Privacy / WhoIsOnline

Privacy Policy

This page explains what WhoIsOnline uses to show Epic Games friends and presence in Telegram. The service is operated by Andrey Izman .

Information we receive

From Telegram, the bot may receive your user ID, username, first and last name, and the IDs and titles of groups where it is used. It also receives settings and the Telegram-to-Epic friend mappings you choose.

From Epic Games, it may receive your stable account ID, display name, friends’ account IDs and display names, online or away status, current game, rich presence, and platform information when available. The connection flow also processes authorization codes, access tokens, and device authentication credentials.

How we use and store information

Stable IDs link your accounts, friends, mappings, and optional group settings. Display names and presence are stored as a working cache so the bot can answer your requests. Encrypted Epic device authentication credentials are stored to maintain your connection. Access tokens are used by the connection process; the website does not display them in Telegram or on web pages.

The bot uses this information to identify your connected account, retrieve friends and presence, show selected activity to you, and provide group features only when you configure them.

Groups and sharing

Groups are optional. If you add WhoIsOnline to a group, its configured owner can choose which mapped friends the group may see. The bot does not publish your entire Epic Games friends list to a group by default.

Telegram processes messages you send to the bot and group messages where the bot participates. Epic Games processes the account connection and supplies account and presence data. The current bot shares friend presence with Telegram groups only through the group features you configure.

Retention and deletion

Information is kept while needed to provide the service, subject to legitimate operational requirements. Disconnecting Epic in the bot’s personal settings removes the stored Epic connection, its encrypted credentials, friend mappings, and cached presence for that connection. Group configuration can remain after disconnecting Epic. A full deletion request, including associated Telegram and group data where applicable, can be sent to the privacy contact below.

We do not state a fixed retention period for all data because it depends on the service’s actual operational requirements. We will review and update this wording as retention controls are finalized.

Security

Epic device authentication credentials are encrypted in storage. The website does not expose client secrets or authentication tokens to browser code. The bot limits group visibility to chosen mappings and uses access checks. No internet service can promise absolute security.

Your choices and contact

You can disconnect your Epic account in the bot’s personal settings. To ask about your information, request access or correction, or request deletion, contact privacy-whoisonline@mervick.dev . For general help, see Support.