Telegram ships with strong defaults, but its most useful privacy controls are opt-in. Most people never open Settings > Privacy and Security, so they leave their phone number, last-seen time, and forwarded messages wide open to anyone who finds their account. Here is what to change, what those settings actually do, and where a purpose-built bot can cover a gap the app itself does not.

Start with Privacy and Security

Every setting below lives in one place: Settings > Privacy and Security. Change these five first.

Last seen and online status. By default, anyone can see when you were last online. Telegram lets you restrict this to your contacts or nobody. There’s a trade-off built in: if you hide your last-seen time from someone, you also stop seeing theirs. Telegram also shows approximate values (“recently,” “within a week”) rather than an exact timestamp once you tighten this, which cuts down on the kind of minute-by-minute tracking that makes people uneasy.

Phone number visibility. By default, your number is visible only to people you’ve already added as contacts. Go to Settings > Privacy and Security > Phone Number and lock this down further if you want. One catch worth knowing: if someone already has your number saved in their phone’s address book, they’ll see it on Telegram regardless of this setting, because Telegram matches contacts both ways.

Forwarded messages. Telegram lets you control whether your name links back to your account when someone forwards a message you sent. Set this to “Nobody” or “My Contacts” if you don’t want a forwarded message to double as a way for strangers to find your profile.

Two-step verification. This is the single most important setting on the list. By default, anyone who gets your SIM (via a stolen phone or a SIM-swap attack) can log into your Telegram account with just an SMS code. Two-step verification adds a password on top, so a stolen SMS code alone isn’t enough to get in.

Active sessions. Settings > Devices shows every device currently logged into your account. If you don’t recognize one, or you’ve lost a phone, terminate that session from here. It’s worth checking every few months even if nothing seems wrong.

Secret chats and self-destructing messages

Telegram’s standard chats are cloud chats: they sync across your devices and are stored on Telegram’s servers, encrypted, but not end-to-end. Secret Chats are different. They’re end-to-end encrypted, device-specific (they won’t show up if you log in on a new phone), and support a self-destruct timer on both text and media. Once a self-destructing message is opened, “the clock starts ticking the moment the message is displayed on the recipient’s screen,” and it’s removed from both devices when the timer runs out.

If a conversation genuinely needs to be private, use a Secret Chat rather than assuming a normal chat is good enough. Regular chats are still encrypted between your device and Telegram’s servers, but Telegram can technically access that content; Secret Chats are built so it can’t.

The privacy setting Telegram doesn’t have: talking to a bot

Everything above covers conversations between people. It doesn’t cover conversations with a bot, and that’s worth understanding before you type something sensitive into one.

Telegram’s own documentation on bot privacy mode explains that a bot with privacy mode enabled in a group only receives commands addressed to it, replies to its own messages, and messages sent through it, not the rest of the group’s chat. That’s a real and useful limit inside groups. But it says nothing about direct messages you send to a bot. A conversation with a bot is a regular chat, not a Secret Chat, so there’s no end-to-end encryption layer between you and the bot’s server. Whatever you send, the bot’s backend can read.

That’s not a flaw specific to any one bot. It’s how the Bot API works. The practical takeaway: treat a DM with a bot the way you’d treat a form submission on a website, not the way you’d treat a Secret Chat with a friend. Read what a bot’s privacy section says it stores before you rely on it for anything sensitive.

Two bots that work with this, not against it

Two bots on the Tiny Telegram Tools directory are built around that exact limitation, rather than pretending it doesn’t exist.

WhisperLockBot lets you post a locked message into any Telegram chat, group or otherwise, by typing its username inline and tagging who should read it. Everyone else in the chat sees a sealed card; only the person you addressed (and you) can tap it open. It’s not end-to-end encryption, and the bot’s own documentation is upfront that the message text is stored so it can be shown again when the recipient taps it. What it does solve is the day-to-day problem of writing something in a group that isn’t meant for the whole group. No admin rights are needed, and there’s a free tier of a few locked messages a day before it asks for a one-time upgrade.

AnonInboxProBot gives you a personal link you can share anywhere. Anyone who opens it and writes to you reaches your Telegram inbox without either side seeing the other’s username. You reply through the bot, and it forwards your answer back anonymously. Per its own privacy notes, incoming messages are stored so you can read and reply to them, and the sender’s identity isn’t shown to you on the free tier. If a message turns abusive, a Block button silently stops that sender without notifying them.

Neither bot claims to be encrypted end-to-end, because bots can’t be; that’s the Bot API limitation covered above. What they add is something Telegram’s default UI doesn’t offer: a locked message inside an otherwise open group chat, or an inbox that doesn’t require either side to hand over a phone number or username. Combined with the account-level settings at the top of this guide, they close a specific, narrow gap rather than promising more privacy than the platform can deliver.

The short version

Turn on two-step verification first; it’s the one setting that stops someone else from simply logging in as you. Then tighten last-seen, phone number, and forwarded-message visibility to match who you actually want to reach you. Use Secret Chats for anything that needs real end-to-end encryption. And remember that any bot, however well-designed, is a regular chat with a server on the other end. Read what it stores before you trust it with something sensitive.