Dev.to Security 🔐 Cybersecurity 👁 0 📖 4 min read

Why I built a bot that remembers what people delete — and what it taught me

It started in a café. At the time, things between my wife and me were difficult. Messages would appear in our chat and then disappear, and I kept wondering what I had missed. So, sitting there with a cup of coffee, I we

Why I built a bot that remembers what people delete — and what it taught me

It started in a café.

At the time, things between my wife and me were difficult. Messages would appear
in our chat and then disappear, and I kept wondering what I had missed. So, sitting
there with a cup of coffee, I went looking for a Telegram bot that could show
deleted messages.

I found one. It was free at first, then it asked me to pay — and honestly, what it did
was pretty basic. Then I found another one that was completely free and did more or less
the same thing.

And that's what made me stop and think. Why is it free?
A server costs money. Development costs money. Keeping thousands of people's private
messages safe costs money and effort. If nobody is paying for that, then what exactly
is the product — and who is it for?

The more I dug into it, the less comfortable I felt handing my private conversations
to a service that couldn't answer that question. So I decided to build my own, around
a few principles I actually care about:

  • security — your messages are encrypted and treated as yours;
  • honesty — clear about what the bot can and cannot do;
  • openness — talking to the people who use it, not hiding behind a landing page;
  • a good interface — something pleasant to use, not just a raw log.

That's how DeletedGuard began — a Telegram bot that keeps a copy of a message
when your contact deletes or edits it. I'm still working on it and improving it every week.

The rule I set on day one: no hacks

There are plenty of "see deleted messages" tricks out there: modified clients,
apps that read your phone's notifications, services that ask for your login code.
I didn't want any of that.

Telegram has an official feature called Chat Automation (part of Telegram Business,
no Premium needed). You connect a bot to your own account, choose which chats it
can see, and Telegram itself sends it the messages — including the events
"this was deleted" and "this was edited". No password, no codes. One tap to switch off.

That choice shaped everything else. It also means honest limits:
the bot cannot recover anything sent before you connected it. I put that on the
website in plain words, because a tool built on trust can't start with an overpromise.

What actually went wrong

I thought the hard part would be the features. It wasn't. The hard part was the
moments when the bot was quietly failing.

Messages lost to a database lock. In the early days I used SQLite. One handler
kept a write transaction open while it was waiting for a reply from the Telegram API.
Under load, other writes waited, timed out — and some incoming messages were simply
never saved. No crash, no error on screen. The lesson I now repeat to myself:
never hold a transaction open across a network call.

Telegram shipped something new. One day Telegram started sending a message type
my library didn't know yet. Instead of skipping one odd message, the whole update
fetch failed — and the bot went silent for hours. Now unknown pieces are cut out,
the message itself is saved, and I get a note "Telegram sent something new" so
I can catch up.


The scariest screen isn't mine. When you connect a bot, Telegram shows a warning
that the bot "manages your account". It's the single reason people named most often
for leaving. I can't change that screen — so I learned to explain, in my own words
and in their language, exactly what the bot can and cannot do.

What I measure

Early on I tracked "how many people connected the bot". It looked great and meant
nothing. A connection is not value.

The number I care about now is: did the bot actually catch a deleted message
for this person?
That's the moment the product exists for. Everything else —
notifications, the archive, the Mini App — serves that moment.

Where it is now

  • Python + aiogram 3, PostgreSQL (moved from SQLite this autumn), a React Mini App to browse the archive
  • stored messages are encrypted (AES-256-GCM), servers in the Netherlands
  • 11 languages, including Arabic and Persian — right-to-left layouts and Persian digits were a story of their own
  • groups too, not only private chats

Where I want it to go

I don't want to be "one more bot". I want DeletedGuard to be the tool people
can recommend without a disclaimer: honest about limits, careful with data,
and still working when something breaks at 3 a.m.

I'll be writing here about the things I learned the hard way — the bugs,
the measurements that proved me wrong, and building for people in eleven languages.
If you work with Telegram bots or Mini Apps, I'd love to compare notes.

Bot: @Deleted_guard_bot · Site: deletedguard.ru/en

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.