Telegram: a 5-minute privacy setup

For everyone using Telegram in Russia, Belarus or Central Asia, or chatting with people there.

The 5-minute minimum

• In Russia Telegram was restricted from August 2025 and almost fully blocked by 10 April 2026 (Meduza, citing OONI). Set up a way to reach your lawyer and family outside Telegram in advance: email, Delta Chat, a number on paper.
• Hide your number: Settings → Privacy and Security → Phone Number. 'Who can see my phone number': Nobody. 'Who can find me by my number': My Contacts.
• Turn on the cloud password: Settings → Privacy and Security → Two-Step Verification. Without it, your account can be hijacked with a code from an SMS. Choose a password you use nowhere else.
• Check your sessions: Settings → Devices. End unknown ones and turn on automatic ending of sessions, for example after a week without activity.
• Put a passcode on the app itself: Settings → Privacy and Security → Passcode Lock (on iPhone, Passcode & Face ID).
• For sensitive conversations turn on auto-delete: Settings → Privacy and Security → Auto-Delete Messages, or in the menu of a specific chat.

If you are at risk

• Forwarded Messages: Nobody, so forwarded messages don't lead to your profile. Calls → Use peer-to-peer: Nobody, so the other person won't see your IP address.
• Invites: My Contacts, so you can't be added to a chat that later turns up in a case. Last Seen & Online, Profile Photos, Bio, Date of Birth, Gifts: contacts only or nobody.
• Turn off Sync Contacts and tap Delete Synced Contacts: otherwise your phone book is stored on Telegram's server.
• Discuss the most important things in secret chats (not available in every app, for example not in Telegram Desktop): they are encrypted between the two phones and are not stored in the cloud. Regular chats, groups and Saved Messages are stored on the server.
• 'If Away For': you can choose a period after which the account is deleted together with your messages. If there is already a case against you, decide this with a lawyer.
• Stars you have already sent can be removed from the list of top senders: press and hold the Star icon under the post and turn off showing yourself. The history in your account will remain.
• According to First Department ('foreign agent'), the Telegram API can reveal your permanent ID, shared groups and non-anonymous paid reactions. If you sent Stars to channels of designated organisations, First Department advises creating a new account on a new number of your own. If a case has already started, delete the old account only after talking to a lawyer.
• For a trip to Russia or Belarus a separate account is safer. When you sign in to your main account on any phone, all channels, chats and history come back.

What not to do

• Never share a login code from an SMS or from Telegram with anyone, not even 'support', a 'bank employee' or a 'rights defender'. This is how accounts are hijacked.
• Don't follow links like 'vote for a child', 'confirm your account' or 'get a gift', and don't sign in to Telegram through third-party sites and bots. A 'Telegram security warning' in a secret chat from an unknown account is phishing.
• Don't react, send Stars or comment in channels of organisations designated 'extremist', 'terrorist' or 'undesirable'. Admins and other people see this, and criminal cases have already been opened over Stars.
• Don't install 'improved' Telegram versions from forwarded links: spyware is spread disguised as Telegram clients.
• Don't rely on 'delete for everyone': the other person may have taken a screenshot, or their phone may have been seized.
• If a case has been opened, a report drawn up or your phone seized, don't delete anything without a lawyer: deletion can be used against you and won't remove what the authorities have already copied.

What traces remain

• Regular chats, groups, channel lists, reactions and comments are stored on Telegram's servers and come back every time you sign in.
• Since September 2024 Telegram's privacy policy says it may disclose a suspect's IP address and phone number to authorities on a court order. The Supreme Court of Bashkortostan wrote in 2025 that Telegram gives data to Russian security services only in terrorist attack cases; more often data is taken from seized phones, from Stars and through provocateurs.
• The number your account is registered to is tied to a passport: it can be used to find the owner.
• Your Stars history is kept in the account and cannot be deleted.

current as of 26 September 2026. More: First Line: using Telegram more safely (updated 24.10.2024); OVD-Info: the risks of Telegram Stars (updated 24.09.2026) (foreign agent, extremist, on Rosfinmonitoring list); Telegram privacy policy, section 8.3; Mediazona: Bashkortostan court says Telegram cooperates with police only in terrorist-attack cases (18.03.2025) (foreign agent); Meduza: Telegram blocking became almost complete (12.04.2026, Russian) (undesirable); Teplitsa: how you get identified on Telegram even with a closed profile (12.08.2026) (foreign agent); First Department: what Telegram's API reveals about you (05.06.2026) (foreign agent); RESIDENT.NGO: two years of Telegram login-code phishing against users in Russia, Belarus and Kazakhstan (23.07.2026); First Line: safety in group chats