Trust & safety
What Miniapper checks before you submit
Run our compliance checker on demand before you submit your app to the Telegram App Center. It verifies HTTPS, deployment, content safety, Telegram-SDK integration, privacy, bundle size and more — some are Telegram requirements you'd otherwise have to remember, the rest are quality bars that keep your app from being throttled or removed later.
Required
HTTPS-only
Telegram WebApp requires the app URL to be served over TLS. Miniapper deploys to *.aisocialfarm.co with Let's Encrypt automatically.
CSP frame-ancestors allows Telegram
Generated apps include `frame-ancestors 'self' https://web.telegram.org https://t.me` so they can be embedded inside Telegram's WebView.
Server-side initData verification
Apps that authenticate the user verify Telegram's `initData` HMAC signature server-side using `WebAppData` as the key. We never trust client-supplied user IDs.
Stars / payment flow uses official APIs
Stars are issued via `Telegram.WebApp.openInvoice` and verified via `pre_checkout_query` on the bot. We never simulate Stars off-platform.
/paysupport command is wired up
Every bot we publish responds to `/paysupport` with refund instructions. Telegram's policy makes this mandatory for any bot accepting Stars.
Privacy policy link in-app
Apps must surface a working Privacy Policy link from a settings menu or main page. Miniapper auto-injects ours unless you provide your own.
Data minimisation
We only request the user fields you actually need (`first_name`, `id`). Phone, email, and exact location are off by default.
Content policy
Generated content is screened against Telegram's content policy: no adult, gambling-with-real-money (Stars excepted), illegal goods, or impersonation.
Recommended
Responsive across TG clients
Layouts adapt to iOS, Android, and Desktop chrome offsets. Safe areas are respected via `Telegram.WebApp.safeAreaInset`.
Honours TG theme + theme changes mid-session
Reads `themeParams` at boot and re-applies on `themeChanged`. CSS variables drive every colour so users get their dark/light/accent.
Haptic feedback on primary interactions
Light haptic on selectable items, medium on primary CTAs, success/error on irreversible actions. Skipped on Desktop where haptic is a no-op.
Best practice
Auto-localised in 11 languages
We auto-detect `language_code` from initData and switch — including RTL flip for Arabic/Hebrew/Persian. Your custom strings are translated by the AI on demand.