# Telegram Phone Chat Safety Guide

TutorClaw offers phone chat via Telegram as an optional feature so you can interact with your assistant on the go. Because your assistant runs locally on your computer and has access to your system, keeping your connection secure is essential.

For more details on security standards and connection details, refer to the [TutorClaw Phone and Alerts Plan](./tutorclaw_phone_and_alerts_plan.md).

---

## 🔑 Bot Token Privacy
Your Telegram Bot Token (generated by @BotFather) acts as the connection key for your bot account.
> [!CAUTION]
> **Bot tokens must stay private.** If someone gets hold of your Bot Token, they can read your messages, impersonate your bot, and attempt to send commands directly to your local computer.
> Never share this token or include it in screenshots, public forums, or shared files.
> - **Test Phone Chat.bat** sends only a fixed safe test message. It does not send conversation history, edit your configuration, or start the full bridge.

---

## 🛡️ Allowed User ID Whitelist
By default, anyone on Telegram can search for your bot's username and attempt to start a chat. To prevent unauthorized access, TutorClaw enforces a strict whitelist so **only the approved user ID is allowed**:
- During setup, TutorClaw registers your unique, numeric Telegram User ID in your settings (`.env`).
- TutorClaw checks every incoming message. If the sender's ID does not match your whitelisted User ID, the message is immediately blocked and ignored.
- **Check Phone Chat Status.bat** lets you see whether phone chat is configured and displays a masked version of your whitelisted ID (e.g. `******4296`). The status check does not call Telegram.

---

## 🚫 Safe Communication Boundaries
- **No Perfect Privacy:** Phone chat may involve Telegram or another outside messaging service, so it should not be treated as perfectly private. Messages travel through third-party servers.
- **Do Not Send Sensitive Data:** Do not send passwords, credit card numbers, financial details, medical records, or highly sensitive information through phone chat.
- **Single-User Design:** Your bot is intended to be a private channel for you alone. Keep it unpublicized and do not share your bot's username or link publicly.
- **System Limitations:** The current version of TutorClaw does not support voice calling, SMS messaging, or always-on alerts.

---

## ⚙️ Safe Shortcuts & Control
TutorClaw provides simple launcher scripts in your project root to control your connection safely:
- **Check Phone Chat Status.bat:** Use Check Phone Chat Status.bat to see whether phone chat appears configured.
- **Test Phone Chat.bat:** Use Test Phone Chat.bat to send one safe test message to your approved phone account.
- **Start Phone Chat.bat:** Use Start Phone Chat.bat to start the phone chat listener.
- **Restart Phone Chat.bat:** Use Restart Phone Chat.bat if phone chat seems stuck. Close any old phone chat window first. (This restarter does not kill processes automatically; it simply prompts you to close any duplicate windows manually before launching the new session).

**How to Stop:** There is not yet a separate safe Stop Phone Chat.bat. For now, stop phone chat by closing the Phone Chat window or pressing **Ctrl+C** inside that window. Do not tell users to kill Python processes.

