Privacy Policy — @scamlist

Last updated: 27 October 2026

Covers the intake bot @proofscambot and the watchdog bot that group administrators add to their own groups. It applies instead of Telegram's Standard Privacy Policy for Bots and Mini Apps.

Who we are

@scamlist is a public database of accounts listed after a closed forum decision or a moderation evidence review concerning OTC deals. Contact: Support → Write to support inside @proofscambot.

What the watchdog sees

Telegram gives an administrator bot every message in the group — there is no setting that shows a bot only some of them. The watchdog receives all messages and discards all of them except what is listed below.

What we store

For a connected group: its id and title, who connected it, its settings. For a member who matches the database: their id, their username at the time, the id of the matching message and of the matching entry. For administrators' decisions: what was done (deleted, muted, banned, vouched for), by whom, when.

For an account listed from the forum: its public Telegram account (from the claim or from its lolz profile) and, for moderation only, the other public contacts in its lolz profile (Discord, VK, Steam, Matrix, GitHub, website). Never phone numbers, e-mail addresses, names or free-text profile fields; only the Telegram account can appear in a post.

Earlier usernames of a listed person. For a person who is in the database, we keep the usernames we have seen for their Telegram id — from the entry, the reports about it, Telegram's answer when we looked a name up and the watchdog when they wrote in a connected group — with the dates we first and last saw each. We use them only to show «🔁 Other usernames of this account: …» (up to five other usernames) in @proofscambot when someone checks that person, and to the moderators; they are not put in channel posts. We keep them for as long as the entry is kept. Usernames of people who are not in the database are not kept.

For @proofscambot: your Telegram id and language; the time you tapped «✅ Check subscription» (the bot is for subscribers of @scamlist, and that tap accepts the rules and this policy — whether you are subscribed is asked from Telegram and remembered for half an hour only); the reports and disputes you file, with the files and links you attach; their status (My account); support tickets and ad orders. Kept while the case exists; removal records (date, reason, moderator) are kept so a removed case is not re-posted.

Following an account. If you add people to your list in @proofscambot, we store your Telegram id, each listed account's Telegram id and last seen username or its lolz.team account, the private label you may add, and timestamps (when you added the account and when a notification was sent). We use this only to send you notifications about public events: an arbitration claim on lolz.team that has the account as defendant or names it, and an entry added to or removed from @scamlist. We never tell a listed person — or anyone else — who has them on a list or how many people do. Your notification switches are stored until you change them.

Paid places on your list. If you buy more places for «🔔 Following», we store a record of each purchase: your Telegram id, the number of places, the price, the date of the purchase and, if it was refunded, the date of the refund and which administrator made it. The payment itself is a line in the history of your balance in the bot (amount, reason, time); we take no card details and no other payment. A top-up is arranged with @cyberpolice: you give your id and the amount, and the balance is credited by hand. These payment records are kept permanently — also after you remove everyone from your list or block the bot — so that a refund or a question about a payment can always be checked. They contain nothing about the people on your list.

Public lolz.team profiles. When you check a lolz.team nickname or profile link, or have a forum account on your list, we keep a copy of that account's public forum profile: nickname, forum status and the forum's own wording of a ban, registration and last-visit dates, counters (sympathies, likes, messages, giveaways, trophies), the occupation field without links or contacts, the Telegram field, the titles of pinned threads, the avatar link and the number of claims. It is used only to recognise what was checked and to show the profile in your private «🔔 Following» card — the avatar appears there and nowhere else, never in the channel or in groups. It is refreshed after 6 hours, kept while the account is on someone's list or behind a live entry and 7 days after that, and deleted at once when the forum no longer shows the profile.

CAS spam flag. When a check in @proofscambot (in the bot or inline) is about a Telegram account whose numeric id is known, that id — and nothing else, not who is checking — is sent to cas.chat (Combot Anti-Spam, CAS), an outside anti-spam service. CAS answers whether it has banned the account as a spammer and, if so, how many offences it counted; when it has, the result shows «🟠 CAS: flagged as a spammer», which is about spam, not fraud, and does not change the verdict. We keep only that answer (the id, banned or not, the offence count and the time) for 24 hours, then delete it. Administrators can switch the check off in the bot's settings.

We do not store the text of group messages. A flagged message is referenced by id so an administrator can open or delete it; the content stays in the group. For a member who does not match, nothing is stored at all.

What the group sees

The bot never names anyone in the group. Its public notice is: «⚠️ A member who just wrote is flagged in the @scamlist database. Administrators have been notified.» Usernames, complaint counts and amounts go privately to the group's administrators only.

Why

To review reports and disputes and publish entries; to run the service the group asked for; to keep the record that lets a wrongful listing be challenged on evidence; to bill, because the watchdog is a paid service.

How long

Group settings and allowlists: while connected, and after disconnection so a group re-adding the bot keeps its allowlist — deleted immediately on the owner's request. Incident and decision records: 24 months. Case records, evidence and removal logs: while the entry stands, and after removal for as long as needed to prevent a re-post and to defend a claim. Earlier usernames of a listed person: as long as the entry is kept. A follow record is deleted when you remove it, or after 90 days in which the bot could not reach you (for example, because it was blocked). A saved lolz.team profile: see «Public lolz.team profiles». A CAS answer: 24 hours.

Entries in the database

An entry is not deleted on the request of the person it is about: retention is necessary for the establishment and defence of legal claims and for the public interest in preventing fraud. What a listed person can do — and what we will do:

Dispute it. Open @proofscambot → «Dispute an entry». A moderator reviews it within 7 days. If the dispute is upheld, the posts are removed from the channel; the internal record keeps the date, the reason and who decided, so the case is not re-posted by mistake. A removed person is reported as «not in the database».
Source lifts its decision. When the forum behind a case lifts its ban or restriction, the posts are removed after a re-check and a second confirmation ten minutes later; administrators are notified first and may hold the removal for up to 30 days, after which the profile is re-checked again.
Correct it. A wrong username or id is fixed on request through «💬 Support» in @proofscambot.
Ask what we hold. Through «💬 Support» in @proofscambot.
Be vouched for locally. A community that trusts someone can silence the warning in its own group; our database is unchanged.

We do not sell, rent or transfer data to third parties. Data leaves our systems in three ways only: what is published in the channel (the public identifiers of a listed account and the evidence behind the entry), the private notice to administrators of a group that installed the watchdog (username, matching entries, amounts), and the Telegram id of a checked account sent to cas.chat for its spam flag (see «CAS spam flag»). Advertisers receive aggregate audience figures only, never anything about an individual.

Security

Data is stored on access-controlled servers with backups kept offline. We notify affected users of a breach.

Changes

If what either bot collects changes materially, this page is updated first; connected group administrators are told before it takes effect and may switch the watchdog off.