プライバシーポリシー
規約本文は英語と中国語で提供しています。
1. Data collected
The service database stores email addresses, generated display names (or names received from a chosen sign-in provider), account creation and last sign-in times, email verification times, roles and account status, session and verification hashes, independent provider identifiers, consent versions and times, orders and payment confirmations, diamond rewards, daily check-in dates, top-ups and episode unlock debits, favorites, viewing progress, temporary playback sessions, per-episode base and actual play counts, manual playback compensations, payment exceptions and administration audit records. Website email accounts have no password. Separate iOS app accounts use securely hashed passwords in a dedicated credentials table, plus temporary registration and password-recovery records. If you enable Remember password in the app, your password is saved in this device's Keychain; you can disable it in Settings. Historical backups are kept indefinitely and may contain previous records until explicitly deleted. We do not ask for a date of birth or identity document in the entry confirmation.
2. Purpose
These records support account verification, sign-in, access control, purchases, account management and security. Verification codes expire after ten minutes and can be used once. The website does not collect card details. When payments are enabled, the payment provider will process the required payment information.
3. Cookies
A necessary signed cookie remembers the first-visit entry confirmation for up to one year. This confirmation creates no new entry or account-consent database record and is independent of sign-in. Your session lasts up to seven days, and the browser binding for verification and social sign-in lasts one day. These cookies are not advertising consent. Clearing or expiring the entry cookie shows the entry prompt again without blocking email or social authentication.
4. Site analytics
Site analytics run automatically under the site’s statistics policy, without a confirmation step or an individual on/off switch. This automatic status is not a record of your explicit permission. Once initialized, this site records randomly generated visitor and visit identifiers, source and campaign labels, permitted advertising click identifiers, public page paths, device and language categories, country, state or province and city inferred on this server from the network address, site actions, actual visible playback time and account conversion events. For supported website page requests, short-link requests, arrivals and site actions, we also retain the IP address observed by our trusted network gateway, including visits without a promotional link. Administrators can filter IP statistics and individual records by promotional link and an exact time range, and review an IP's activity across links. Server requests, known prefetches or bots and confirmed browser page views are distinguished; a request alone does not prove a completed human visit. A shared IP address does not establish that records belong to one person. A confirmed purchase can retain the IP captured when its order was created, rather than a payment provider's address. Missing historical IP addresses are not reconstructed, and visits that do not reach this site from an external entry cannot be observed. These IP and action records are used internally and are not forwarded to advertising platforms. Region lookup remains local: coordinates are not stored and addresses are not sent to a geolocation API. Inferred regions may be inaccurate and do not establish residence. Search text, email addresses, full callback URLs and signed video links are excluded from analytics. Automatic site analytics do not authorize advertising sharing; no third-party advertising pixel scripts are loaded. Analytics preference and visitor cookies last up to 90 days; the visit cookie lasts 30 minutes. Detailed analytics, IP addresses, site actions, traffic totals and historical attribution records are kept indefinitely without automatic deletion after a fixed number of days. Cookie and session expiry still limits identification, and advertising attribution remains limited to its 30-day window. Explicit account deletion and withdrawal requests continue to apply to their associated data; retaining a history does not renew a permission or credential. Historical data that was not collected is not reconstructed. Necessary sign-in and access cookies continue to work independently.
5. Anonymous public page counts
Public page arrivals and page views are also counted separately without IP addresses or visitor, account or browser identifiers. These counts are independent of browser visitor analytics and promotional visit records. Refreshes and repeated browsing can add counts; they do not identify unique people and are not linked to account conversions or advertising matching identifiers.
6. Optional Meta advertising conversion sharing
When this optional integration is enabled, sharing can use authorization already obtained outside this site if the operator has configured that mode, or an explicit choice through the controls below. In external authorization mode, sharing starts automatically once the site analytics visit is ready, unless an existing refusal or withdrawal can still be linked to this browser. External authorization is not recorded as your on-site approval. No separate advertising confirmation popup is shown. Automatic site analytics do not enable it. PhantomTV is an adult drama website; this site identity is not hidden from Meta. Only after your express permission, obtained externally or through the controls below, our server can send Meta a generalized visit to this site, a successful new registration, or a confirmed real USD top-up with its USD amount, plus advertising click and randomly generated browser matching identifiers, to measure and optimize advertising. Each website event includes its actual source page on this site, with query parameters and fragments removed, and the browser’s User-Agent. The retained page path can identify the page visited; a missing or invalid source is not replaced with the homepage. We do not send email addresses, IP addresses, account identifiers, query strings, fragments, viewing or search activity, or separate content-name or content-detail fields. No Meta Pixel JavaScript is loaded. Advertising preference cookies and server permission or external matching authorization remain valid for up to 90 days; matching identifiers may be used for up to 30 days and undelivered confirmed events may be sent for up to seven days. Historical permission and event delivery records are kept indefinitely without automatic age-based deletion. Expired permissions do not allow sharing, and temporary sending credentials and matching context are cleared when no longer valid or on withdrawal. You can turn sharing off using the controls below. Turning it back on requires a new explicit choice on this site. Existing refusals and withdrawals are preserved while they can still be linked to this browser; clearing all browser data can prevent a previous choice from being linked to a new browser identity. That choice does not turn off the site’s automatic first-party statistics. Withdrawing stops future sharing and cancels undelivered events; it cannot recall data Meta already received. A failed server withdrawal is shown explicitly and must be retried. Necessary cookies, age declarations, sign-in and service access remain independent. The website authorization mode does not authorize iOS app tracking. Optional iOS sharing requires an explicit App choice, Apple App Tracking Transparency permission and an available integration. It covers only registration completed while that permission is in place and verified real purchases captured with that permission; earlier actions are not backfilled. App events may include application and operating-system versions, language, a randomly generated installation or matching identifier and, when Apple permits access, the advertising identifier (IDFA). They do not include your email, account ID, viewing or search history. The app does not read advertising identifiers before permission and sends App events only after a fresh foreground permission check. You may withdraw App sharing in the privacy page; a failed server withdrawal remains pending and is retried. Withdrawal stops future sharing, cancels undelivered App events and clears their sending material while retaining redacted event facts; it cannot recall data already received by Meta. App and website choices are managed separately, and refusing tracking does not restrict normal registration, viewing or payment.
7. Services and sharing
When enabled, Resend receives the destination email address and verification message. Google, X or Telegram processes your chosen sign-in and shares the authorized identity information. Bunny Stream receives video delivery requests. When cryptocurrency payments are enabled, OxaPay processes checkout and returns transaction status; the service stores order identifiers, payment tracking identifiers, checkout links and payment confirmations. Delivery and payment services receive the network information needed to handle those requests. We request basic sign-in information, not permission to post or message on your behalf. Server tokens and merchant secrets are not published in the browser.
8. Storage and rights
Account records are stored on the configured application server. Bunny Stream delivers video through its configured locations. Contact the site administrator to request access, correction or deletion of your records and provider identities. In the iOS app, open Account > Settings > Delete account, enter your current password and confirm permanent deletion. This removes the App account's profile and credentials, revokes its sessions and removes nonessential personal associations; other sign-in-method accounts are unaffected. Necessary order, transaction, entitlement and audit records remain linked to an account key without its profile details for financial and access checks. Deletion ends access to remaining diamonds and purchased content and does not itself cancel or refund payments. The app clears its saved login preferences, credentials and site cookies; a device credential-cleanup failure is shown explicitly. Historical backups are kept indefinitely until explicitly deleted, and account deletion cannot recall backup copies or data already received by third parties. Expired verification challenges and authorization states are removed when new verification or authorization requests are made, after an additional one-day window.
9. Minors and policy changes
The service is restricted to eligible adults. If an ineligible account is identified, contact the administrator to restrict access and handle its data. Policy changes receive a new version. Account and transaction records are retained for service and transaction checks.
10. Optional AppsFlyer App measurement
App measurement is off by default. If you separately opt in to AppsFlyer, grant Apple ATT permission, and the current configuration is available, the App can send installation/session and technical information and registration or verified purchase events (including the real amount and currency) to AppsFlyer to measure advertising. By default this integration does not read IDFA or IDFV. It may read them only when the operator enables device identifiers, you make a new explicit MMP choice, and current Apple ATT permission allows it. Once measurement is enabled with your permission, AppsFlyer can also receive its own installation UID, device/OS/app information and network request information. It receives the network IP address and maps that address to a coarse geographic location for advertising attribution, even when IDFA/IDFV collection is disabled. AppsFlyer may also process technical and performance data, such as device/OS/app information, launch timing and battery information, for analytics and fraud prevention. This integration does not request GPS or precise location. Only the advertising partners explicitly configured for your current consent are eligible for postbacks; known partners are filtered in the SDK, while unknown partner integrations must also remain disabled in the AppsFlyer console. Apple AdServices is separately controlled. Website and old Meta choices do not grant this permission. You can turn App measurement off in the App privacy settings. Withdrawal stops new SDK starts and new event calls and invalidates future backend claims, but cannot recall in-flight data, previously received data, or guarantee deletion of requests already queued inside the supplier SDK. SDK-authorized offline requests may retry, including after a later explicit reauthorization. Before enabling again or accepting changed recipients you must make a new explicit choice. Declining does not limit sign-in, registration, viewing or payment. We do not send your email, site account/order identifiers, viewing history, search terms or invitation code to AppsFlyer.