Ferra does not request access to your precise location, contacts, camera or microphone. Images are selected with Apple’s Photos Picker, which does not grant Ferra access to your entire photo library.

2. How information is used

• To authenticate you and maintain your session.
• To create agents, maintain chat history, process selected images and request AI responses.
• To enforce the daily free-message limit and show your usage.
• To filter prohibited content and receive, hide and review reported responses.
• To prepare an email or message after your approval and record whether you sent, cancelled or could not complete it in the native app.
• To secure, troubleshoot and improve the service, and to meet legal obligations.

3. AI processing and third parties

Apple provides Sign in with Apple and the optional Mail or Messages composer. Apple’s own privacy terms apply to those services.

Telegram provides the Mini App platform and signed account data used to authenticate you. Telegram’s own privacy terms apply to its account and platform processing.

OpenRouter and its model providers receive the content needed to answer your request. This can include your message, selected image, relevant conversation history, your agent’s name and task, and tool instructions. Proposed tool arguments can include an intended recipient, subject and content; Ferra does not perform the external action before your approval and any required native confirmation. Model providers have their own data-retention and training policies. Do not submit sensitive information or images that you do not want processed by an AI provider.

In free-start mode, requests may use the developer’s OpenRouter account, subject to the server-side daily allowance. In BYOK mode, requests use your own OpenRouter account and its charges and terms apply to you.

For email and message actions, Ferra stores the proposal, your approval decision and the reported native outcome. When a server-side connector is not configured, Ferra opens Apple Mail or Messages and you choose whether to send. The native provider processes the recipient and content only when you proceed under its own terms. Ferra never treats a proposal or an approval alone as proof that a message was sent.

Cloudflare hosts Ferra’s backend and D1 database. Infrastructure providers may process operational information as needed to deliver and protect the service.

Ferra may disclose information if required by law or reasonably necessary to protect users, the service or the public. Ferra does not sell personal information or share it for cross-context behavioral advertising.

4. Retention and deletion

Your account and app content, including selected image attachments, are kept while your account is active. Sessions expire after 30 days and can be ended sooner by signing out. You can delete individual agents and chats in the app.

To delete your entire account, open Settings → Delete Account in Ferra. This removes your account, agents, chats, messages, image attachments, pending actions, reports, usage history, sessions and encrypted OpenRouter key from the active Ferra database. You can also request deletion by emailing the address below. Temporary infrastructure logs or backups, where maintained by the hosting provider, may expire separately under that provider’s retention schedule; deleted accounts are not intentionally restored to the active service.

5. Security

Ferra uses HTTPS in production, verifies Apple identity tokens against Apple’s public keys, encrypts stored BYOK credentials and limits API and attachment access to the owning account. No system is perfectly secure, so Ferra cannot guarantee absolute security.

6. Children

Ferra is not directed to children under 13. If you believe a child under 13 has provided personal information, contact me so I can review and delete it where required.

7. International processing

Apple, OpenRouter, model providers, Cloudflare and native delivery providers may process information in countries other than yours. Their processing is subject to their own terms and applicable safeguards.

8. Your choices and rights

You choose whether Apple shares your name and email, what Telegram includes in Mini App initData, whether to connect a BYOK key, which images to select and whether to approve or confirm an external action. You can remove your BYOK key, delete content or delete your entire account in the app. Depending on where you live, you may also have legal rights to request access, correction, export or deletion. Contact me to make a request.

9. Website and Mini App

The Ferra landing and legal pages do not use cookies, advertising trackers or analytics scripts. The Telegram Mini App stores the Ferra session token in browser or WebView local storage; it does not store your OpenRouter key on the device. The developer’s main tou.gg website may have separate privacy practices; this policy covers the Ferra app, Telegram Mini App, API and pages under tou.gg/ferra.

10. Changes

If this policy changes, the updated version will be posted here with a revised effective date. Material changes may also be communicated in the app where appropriate.