CourseVault
A closed learning platform inside a Telegram bot. Native DRM blocks forwarding, saving, screenshots, and screen-recording — course authors stop losing 50% of revenue to leaks.
The problem we were hired to solve.
Authors split bad options: build a custom site (thousands of dollars, ops headache, students still pirate the videos a week in), use a generic LMS platform (watermark gets cropped, files still leak), or run a Telegram channel (zero protection, files spread in minutes). Whichever path they picked, half their work ended up free on Telegram within twenty-four hours.
One bot. Lessons unforwardable, unsaveable, unscreenshotable on mobile. Access toggle by @username. Students learn from the same app they already check ten times a day. The author keeps the revenue.
Context
Course authors in 2025–26 lose up to 50% of revenue to pirated material. Lessons end up on group-buy networks within hours of launch — sometimes before paying customers even finish onboarding. Custom course sites cost thousands to build and maintain. Plain Telegram channels offer zero copy protection. Consumer LMS platforms cap at watermarking that anyone can crop out. The brief was a course platform that ships in days, lives where the audience already is, and shuts down the leak channels at the protocol level — not after the fact.
Approach
A closed learning platform inside a Telegram bot — the messenger turned into a hardened LMS. Bot core on Node.js + grammY. MongoDB stores course structure (modules, lessons, media references) and the student roster. The DRM layer is built on Telegram's native protect_content flag: every lesson message is sent with no-forward, no-save, no-copy enforced server-side. On mobile clients, screenshots and screen-recording are blocked at the OS-IPC level — Android marks the lesson view as FLAG_SECURE, iOS receives the protected-content signal that the system honors. Module-and-lesson navigation feels like a site — owner-controlled menu, breadcrumb back, no external links that could leak the lesson elsewhere. The owner admin panel lives inside the bot itself: grant or revoke access by @username or numeric ID with one tap, view the access roster, audit who has watched what. Only users on the access list see the content. Non-paid users hit a paywall message and never see a single lesson byte.
How this project was actually made.
Every project leaves a paper trail. Figma comments, Notion specs, GitHub history, Vercel deploy logs, Telegram threads, first-week analytics. Numbers below are real and available on request under NDA.
◆ Screenshots of any artifact available on request. Confidential details redacted.
Key features
- ◆
- ◆
- ◆
- ◆
- ◆
Results
Course author got full distribution control. Zero files leaked to group-buy networks since launch. Students access their courses straight from their phone — no separate app to install, no login flow, no password reset loop. The ~50% revenue leak the author was used to absorbing is closed. The author manages the entire roster from inside Telegram — no separate dashboard to log into, no spreadsheet to maintain.
Tech stack
What the client said.
Lost half my course revenue to leaks for two years before this. Switched to the bot in a week. Zero files leaked since launch — and students actually prefer it because it lives in the same app they already use ten times a day. The work I put into recording finally pays for itself.