What a Telegram bot can and cannot see
A bot answers in your group and you never added it. What did it just read? We checked Telegram's own bot documentation line by line, then checked three live bots' published data models against it.
Bot API behavior verified 2026-09-04 against core.telegram.org/bots/faq and core.telegram.org/bots/features. Bot data models sourced from each bot's own published documentation.
This is not a review of any one bot's trustworthiness. It's a read of what the platform technically hands a bot in three situations, plus what three specific bots say they keep. The examples are three of nine live bots from Tiny Telegram Tools, chosen because they all touch anonymity or private text, which is where "what does it see" matters most.
Privacy mode, the default filter
Every Telegram bot starts with privacy mode on. With it on, a bot in a group only receives commands addressed to it, replies to its own messages, and messages sent while it was the last bot to speak, not the group's general chatter.
Telegram's own FAQ spells out the exact list. With privacy mode enabled, a bot receives: commands explicitly meant for it (like /command@this_bot), a general command like /start if the bot was the last one to post in the group, messages sent through it (inline results, for example), and replies to anything the bot itself sent. On top of that, every bot, privacy mode or not, always gets service messages, everything from private chats with users, and everything from channels it belongs to. Bots never see each other's messages, in any mode.
Turning privacy mode off is a deliberate, admin-only action in BotFather. Only then does a bot see the full stream of a group's messages. Most single-purpose bots, including the ones checked below, have no reason to ask for that, and don't need it to run a command or answer a mention.
Guest Mode: answering without joining
Guest Mode lets a bot answer an @-mention in a group it was never added to. Telegram's own documentation states it sends the bot "a dedicated update that includes the summoning message and, when present, the specific message it was replying to," and explicitly, "Guest mode does not grant access to a chat's message history or participant list."
That's the whole payload: the one message that named the bot, and, if that message was itself a reply, the message underneath it. No scrollback, no roster of who else is in the chat, no standing membership that persists after the reply. Telegram also caps this at three guest bots mentioned in a single message. Telegram's docs draw a clean line between this and inline mode: inline mode is for fetching content a user then chooses to send themselves, one tap, no reply from the bot as itself; Guest Mode is the bot replying in the chat, as itself, off that single update.
Practically, that means a bot that only answers Guest Mode mentions and inline queries has no path to your group's history even if it wanted one. The platform doesn't hand it over. A step-by-step walkthrough of using Guest Mode as a group member, with a live example, is at Tiny Telegram Tools' Guest Mode guide.
Three access modes, side by side
| Mode | What the bot receives | Chat history | Member list |
|---|---|---|---|
| Privacy mode on (default) | Commands addressed to it, replies to its own messages | No | No |
| Guest Mode mention (not added) | The mentioning message, plus the message it replied to | No, by documented design | No, by documented design |
| Privacy mode off (admin-enabled) | Every message in the group | Only from when it joined, going forward | Yes, standard membership API |
None of these modes give a bot access to messages sent before it started receiving them. Telegram doesn't back-fill history to a newly added or newly un-privacy'd bot.
What three live bots actually store
Platform limits are one layer. What a bot's own backend keeps is a separate, bot-by-bot question, and the only honest way to answer it is to read that bot's published data model rather than take its word for it. Here's what three anonymity-adjacent bots from the same maker document about their own storage.
| Bot | Stores | Documented limit |
|---|---|---|
| WhisperLockBot | The locked message text, sender id and name, the tagged recipient, and a reveal count, so the card can be reopened later. | Only the addressed recipient and the sender can ever open the popup text; everyone else in the chat sees a sealed card, never the contents. |
| AnonInboxProBot | Incoming anonymous messages (owner id, sender id, body), an open-session marker, a link-open counter, and a block list. | The sender's identity is never shown to the owner on the free tier; Pro adds limited hints, not the sender's full identity. |
| AnonSayProBot | Each anonymous post (chat, message id, sender id, body), a per-group salt, a hashed-id cache for admin lookups, and a block list. | The sender's identity is hashed with a per-group salt and only surfaced to an admin via /reveal, never posted publicly; posts are purged after 30 days. |
Sender ids get stored even in "anonymous" flows, because someone has to be reachable if a reply or a ban needs to happen. What changes bot to bot is who that id is ever shown to, and for how long it's kept. AnonSayProBot's docs state a 30-day purge; WhisperLockBot's and AnonInboxProBot's published data models don't state a retention window, so that's a gap worth asking about rather than assuming either way.
What this audit doesn't cover
Server-side logging
Telegram's own server logs, and any hosting-platform logs a bot's backend runs on, sit outside what a bot's data model can tell you. This piece covers what the Bot API hands the bot and what the bot's documented schema keeps, not lower-level infrastructure logging.
Deleted messages
If a bot already stored a message before you deleted it in Telegram, deleting it client-side doesn't retroactively remove it from that bot's database. Whether it does depends on the bot's own deletion logic, which its docs may or may not state.
Third-party bots generally
The three bots checked here document their storage in detail because that's the standard we're holding them to. Most bots on Telegram publish no data model at all, which is itself the finding: read one before you trust a bot with anything you'd call private.
How we checked this
Platform behavior (privacy mode, Guest Mode's scope, the three-bot mention cap) comes from Telegram's own Bot FAQ and Bot Features pages, fetched and quoted directly on 2026-09-04. Bot-specific storage claims come from each bot's own published documentation on tg.zovo.one, not from source code review or a data request to the operator. Where a bot's docs didn't state a retention period, we said so rather than filling the gap with an assumption.
Frequently asked
Can a Telegram bot read every message in my group?
Not by default. Privacy mode is on until an admin turns it off, and while it's on, a bot only gets commands addressed to it and replies to its own messages.
What does a bot see when I @-mention it without adding it?
One update: the mentioning message, and the message it replied to, if any. No chat history, no participant list, per Telegram's own docs.
Does a Telegram bot know who is in my group?
Only as a full member with privacy mode off, admin-enabled, or through direct interaction with a user. A Guest Mode mention gives it neither.
What do anonymous-posting Telegram bots actually store?
Read the bot's own published data model. AnonSayProBot stores a hashed sender id per post and purges posts after 30 days; other bots' retention will differ.