Security first

Security first, in plain words

Each point below describes how KickThemBot works today, not a plan. Where a step needs you, it happens in your own Telegram account.

Your money

Payments go to you, not through us.

  • Card payments go to your own connected Stripe account, and USDT payments go straight to your own wallet. KickThemBot never holds your members' money.
  • Every Stripe webhook is checked against Stripe's signature before KickThemBot changes anything.
  • You get a Telegram message whenever a USDT wallet is added, changed or removed, USDT payments are turned on or off, or the buyer note changes.

Your bot and keys

Your bot token is encrypted. Keys are stored as hashes.

  • Your Telegram bot token is encrypted with AES-256-GCM before it is saved in our database.
  • AI agent tokens, pairing codes and project API keys are stored only as hashes, never in readable form.

AI agents

Your agent gets only what you approve.

  • An agent connects only after you check its name, code and permissions in @KickThemBot and tap Approve.
  • Member records, project API keys and USDT wallet proposals are Sensitive permissions. An agent must ask for them, and you see a warning before you approve.
  • An agent can never connect, change or disconnect Stripe. It can only send you a link, and only your own Telegram account can tap Connect Stripe in @KickThemBot.
  • An agent can only propose a USDT wallet or a buyer note. Nothing changes until you check the details in @KickThemBot and tap Confirm.
  • Send /agents to @KickThemBot to revoke one agent or all of them. Any project API key a revoked agent created stops working too.

Your members' data

Members get in once, and only while they have access.

  • Each chat invite link KickThemBot creates holds one member at a time, and a member's invite links are revoked when their access ends.
  • After access ends, KickThemBot removes the member from chats connected with its invite and ban rights.
  • Helpers you add see only the projects you share with them, and never your KickThemBot billing.
  • Database backups are encrypted and taken every night.
  • Close your account with /delete_account in @KickThemBot. Your account and member data are deleted 90 days later, and accounting records are kept as the Privacy Policy explains.

Reporting a vulnerability

Found a security issue? Tell us.

Email the steps to reproduce it to the address below. Please test only against your own account and data.

For what we store, why and for how long, read the Privacy Policy. What you and we agree to is in the Terms of Service. How agents pair and what they can do is on For AI agents.

Get started

Paid Telegram access, managed automatically.

Open the bot, connect one private group, and let the next renewal batch run without you.

Start Free

Free plan, no card required. Upgrade or stop whenever you want.

Opens Telegram. Starting the bot does not purchase a plan.