Privacy Policy

Last updated: October 7, 2026 简体中文 繁體中文 English

Homeway (“we” or “us”) is operated by CHARMLOT PTE. LTD., a company registered in Singapore, and provides a network acceleration service for using supported Chinese video apps, including the homeway.tv website, the Homeway TV and mobile apps, and the Homeway browser extension for Chrome and Edge (together, the “Service”). This Policy explains what personal data we collect, why we collect it, who processes it, how long we keep it, and what rights you have. We process personal data in accordance with Singapore’s Personal Data Protection Act (PDPA); for users in the EU and the UK, we also explain the legal bases for processing and your rights as required by the GDPR / UK GDPR.

This English version is provided for convenience. If it differs from the Simplified Chinese version, the Simplified Chinese version prevails.

In short: we collect only the data necessary to provide the Service, charge for it and prevent abuse. We do not sell personal data or track you for advertising, and our apps and browser extension contain no third-party analytics or advertising SDKs (push notifications use only Google’s and Apple’s push services). We do not view or record what you watch in video apps.

1. Data We Collect

Account

• Email address: used for sign-in and to send you notices related to the Service.
• If you sign in with Google: your Google account identifier and email address. We do not obtain your Google password, contacts or any other Google data.
• Account status: registration time, account status, and whether you have already claimed the free trial.
• Sign-in sessions: used to keep you signed in. You can invalidate a session by removing the device under device management.

Devices

• Device name, platform (such as Android TV, iOS or browser), installation channel, app version, registration time, last active time, and the cumulative number of active days for each device and account (this is only a count; we do not keep a day-by-day record).
• Device identifier: we store the device identifier provided by the operating system in a non-reversible form, used solely to prevent the same device from claiming the free trial more than once.
• A usage credential for each device, which becomes invalid when the device is removed or your entitlement expires; and temporary activation codes used when you activate a TV by scanning a QR code.
• Camera: the mobile app uses the camera only when you scan the activation QR code shown on your TV. The image is recognized on your phone and is never uploaded or stored.
• Push tokens: after you sign in, the app obtains a push token for the device from Google (Firebase Cloud Messaging, Android) or Apple (Apple Push Notification service, iOS) and registers it to your device, so that we can send Service notices to that device (such as important announcements or a reminder that your subscription is about to expire). The token is used only for push notifications and contains no other information; it is deleted when you sign out or remove the device. Notifications are shown only after you allow the app to send them.

Subscriptions and Payments

• Your plan, subscription status and validity period, whether auto-renewal is on, and records of trials, redemption codes and manual activations.
• Payments are processed by Stripe. Payment information such as card numbers is submitted directly to Stripe; we cannot see and do not store full card numbers. We store the subscription and billing information Stripe provides (which may include your email address, name and billing country / region) to verify subscription status and provide after-sales support.
• In-app purchases: apps installed from Google Play or the App Store purchase subscriptions through the store. Charges are processed by Google or Apple and are subject to their privacy policies. We store only the purchase token, product, subscription status and the country or region of purchase returned by the store (not your store account or payment information), to activate, renew and verify subscriptions.

Network and Security

• IP addresses and access logs: used for rate limiting, abuse prevention, security auditing and troubleshooting. We also count, for each day, the number of active devices and accounts in each country or region. The country or region is inferred from the IP address and is counted only in aggregate figures that contain no personal identity; these figures are not stored in association with your account or device.
• Human verification: before sending a sign-in verification code, we use Cloudflare Turnstile for human verification, and Cloudflare processes signals from your browser and device for this purpose.
• Website local storage: the website stores your sign-in status in your browser. We do not use advertising or analytics cookies.

Acceleration Service

• The app handles only some network requests of supported video apps; traffic from other apps and web pages does not pass through us. The video itself does not pass through our servers.
• Requests that pass through us use encrypted connections. We do not decrypt the content, and we cannot see your video platform account, what you watch or the content of your requests.
• Server-side records: for troubleshooting, our servers record, for each request that passes through us, the domain (an API domain of a supported video platform, set by us), the time, the time taken at each stage and the amount of traffic, and keep these records for 30 days. By default, these records are not linked to your account or device; they are linked to your device only if you turn on “Performance logging” (see below).
• Per-platform aggregates: for each video platform, we count the daily number of requests, the time taken and the number of devices used. Device counts are de-duplicated on the relay servers and only the counts are kept; we do not keep which devices were counted, and the counts are not linked to accounts.
• Server address reports: to keep acceleration rules accurate, while acceleration is on the Android app anonymously reports the server addresses (domains and IP addresses) of supported video platforms. These reports are not linked to your account or device and do not include what you watch.
• Performance logs: to troubleshoot slow loading and slow playback start, while acceleration is on the app records the time taken by requests that pass through us, uploads these logs periodically and links them to your device. They contain only: the API domains of supported video platforms (set by us, not the URLs you visit), the time and duration of each request and the amount of traffic, the aggregate time taken by other traffic (without domains, addresses or the app it belongs to), route speed test results, and the app version, network type (Wi-Fi / cellular) and your country or region. They do not include the URLs you visit, traffic from other apps, your video platform account or what you watch. While this is on, the server-side records described above are also linked to your device. You can turn it off at any time on the account page in the app; once it is off, logging stops immediately, logs not yet uploaded are deleted, and server-side records are unlinked from your device.
• Crash information: while performance logging is on, if the app quits unexpectedly, stops responding or encounters an error, it uploads crash information the next time it opens, linked to your device: the error type and summary, the call stack (code locations within the app), the time it occurred, the app and operating system versions, and the device platform. It does not include the URLs you visit, what you watch or your video platform account, nor any connection credentials. It uses the same switch as performance logging; when that is off, nothing is uploaded and crash information on the device that has not yet been uploaded is deleted.

Browser Extension

• Only allowlisted websites are proxied: through the browser’s proxy settings, the extension sends only the domains of supported video websites (an allowlist set by us and updated with the Service) through our ingress servers; all other websites connect directly and do not pass through us. Requests to allowlisted websites also use encrypted connections, and we do not decrypt the content; the server-side records are the same as described under “Acceleration Service” above: only the domain, time, duration and amount of traffic, not URLs.
• No reading of web pages or browsing history: the extension does not read or modify the web pages you visit, and does not collect or upload your browsing history. It runs a script only on the homeway.tv sign-in page, to receive the sign-in handoff code. The extension requests access to all websites only because the browser requires that permission for the extension to supply this device’s proxy credentials automatically when our proxy server asks for authentication.
• Device information registered: when you sign in, the extension registers as a “browser” device. The device name is derived from the browser and operating system names (such as “Chrome · macOS”), together with the extension version and an identifier randomly generated at installation (not a hardware identifier).
• Stored locally: sign-in credentials, the device ID, the on/off switch, the most recently fetched configuration (including the allowlist and the list of ingress servers) and the most recent proxy error are kept in the browser’s extension storage and are not uploaded; they are deleted when you sign out. The extension periodically sends speed-test requests to our ingress servers to choose a route; the results are kept only on your device.
• Data collected by the extension is used only to provide the Service. It is not sold or transferred to third parties, not used for advertising or purposes unrelated to the Service, and not used to determine creditworthiness or for lending.

We do not collect: your real name (unless provided by Stripe), phone number, contacts, precise location, video platform account passwords, or viewing history.

2. Purposes and Legal Bases

We do not use your data for advertising, and we do not sell or rent it to anyone. If we send marketing emails in the future, we will ask for your consent first, and you can unsubscribe at any time.

3. Who We Share Data With

We share data only with processors that help us operate the Service, and we require them to protect the data as agreed:

In addition, we may disclose necessary data where required by law, in response to lawful requests from law enforcement or judicial authorities, or to protect the rights and safety of us and our users. If the company is involved in a merger, acquisition or asset transfer, data may be transferred along with the business, and we will notify you at that time.

Your accounts and viewing activity in video apps are processed by the respective video platforms and are subject to those platforms’ own privacy policies.

4. International Transfers

Our account data is stored in Singapore, and our servers and service providers may also process data in other countries or regions (for example, the United States). The network routes needed to provide the acceleration service relay encrypted connections through other regions; these routes do not receive your account data. We ensure that recipients protect data to a standard no lower than that required by the PDPA. For data of users in the EU and the UK, we rely on standard contractual clauses (SCCs) provided by our service providers, or equivalent safeguards.

5. Retention

• Account, device and subscription data and security audit records: kept for as long as your account exists. After you delete your account, we delete or anonymize them within 30 days, except that transaction and invoice records we are required by law to keep (generally for 5 years) are retained for the required period.
• Server logs (including IP addresses): generally kept for no more than 30 days.
• Performance logs and crash information: automatically deleted after 30 days, and deleted immediately when you delete your account.
• Push tokens: kept until you sign out, remove the device or delete your account.
• Backups: overwritten on a fixed rolling cycle and not kept long-term.

6. Security

We protect your data with measures such as encryption in transit, storing sensitive credentials in a non-reversible form, and access controls. No system can be perfectly secure. If a data breach occurs that may affect you, we will notify you and the relevant authorities as required by applicable law.

7. Your Rights

You can:

• access the personal data we hold about you and obtain a copy;
• correct inaccurate data;
• delete your account and related data (except data we are required by law to keep);
• withdraw consent, or object to processing based on legitimate interests;
• (users in the EU and the UK) request restriction of processing, exercise your right to data portability, and lodge a complaint with your local data protection authority.

In “My account” you can view your account information, manage and remove devices and manage your subscription. You can also delete your account yourself (at the bottom of the “My account” page on the website, or with “Delete account” at the bottom of the account page in the app). Please cancel any auto-renewing subscription before deleting your account. For other requests, email support@homeway.tv. We may first need to verify that you are the account holder (for example, by asking you to reply from your account email address), and we will respond within 30 days.

Deleting Some of Your Data (Without Deleting Your Account)

If you want to keep your Homeway account and delete only some of its data, you can:

1. Devices and credentials: remove a device under “Settings → Devices” in the Homeway mobile app or under “My account” on the website. The device is signed out immediately and its usage credential becomes invalid. To have the device record (name, platform, etc.) deleted, make a request as described in step 4.
2. Performance logs and crash information: in the Homeway mobile app, turn off “Send performance logs” under “Settings → Help improve Homeway” (in the TV app, use “Performance logging” on the account page). Logging stops immediately, logs on the device not yet uploaded are deleted, and server-side records are unlinked from your device. Logs already uploaded are automatically deleted within 30 days, or you can request immediate deletion as described in step 4.
3. Push tokens: sign out on that device or remove the device, and its token is deleted right away.
4. Other data: email support@homeway.tv from your account email address with the subject “Delete data”, stating which data you want deleted (for example, performance logs, sign-in and security audit records, or your Google sign-in link). After verifying that you are the account holder, we will delete the data and reply within 30 days.

So that we can keep providing the Service, your account email address and your current subscription and its validity period are kept until you delete your account; the device identifier used to prevent repeated trial claims (stored in non-reversible form) is not deleted along with the device; and transaction and invoice records we are required by law to keep are retained for the period set out in Section 5. To delete your entire account, see above.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data. Minors should use the Service only with the consent and assistance of a parent or guardian. If you believe we have mistakenly collected data from a child, please contact us to have it deleted.

9. Changes to This Policy

We may update this Policy as the Service changes, and we will change the “Last updated” date at the top of this page. We will notify you of material changes by email or in-app notice before they take effect.

10. Contact Us

CHARMLOT PTE. LTD. (Singapore)
Email: support@homeway.tv (please also use this address for data protection matters)