Everything accounted for.
A one-time code goes to Telegram next. Sessions last 30 days, encrypted with AES-256-GCM.