One person bought the course. Now you can see who's watching.
Protect for course creators in Telegram: a personal link for every buyer, channel entry only for people who paid, sessions and clear signals when an account gets shared. The decision is always yours.
Telegram protects the content. Code&Coffee protects the license.
- Beta Closed beta — courses in Telegram
- Soon Protect API
How it works
Two paths side by side: what you do and what happens on the student's end.
Opens their link
The bot recognises the purchase and grants access to the course.
Asks to join the channel
The bot approves only people who paid. A forwarded channel link gets nobody in.
Opens the materials
In a Telegram mini app. Every opening is a session with a device and a time.
Signals with points and reasons
The score is built from events, and every one is visible. No model, no hidden weights. Each signal has a cap: repetition matters, but not endlessly.
- Normal0–29
- Watch30–59
- Suspicious60–79
- High risk80–100
| Signals with points and reasons | Points |
|---|---|
| Concurrent sessions over the limit | +30 |
| Unusual region change | +20 |
| Rapid switching between sessions | +20 |
| Joined the channel after access was revoked | +20 |
| New device or browser | +15 |
| Many different networks | +10 |
| Someone else tried a one-time link | +10 |
You decide
A signal is a reason to look, not a verdict. Protect never blocks anyone on its own.
- Allow
All good. Past signals stop counting.
- Limit sessions
One session, strictly. Other open sessions are closed.
- Revoke access
Course access and open sessions are closed, the bot removes the student from the channel.
- Block
The student won't get access to any of your courses again.
The one exception is a course's strict mode: it won't open a session over the limit.
What Protect doesn't do
- It isn't DRM
- Screenshots, screen recording and a camera still work. A watermark with the student's name and disabled selection deter — they don't protect.
- No device fingerprinting
- No canvas, fonts or hidden identifiers. So the signals are coarse — and honest.
- No payments
- You send the link yourself after payment in your own system. There's no payment integration yet.
- Region means country
- There's no precise location, and there won't be.
What's stored
- Link and session tokens — hashes only.
- The bot token is encrypted with a key that isn't in the database.
- A subnet hash instead of an IP. The address itself isn't kept.
- Browser and network hash are erased after 90 days.
- Students of different creators are never linked to each other.
Protect API
The same model — license, session, signals, decision — for courses and products on your own site. It doesn't exist even in code yet: it's the next step.
The beta is closed
There's no open sign-up yet. When there is, this spot will hold a button, not a promise.
Back to home