Telegram
What the default settings do
Telegram is often assumed to be end-to-end encrypted like Signal or WhatsApp, but by default it is not. Regular conversations, called cloud chats, are encrypted in transit and at rest on Telegram’s servers using Telegram’s own MTProto protocol, with decryption keys split across data centers. That protects messages from casual interception, but Telegram itself technically retains the ability to access cloud chat content, not just an outside attacker. Only Secret Chats, a separate and opt-in chat type, use genuine end-to-end encryption, and they are device-specific rather than cloud-synced, so one started on your phone will not appear on a linked desktop.
Beyond encryption, a few visibility settings default to sharing more than expected. Last seen status and profile photo are visible broadly out of the box, and forwarded copies of your messages link back to your account unless changed. Groups are also open by default, so anyone with your phone number can add you to one without asking first.
It is also worth knowing about a real policy change. In September 2024, after his arrest in France, Telegram founder Pavel Durov announced that, in response to a valid legal request from judicial authorities investigating a suspect in a criminal case, Telegram may disclose that user’s IP address and phone number to authorities. Previously, disclosure was limited to confirmed terrorism cases. This applies to account metadata, not to Secret Chat content, which Telegram states it cannot access at all.
A reasonable privacy baseline
These settings are found in Settings → Privacy and Security within the Telegram app, unless noted otherwise.
Truly private conversations
Secret Chat → Use for sensitive one-on-one conversations (open a contact's profile → the ⋮ menu → Start Secret Chat, or "New Secret Chat" from the compose menu)
Secret Chats are the only Telegram chat type with genuine end-to-end encryption, plus optional self-destruct timers on every message. They live on a single device and are not backed up to the cloud, so switching phones or reinstalling the app will lose them. For anything you would not want stored on a server, a Secret Chat is the right tool, not a regular chat with a strong account password.
Visibility controls
Phone Number → My Contacts or Nobody (Settings → Privacy and Security → Phone Number)
Controls who can see your number directly. A related option, for who can find your account by searching for your number at all, appears once this is moved off "Everybody." Restricting both is the closest Telegram gets to keeping a number private.
Last Seen & Online → My Contacts (Settings → Privacy and Security → Last Seen & Online)
Visible broadly by default. Restricting it to contacts stops strangers from tracking when you are active, though this is reciprocal: you lose last seen visibility for anyone outside that group too.
Profile Photo → My Contacts (Settings → Privacy and Security → Profile Photo)
Limits your profile photo to people already in your contacts, rather than anyone who opens a chat with you or finds your username in a group.
Forwarding and group additions
Forwarded Messages → My Contacts or Nobody (Settings → Privacy and Security → Forwarded Messages)
By default, a forwarded message includes a clickable link back to your account. Restricting this still shows your name on the forward, but it is no longer clickable, making it harder to trace back to your profile on its own.
Groups & Channels → My Contacts (Settings → Privacy and Security → Groups & Channels)
By default, anyone with your phone number can add you directly to a group or channel. Restricting this to contacts means everyone else must send an invite link instead. Telegram Premium subscribers can still add you regardless of this setting.
Security
Passcode Lock → On (Settings → Privacy and Security → Passcode Lock)
Requires a PIN, passcode, or biometric unlock to open the app, depending on your device. It is not enabled by default and matters most if your phone is shared, lost, or picked up while unlocked.
Two-Step Verification → Enabled (Settings → Privacy and Security → Two-Step Verification)
Also called a cloud password, this requires a password in addition to the SMS code when your account is registered on a new device, protecting against SIM-swap attacks and intercepted login codes. Telegram also asks for a recovery email during setup; store it safely, since losing both can permanently lock you out.
Message retention
Auto-Delete Messages (Global) → Choose a duration, for example one month (Settings → Privacy and Security → Auto-Delete Messages)
Sets a default expiration timer for all new chats and groups going forward. It does not apply to conversations already open, and it is separate from the self-destruct timers inside Secret Chats.
Per-Chat Auto-Delete Timer → Set individually for existing sensitive chats (open the chat → tap the contact or group name → Auto-Delete Messages)
Because the global timer only covers chats started after you turn it on, existing conversations need their timer set individually, worth doing for any chat holding information you would rather not have sitting on a server indefinitely.
Trade-offs
- Restricting Last Seen & Online to contacts means losing visibility into when people outside that group were last active, since the rule is reciprocal.
- Setting Groups & Channels to “My Contacts” means unfamiliar people must send an invite link instead of adding you directly, and Premium subscribers can bypass the restriction entirely.
- Turning off the forwarded-message link does not stop your name and message text from being forwarded and read; it only removes the clickable link back to your account.
- A Secret Chat lives on one device only. Switching phones or reinstalling Telegram will not carry it along, and there is no cloud backup to fall back on.
- Passcode Lock and Two-Step Verification add a small amount of login friction, and a forgotten two-step password without the recovery email can lock you out entirely.
- Auto-delete timers are permanent once a message expires, with no recovery for anyone in the chat.
Who should not change these settings
- If you use Telegram mainly for public channels, community groups, or as a business contact point, keeping your number and profile visible to a wider audience may be the point of using it that way.
- If you rely on being easy to add to groups for work or events organized by people outside your contacts, restricting group additions means missing some invitations.
- If you regularly need to prove authorship of a forwarded message, for example confirming you are the source of a public announcement, keeping the forwarded link on preserves that attribution.
- If you already treat Telegram as a casual channel and use Secret Chats or another app for anything private, the cloud chat defaults may not matter much to you.
- If losing account access through a forgotten two-step password and inaccessible recovery email would be worse than the security benefit, passcode lock alone is a reasonable choice.