Privacy Policy

1. Who Decides Why and How We Process Your Personal Information

We determine why and how we process your personal information, and we are responsible for your personal data as the data controller (or data user, as defined in your jurisdiction). Where required by local law, we act as a data processor when processing personal information on behalf of another controller.

2. How We Collect and Use Your Personal Information

We collect your personal information primarily to make it easier and more satisfying for you to use our services. As we improve our products and launch new features, we may need to collect new types of personal information or change the purposes or methods of processing, and where required by law we will notify you and obtain any necessary consent.

(a) What types of personal information do we collect from or about you

(i) Create an account and log in. When you use our Apps, you may sign in through a supported platform account (such as TikTok Minis) or create an account directly. During registration or sign-in, we collect identifiers such as your platform user ID, display name, profile image, and email address if you choose to provide it. When you register to use our services, we create a unique user ID to track your use of the Services; this user ID is stored together with your profile information to record your activity within the Apps.

(ii) Browse our services and watch videos. When you interact with our services, we automatically collect certain information about your device and your usage, such as browser type and language, IP address, device identifier, hardware and software information, advertising ID, playback data, standard server log information, viewing history, and your interactions with content and other users.

(iii) Top-up and payment. While purchasing our services, you can choose payment services provided by third-party payment institutions (such as TikTok Minis payments). To confirm your payment instructions and complete the transaction, we may share information such as your order number and user ID with the payment provider. To display order information in your account and protect your after-sales interests, we collect order information, transaction and consumption records, and virtual property information generated during your use of the services. In case of a refund, the payment institution may ask you to provide personal information to process the refund request.

(iv) Share with your friends. We may offer you the opportunity to invite contacts from a social platform so they can be located in our Apps or join you. Such contact information is used only for sending the invitation to the intended recipients.

(v) Contact and customer service. We may collect your email address and any other personal information you provide when you contact customer service or otherwise communicate with us.

(vi) Promotions and events. If we offer promotions, lucky draws, or similar activities, participation is voluntary. The requested information typically includes your user ID and registration details, which we use to administer the activity and notify winners.

(vii) Provide you with security. To protect the safety of you, other users, and the public, and to better prevent risks such as phishing, fraud, network attacks, and intrusions, we may collect, use, or integrate your account, transaction, device, and log information — as well as information shared by partners with your authorization or as permitted by law — to assess account and transaction risks, verify identity, detect and prevent security incidents, and take necessary recording, auditing, analysis, and disposal measures.

(viii) Improve our services. We and our analytics service providers may use standard tracking technologies (such as web beacons, SDKs, APIs, scripts, and tags) to identify your device, remember preferences, and understand which pages and features you use. This information may be combined with other personal information such as your user ID, unique device ID, hardware type, device maker, operating system type and version, system language, time zone, screen size, mobile advertising ID (IDFA on iOS or Android Advertising ID), approximate geolocation derived from your IP address, email address (if connected through a social login), frequency of use, feature usage statistics, in-app events, aggregated performance data, and download source. We use this to improve quality, tailor recommendations, personalize the experience, and support fraud prevention, security, and authentication. Device information such as device type, hardware model, operating system, language, and screen size is also used to determine compatibility and optimal settings. Please refer to your device manufacturer's or browser's guidance to manage tracking preferences. Within the mobile Apps, we do not link the information stored in analytics software to personally identifying information.

(ix) Advertise our services. Some of our services employ ad-serving technologies that use cookies, clear GIFs, web beacons, tracking pixels, and similar technologies to deliver interest-based advertising about our products and services. Our Apps may also be advertised on third-party services; after clicking such an advertisement and installing an App, you become a user of our services.

(x) Tips for specific function permissions. Certain functions require device permissions (such as camera, photo library, microphone, storage, device information, location, or notifications). Most mobile devices allow you to turn these permissions on or off; please refer to your device manufacturer for specific methods. By turning on a permission, you authorize us to collect and use relevant information to provide the corresponding service. Once turned off, we will no longer collect that information going forward and may be unable to provide the related service, but this does not affect collection carried out previously based on your authorization.

(b) How we collect and obtain your personal information

(i) Information you provide. When you pay for our services, create an account, contact us, or otherwise engage with our services, we may ask for personal information such as your email address, account name, account number, and transaction information. Please note that we cannot guarantee the privacy of information you choose to post publicly on the internet, including on social media pages.

(ii) Information we automatically obtain about you. Information collected, summarized, tracked, and recorded when you use our services, including but not limited to log, location, and device information.

(iii) Information from your communications with us. We may ask for personal information when you call us, send us an email, or provide comments, chat messages, and opinions through our services.

(iv) Information we receive from third parties. You may use third-party platforms or authentication services (such as TikTok Minis, Apple, or Google) to sign in to our website or Apps. These services may share your personal information with us, such as your account name and email address, depending on your privacy settings with those platforms. You should review and adjust your privacy settings on third-party websites and services before linking them to our services. If you follow a link to any third-party website, note that your interactions with that website are governed by its own privacy policy, not ours, and we do not accept responsibility for its practices.

(c) How can we use your personal information

We use information collected through our services, individually and combined, for the purposes described in this Policy or disclosed to you in connection with our services. For example, we may use your information to:

• Create user accounts and allow you to use our Apps;
• Identify and suggest connections with other users;
• Facilitate sharing on social networks;
• Operate, develop, and improve our Apps and other services;
• Understand you and your preferences to enhance and personalize your experience;
• Provide personalized recommendations for content and services;
• Respond to your comments and questions and provide customer service;
• Set up and maintain accounts you register for;
• Identify, fix, and troubleshoot bugs and service errors;
• Save in-application progress and statistics (for example, viewing history and unlocked episodes);
• Serve and measure the effectiveness of advertising;
• Send service-related information, including confirmations, invoices, technical notices, updates, security alerts, and administrative messages;
• Personalize advertising for you;
• Communicate with you by email about promotions, rewards, upcoming events, and news about our products and selected partners, in accordance with your marketing preferences (you may opt out at any time using the details in "How to Contact Us");
• Optimize or improve our products, services, and operations;
• Facilitate software updates;
• Protect the integrity of our services and enforce our Terms of Service, including detecting and preventing fraud, hacking, cheating, spamming, and unauthorized activities;
• Detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity;
• Perform statistical, demographic, and marketing analyses of users of our services.

We may also use information collected from or about you to create aggregated or de-identified data that does not specifically identify you.

(d) Push Notifications

With your consent in accordance with your device settings, we may send push notifications through our Apps about application updates, new episodes, and other service-related matters. You may opt out at any time by turning notifications off at the device level through your settings.

3. How Long We Retain Your Personal Information

We retain your personal information for different periods depending on what it is, how we use it, and how you configure your settings:

• Some personal information can be deleted at your discretion, such as information saved in your account; we retain it until you delete it or ask us to delete it.
• Other personal information is deleted or anonymized automatically after a set period, such as certain advertising and analytics data.
• Some personal information is retained longer where necessary for legitimate business or legal purposes, such as security, fraud and abuse prevention, or financial record-keeping.
• If we terminate our services or operations, we will promptly stop collecting your personal information, notify you in advance as required by law, and delete or anonymize your personal information after termination unless otherwise required by law or regulators.

When you delete personal information, we take steps to ensure it is safely and completely removed from our servers or retained only in anonymized form. Because we protect information against accidental or malicious deletion, there may be a delay between your deletion request and removal from active and backup systems.

4. How We Protect Your Personal Information

We take reasonable and appropriate measures to protect your personal information from unauthorized access, loss, misuse, or alteration by third parties.

(a) Technical measures. We adopt industry-standard security protections, including reasonable systems and security technologies to prevent unauthorized access, use, and modification of your information. Various encryption techniques are used across our services — for example, encryption technologies such as SSL to protect information in transit, encrypted storage, isolation technologies, and data desensitization when information is presented or correlated. We apply strict data access controls and multi-factor authentication to prevent misuse of data.

(b) Access control measures. We allow only employees and partners who need to know your personal information to access it, supported by strict access control and monitoring mechanisms. All persons who may access your information must comply with confidentiality obligations; failure to do so may result in legal liability or termination of the partnership.

(c) Other security measures. We manage the storage and use of information through data classification standards, data security management specifications, and secure development specifications, supplemented by confidentiality agreements, monitoring, and auditing mechanisms. Our data security management system covers organizational structure, system design, personnel management, and product technology across the data life cycle.

(d) Security tips for you. The internet is not an absolutely secure environment. Even though we strive to strengthen security measures, we cannot guarantee 100% security of information during transmission or storage, nor can we guarantee that third parties will never illegally obtain access to it. Please understand that the systems and networks you use to access our services may encounter problems beyond our control.

(e) Security incident handling. We have established classification standards and handling procedures for security incidents and vulnerabilities, together with emergency response plans. In the event of an incident likely to result in a high risk to your rights and freedoms, we will promptly inform you of the basic situation and possible impact, the measures taken or planned, suggestions for mitigating risk, and available remedies, using means such as email, letter, telephone, push notification, or — where individual notification involves disproportionate effort — a public announcement. We will also report incidents to regulators as required by applicable law.

5. When We Share Your Personal Information

We do not share your personal information except as approved by you or as described in this Policy. We may disclose your personal information in the following circumstances:

(a) With your consent. We may share your personal information with certain third parties with your approval and consent.

(b) Service providers. We engage other companies and individuals to perform services on our behalf, such as data analysis, IT and related services, payment processing, email delivery, customer support, and security and fraud-detection services. These providers may access your personal information in connection with performing services for us and are contractually obligated to maintain its confidentiality and security, to use it only on our behalf, and to process it consistently with this Policy. For example, analytics providers may use cookies or similar technologies to help us understand how users interact with our services; the information generated is transmitted to and stored by those providers subject to their own privacy policies, and we do not use them to gather information that personally identifies you.

(c) Third-party plug-ins and platforms. Third-party applications and platforms (such as social login services) may give you options to post information about your activities to your profile page. This Policy does not apply to your use of such third-party applications and services, and we are not responsible for how they collect, use, or disclose your information. We encourage you to review their privacy policies before connecting or using them.

(d) Disclosures to protect us or others. We may disclose your information as required by applicable laws and regulations — for example, to comply with a subpoena or government request, investigate fraud, enforce or apply our rights, or protect the rights, property, and safety of us, our users, or others. This includes exchanging information with other companies and organizations for fraud protection.

(e) Disclosures in the event of merger, sale, or asset transfer. We may share your information in connection with any merger, sale of assets, financing, or acquisition of all or part of our business. You will be notified by email and/or a notice within our services of any change in ownership or use of your personal information.

(f) Advertising partners. Through our services, third-party advertising partners may set technologies and tracking tools to collect information about your use of our services and your devices, such as GAID (Google Advertising ID on Android devices) or IDFA (Identifier for Advertising on iOS devices), region, geo-location information (with your consent), and IP address. They may also collect information relating to advertisements served and their location, how long an advertisement was visible, domain type and advertisement size, and click-throughs and advertisement responses. They use this information to deliver ads to your device and verify clicks or installs, show more relevant ads, enable offer walls, track and measure ad effectiveness, and improve targeting and measurement. This Policy does not govern third-party advertising partners, which have their own privacy policies. You can limit mobile ad tracking through your device settings and by resetting your advertising ID; see, for example, Apple's guidance at http://support.apple.com/kb/HT4228 and Google's settings at https://support.google.com/ads/answer/2662922. Adjusting these preferences does not mean you will no longer see advertisements — only that the ads you see may be less relevant to your interests.

(g) When you make your personal information public. Any information you disclose publicly through our services or third-party platforms may be collected and used by others; we cannot control such use.

6. How We Protect Personal Information of Children

We do not knowingly collect or solicit personal information from children under the age of 14 (or the higher minimum age set by the law of your jurisdiction), nor do we knowingly allow children to use our services. If you are a child under that age, please do not send us any information about yourself, including your name, address, telephone number, or email address. If you believe we have collected personal information from a child, please contact us using the details below; upon verification, we will delete that information as soon as commercially practicable.

7. International Transfers

We may transfer information we collect about you across borders, from your country or jurisdiction to other countries or jurisdictions around the world. Those countries may not have the same data protection laws as your own. We take steps to ensure adequate safeguards are in place for the transfer, use, and disclosure of information about you, including contractual, technical, and organizational measures consistent with applicable law.

8. How to Manage Your Personal Information

(a) Your choices about information you provide. If you prefer not to provide us with personal information, you may choose not to. Some services may not be fully available without it — for example, purchases generally require an account.

(b) Your choices about information provided by third parties. You may control how third parties collect and share your information by changing your preferences or opting out directly with those third parties. Before disclosing information to third parties, we recommend reviewing their privacy policies.

(c) Your marketing and advertising choices. You can exercise choices over how we use your personal information at any time: to withdraw from contests or promotions or opt out of marketing communications, contact us using the details in "How to Contact Us." Even if you opt out of marketing emails, we may still contact you occasionally about your account status or other service-related matters. To disable tracking technologies used for advertising effectiveness or personalized advertising, refer to your device manufacturer, operating system developer, or browser guidance.

(d) Accessing and deleting your information. You may deactivate your account or delete the email associated with it by contacting us using the details in "How to Contact Us." If you would like to access or view the personal information we hold about you, correct it, or request deletion, you may also contact us the same way. If you are a California resident or a user in the EEA, the UK, or Switzerland, please also see the appendices below for additional rights.

9. Notices and Amendments

We may update this Policy from time to time to reflect changes in our information practices. If we make material changes, we will notify you by email (sent to the address specified in your account) or by a notice within our services before the change becomes effective. Where applicable data protection laws require enhanced notice or consent for changes, we will provide it. You can see when this Policy was last updated by checking the date displayed at the top of this page. We encourage you to review this page periodically for the latest information on our privacy practices.

10. How to Contact Us

If you have complaints or reports regarding cybersecurity, or any questions, comments, or suggestions regarding this Policy, your information, or the privacy practices of our services, please contact us by:

• sending an email to 1015985272@qq.com; or
• submitting feedback through the customer service channel in our Apps.

You may also write to: Data Protection Officer, Hong Kong Star of Today Network Technology Co., Ltd.

In general, we will address your questions, comments, or suggestions promptly after receiving and verifying your identity. If you are not satisfied with our handling, you may file a complaint with the government department responsible for personal information protection in your jurisdiction.

Appendix 1: Additional Information for California Residents

If you are a California resident, the following information supplements this Policy in relation to your use of our services under the California Consumer Privacy Act ("CCPA").

Information we collect and sources. In the past 12 months, we have collected the following categories of personal information for the purposes described in Section 2:

• Identifiers: account name, email address, IP address, unique personal identifier, user ID, third-party account names, and other online identifiers, obtained directly from you or automatically during your interactions with our services;
• Internet or other electronic network activity information: browser type and language, device and hardware information, playback data, and other information regarding your interactions with our services, obtained automatically;
• Commercial information: purchase and consumption histories or tendencies, obtained directly from you or automatically;
• Geo-location data: locale and general geolocation derived from your IP address;
• Audio, video, and other electronic data: interactions with us (such as customer service) or with other users, and feedback you provide about our services;
• Profiles and inferences: inferences drawn from the above to reflect preferences, characteristics, and behavior.

Use and disclosure. We use personal information for the business and commercial purposes described in Section 2. We do not sell personal information about our users. However, we permit certain third-party advertising and analytics partners to collect information through our services for serving more relevant ads, measuring campaigns, and detecting ad fraud, including GAID or IDFA, region, geo-location information (with consent), and IP address. In the preceding 12 months, we have disclosed the categories of personal information listed above for business purposes.

Your privacy rights. California residents have the right to:

• Know: request disclosure of the personal information we have collected, used, and disclosed over the past 12 months and information about our data practices;
• Delete: request deletion of personal information collected from you;
• Non-discrimination: exercise these rights without discriminatory treatment;
• Opt out of sales: we do not sell personal information, so no opt-out is required;
• Financial incentives: we do not currently offer financial incentives tied to personal information.

Because there is not yet a common understanding of how to interpret "Do Not Track" signals, we do not currently respond to them; however, you may opt out of interest-based advertising as described above. To exercise your rights, or if you are an authorized agent acting on a California resident's behalf, contact us using the details in "How to Contact Us." We may need to verify your identity (and, for agents, written permission and identity) before processing a request, and in some cases may request additional verification information such as government-issued identification.

Appendix 2: Additional Information for Users in the European Economic Area (EEA), the United Kingdom, and Switzerland

If you are located in the EEA, the UK, or Switzerland, the following information applies to personal data collected through your use of our services.

Data controller. HK TODAY STAR NETWORK TECHNOLOGY CO., LTD. is the data controller of your personal data.

Legal bases for processing. We collect, use, and share your personal data on the following bases:

• Performance of contract: to administer your account, provide the content and features you request, support purchases and top-ups, and provide customer support;
• Consent: to send newsletters, direct emails, and surveys; to serve targeted ads in our Apps; and for certain other marketing features, all subject to your consent;
• Legitimate interests: to provide requested technical support, debug and improve our services, personalize your experience, communicate per your marketing preferences, and establish, exercise, or defend legal claims, where those interests do not override your fundamental rights and freedoms;
• Legal obligation: to comply with legal obligations to which we are subject.

International data transfers. Personal data we collect may be transferred to, stored in, and processed in countries where we, our affiliates, partners, or service providers maintain facilities or operations. We ensure transfers of personal data to third countries or international organizations are subject to appropriate safeguards.

Your privacy rights. You have the following rights regarding your personal data:

• Access, correction, and deletion: view, correct, update, or request deletion of your personal data as described in "How to Manage Your Personal Information";
• Objection: object to processing based on legitimate interests on grounds relating to your particular situation, including stopping marketing messages at any time;
• Withdrawal of consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Data portability: request transfer or porting of personal data you provided to us in certain circumstances.

To exercise any of these rights, contact us using the details in "How to Contact Us." If you have unresolved concerns, you also have the right to complain to the relevant data protection authority in your member state of residence, place of work, or where an alleged infringement occurred.