Privacy Policy

Account information. When you sign in with Telegram we receive your Telegram user ID, your first/last name, username (if set), and profile picture URL. When you sign in with Google we receive your Google account ID, email address, name, and profile picture.

Activity. We store records of the videos you save to favorites, the videos you have purchased or watched, your subscription status, your credit balance, and your top-up and payment history.

Session & device. When you log in we record an opaque session token (stored in an HTTP-only cookie), the IP address that initiated the session, and a short device descriptor derived from the user agent (browser and OS). These let you review and revoke active sessions on the Sessions page.

Payment data. Top-up payments are processed by Xendit. We do not receive or store your card number or e-wallet credentials. Xendit shares with us the channel used (e.g. GCash, Maya, GrabPay, ShopeePay), the amount, and a transaction reference so we can credit your account.

• Authenticate you and keep you signed in.
• Deliver purchased or subscribed videos to your Telegram chat.
• Process top-ups, subscriptions, and per-video purchases.
• Personalize your home and favorites, and remember what you have watched.
• Maintain account security and prevent abuse.
• Provide support and respond to your enquiries.

Drama Leaks works alongside the Drama Leaks Telegram bot. When you link your Telegram account, the bot can send purchased videos directly to your private chat. The bot only reads messages you send to it (such as /start, /login, /link, or a 6-digit code) and only sends messages in response to your actions on Drama Leaks. We do not access your Telegram contacts, groups, or other chats.

We use a small number of strictly necessary cookies: a session cookie to keep you logged in and a role hint cookie used by our routing middleware. We do not use third-party advertising or tracking cookies. Some pages may keep short-lived flags in your browser’s session storage to avoid repeating one-time redirects.

We do not sell your personal information. We share data only with:

• Telegram— to deliver videos to your chat when you sign in with Telegram or link your Telegram account.
• Xendit— to process payments. Xendit handles your payment credentials under its own privacy policy.
• Google— when you choose Google sign-in, Google authenticates you and tells us the basic profile information listed above.
• Hosting and database providers we use to operate the service.
• Authorities or other parties when required by law, or to protect our rights, users, or the public.

We keep account and transaction data for as long as your account is active or as required for tax, accounting, or fraud-prevention purposes. One-time codes (login and link codes) expire automatically within minutes. Sessions expire after 7 days of inactivity and can be revoked at any time from the Sessions page.

You may review and update your profile, sign out of any device, and disconnect Telegram or Google at any time from your account page. To request a copy of your data, correct inaccurate information, or delete your account, please contact us using the details below.

Drama Leaks is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Material changes will be highlighted on the site.

Questions about this policy or your data? Email support@dramaleaks.com.