Where your data goes
FinchGram connects to these, and to nothing else.
Telegram
Everything a Telegram app sends: your phone number when you log in, and your messages and files. It goes through TDLib, Telegram's own library, to Telegram's servers, as with Telegram's own apps. Telegram also learns the app's version and your Mac's model, system version and language, which it lists under your active sessions. Telegram's Privacy Policy applies.
GitHub, for updates
Once a day, at a random time, FinchGram asks GitHub whether there is a newer release, and downloads it when there is. GitHub sees your IP address, as with any visit. Turn off “Check for updates automatically” in Settings to stop it. GitHub's Privacy Statement applies.
WebDAV servers you add
The Downloads page connects only to the servers you add, with the account you give it, and only reads from them. With an http:// address, the password and the files cross your network unencrypted; use https:// beyond your own network.
AI assistants you allow
Only once you turn AI access on, and only what you let them see. More below.
There is no FinchGram server, so there is nowhere for the app to send anything about you: no analytics, no crash reports, no usage counts.
What stays on your Mac
FinchGram keeps its own files in ~/Library/Application Support/FinchGram/ and what it fetches for you in ~/Documents/FinchGram/; the files you save go to Downloads.
Chats and messages
tdlib/TDLib's database: the chats and messages Telegram sent, so that chats open at once. Encrypted as a whole, with a key of its own in your login keychain.
Photos, videos and files
media_cache/What Telegram sent, as plain files under Documents, where you can see them and clear them; what you clear is fetched again when you look at it.
Settings
settings.tomlYour preferences, including AI access: which chats, and what may be written.
FinchGram's database
finchgram.dbYour WebDAV servers with their passwords, and the apps you allowed or refused at AI access. Encrypted as a whole, with its key in your login keychain.
Keys, in the macOS Keychain
The keys of the two databases are in your login keychain, under FinchGram, where only this app reads them; a password is never in a plain file.
Two logs
downloads.logmcp.logWhat the download engine did, with addresses shown without the account and never a password; and which AI apps connected and what they asked for, never a message's words. Both stay small: they start afresh past a size limit.
What you save
Files from WebDAV servers go to
~/Documents/FinchGram/webdav, a folder per server, or to the folder you choose; photos, videos and screenshots you save go to Downloads.
To remove everything FinchGram keeps, quit it, delete the folders ~/Library/Application Support/FinchGram and ~/Documents/FinchGram, and in Keychain Access delete the items named “FinchGram”.
AI access
FinchGram is an MCP server: an AI assistant's app on your Mac, such as Claude Desktop, Claude Code or Cursor, can read your Telegram and act in it through FinchGram, with your account. It is off until you turn it on in Settings → AI access.
- You choose the chats an assistant may see: every chat except secret chats, or only the ones you pick.
- You choose what it may write: messages under your name, drafts for you to send, or nothing.
- The first time an app connects, FinchGram asks you whether to allow it, and remembers your answer for that app.
- Reading marks nothing as read, and secret chats are never shown.
- FinchGram keeps nothing for an AI, indexes nothing, and calls no AI itself.
What an assistant reads leaves FinchGram for that app, over a connection that stays on your Mac. The app usually passes it on to its AI service to answer you, and what happens there is up to that app and its privacy policy. Read it before you turn AI access on.
What FinchGram asks macOS for
Notifications
For new messages. Turn off “Message previews” in Settings to keep their words off the screen.
Screen Recording
Only for the screenshot tool (⌘⇧A). A screenshot stays on your Mac unless you send, copy or save it.
Keychain
To keep the keys of its two databases.
You can check all of this
FinchGram is open source under the GPL-3.0. Every release is built by GitHub Actions from the public source and signed, and the app checks the signature before it installs an update. What this page says can be checked against the code.
Read the source on GitHubThis website
finchgram.com runs on Cloudflare Workers. It sets no cookies, runs no analytics and loads nothing from other companies: its fonts and screenshots come from finchgram.com itself. Cloudflare, which serves it, sees each request as any host does and keeps its usual short-lived logs; Cloudflare's Privacy Policy applies to those.
Changes and questions
When this page changes, the date at the top changes with it. Questions about privacy: an issue on GitHub.
FinchGram is an unofficial client, not made by Telegram.