TeleGrab
TeleGrab saves media you are already looking at in your own Telegram Web session. The work happens in your browser, so there is very little for this policy to cover — but what there is, it covers in full, including the purchase terms for the one-time Pro licence.
Effective 28 August 2026 · Last updated 28 August 2026TeleGrab is a Chrome extension and this website, operated by PolySub (“TeleGrab”, “we”, “us”). We are the controller of the small amount of personal data described here. Questions about this policy, and any request about your data, go to hello.polysub@outlook.com. That address is monitored and is also where support and refund requests are handled.
If you read nothing else, read this. Everything below is the detail behind these five points.
All of this is local. It stays in your browser profile, we cannot read it, and uninstalling the extension or clearing site data removes it.
The scanner is deliberately DOM-only: it reads message elements that Telegram has already rendered in the chat you have open, in your own logged-in session. It does not call Telegram APIs, enumerate your chats, read a Telegram database, or reach into another browser profile. Scanning older messages happens only after you press the scan button, and is implemented by scrolling the chat you are already in. Captions, sender names and file details are read so the library can search, filter and export them, and they stay on your device.
If — and only if — you hold a Pro licence, the extension asks our licence endpoint whether that licence is still valid. The request body contains exactly two things: your random installation identifier and your current licence token. It contains no Telegram content, no file names, no email address and no browsing information. If our server cannot be reached, a paid licence keeps working offline until the cached token expires. On the Free plan the extension makes no network request to us at all.
One feature moves data rather than only pulling it in. “Send to Saved Messages” re-uploads the file TeleGrab just read to your own Telegram Saved Messages, from your own account, over your own connection. It is an upload to Telegram, not to us — we never receive the file, and no copy passes through our servers. Nothing happens unless you choose that action on a specific item.
These are not policy promises about restraint; they are things the extension has no code path and no browser permission to do.
Buying happens on this website, not in the extension. To create an order, deliver a licence and let you restore or move it later, we store:
Our payment provider, Beam, hosts the payment page and processes whatever you enter there. Card numbers, bank credentials and equivalent payment details go to Beam and are handled under Beam’s own privacy terms. TeleGrab never receives, sees or stores them. What comes back to us is the outcome: paid, refunded, or the identifiers above.
We email you for one reason: to deliver or restore your licence. Resend delivers a one-time activation link from our verified domain. Activation links expire after 30 minutes. We do not run a marketing list and will not add you to one.
This website sends a small set of server-side events to PostHog — checkout started, payment confirmed, licence activated, licence moved, recovery requested — so we know whether purchase and recovery are working. These events are keyed to an order or licence identifier, not to your installation identifier, and they never carry Telegram content, downloaded file names or message data. The extension itself sends no analytics anywhere.
This website is served by our hosting provider, which keeps standard request logs — including IP address and browser user-agent — for delivery, security and abuse prevention. The site itself sets no cookies at all — none for advertising, none for cross-site tracking, and none for analytics — and stores nothing in your browser. Your language is chosen by which address you visit, not by anything saved on your device.
We keep the list of companies that touch this data as short as we can. Each one acts as a processor for us, on our instructions, for the purpose named:
These providers may process data outside Thailand, including in the United States and the European Union. Where a transfer of personal data leaves your country, we rely on the provider’s own transfer safeguards — such as standard contractual clauses — and on the fact that the transfer is necessary to perform the purchase you asked us to complete.
Order and licence records are kept for as long as we support the lifetime licence you bought — that is what makes it possible to restore or move it years later — and after that only where tax, accounting, fraud-prevention or other legal obligations require it. Payment webhook events are kept for reconciliation. Analytics events are kept under PostHog’s retention settings. Local data on your device is kept until you clear it or uninstall the extension; we cannot delete it for you, and we never had a copy.
Where the GDPR, the UK GDPR or Thailand’s PDPA applies: we process your email, order and licence data because it is necessary to perform the contract you entered when you bought Pro; we process a small amount of licence, log and analytics data under our legitimate interest in preventing licence abuse and fraud, keeping the service secure, and knowing that purchase and recovery work; and we process anything else on the basis of your consent, which you may withdraw at any time.
Depending on where you live, you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or object to how we use it, or ask for it in a portable form. Email hello.polysub@outlook.com and we will respond within the time your law allows. Some purchase records may have to be retained after a deletion request where law or fraud prevention requires it, and we will tell you if that applies. You also have the right to complain to your data protection authority — in Thailand, the Personal Data Protection Committee; in the EEA or UK, your national supervisory authority.
Secrets stay on the server and are never shipped in the extension. Licence tokens are cryptographically signed and short-lived. Installation identifiers are stored as keyed hashes. Payment webhooks are signature-checked before they are trusted, and each event is processed once. Access to the licensing tables is restricted to the server. Activation links expire. No system is perfect, and if a breach ever affects your data we will notify you and the relevant authority as the law requires.
TeleGrab is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, write to us and we will delete it.
If we change this policy we will update the effective date at the top of this page, and for a change that materially affects how we handle your data we will say so on the site and, where we have your address and the law requires it, by email. Continuing to use TeleGrab after a change means the updated policy applies.
฿259 buys a one-time personal licence. It is not a subscription, it does not renew, and there is nothing to cancel. Pro is active in one browser installation at a time — not three profiles, and not tied to a Chrome account. Chrome sign-in is not required. You may move the licence to another computer by verifying your purchase email from the extension popup’s Restore purchase control; activating on a new computer deactivates the previous installation.
Free allows ten successfully downloaded or Saved Messages files per local day, whether handled one at a time or from a selection. Browsing, filtering, previewing and organising do not use quota. The counter lives on your device and resets each day.
Write to hello.polysub@outlook.com if something is wrong. An approved refund deactivates the associated Pro licence and returns that installation to the Free plan. Any mandatory consumer rights you have under the law where you live still apply, whatever this page says.
TeleGrab may only be used with accounts and media you are authorised to access. You are responsible for copyright, for the privacy of the people in what you save, for the rules of the chat or channel you saved it from, and for the law where you live. We may deactivate a licence used to breach these terms.
