Privacy Policy
1. Who we are
Phantomhive Ltd ("we", "us"), a company registered in England and Wales (company number 16262820, registered office 29 Trenchard Avenue, Stafford, Staffordshire, ST16 3RD), runs Phantom Remote and is the controller of the information described here. Contact: clemence@phantomhive.co.uk.
2. What we collect, and why
| What | Why |
|---|---|
| TV details: a random TV identifier created by the app, the TV's name (for example "Living room TV"), its make, model and Android version, when it was first paired and when it was last online. | To pair and reach your TV, and to know which TVs the remote must support. |
| Pairing records: a random identifier for each paired phone, a general device type (for example "iPhone"), the TV it controls, when it was paired and last used, any name you give the TV on your phone, and when pairings are removed. Access tokens are stored only in a scrambled (hashed) form. | To route your commands to the right TV and let you or the TV remove a phone. |
| Country: the country only (for example "GB"), worked out on our server from the time zone your phone or TV reports, or from your browser's language setting. We do not use your IP address or any location service for this, and we do not keep the time zone or language. | To understand where the service is used, for planning. |
| How you found us: if the address you first opened carried a campaign tag (utm_source, utm_campaign) or a "ref" tag, or you came from another website, we keep that tag or that website's name with your pairing. | To understand which promotions work. |
| Activity: which days a paired phone or TV was used (by its random identifier only). | To count daily, weekly and monthly users. |
| Usage totals: daily totals of remote actions by type (for example "volume up") and of app launches by app (for example "Netflix"). These totals are not linked to any phone, TV or person. Our server never records what you watch, programme titles or searches. | To see which features and apps matter most. |
| Terms acceptance: which version of the terms was accepted, when, and for which TV and paired phone identifier. | To keep a record that the terms were agreed. |
| Installed apps: the list of apps installed on the TV (names and icons). It passes through our server to your phone and is kept on your phone; we do not store it on our server. | To show your apps on the remote. |
| Email address (optional): only if you choose to get updates in Settings and tick the box to agree, with the time you agreed and the wording you agreed to. | To send occasional updates about Phantom Remote. It is not needed to use the remote. |
| IP addresses: never written to the database in readable form. Held in the server's working memory only, to limit repeated attempts (for example wrong pairing codes), and to find a TV on the same home connection when you ask it to show its code again. A scrambled value that cannot be reversed is kept with a waiting pairing code. | To keep the service secure and prevent misuse. |
We do not ask for your name or payment details. Commands you send to your TV pass through our server to reach it but are not stored, apart from the anonymous daily totals above.
3. What the app keeps on your TV
The Phantom Remote app on your TV keeps the following on the TV itself. It is not sent to our server for storage. Where a phone feature needs it (for example the household names in "Earn TV time"), it reaches your paired phone only when the phone asks for it: directly on your home Wi-Fi, or passed through our server without being stored when you are away from home. It is not included in cloud backups. Phantom Remote does not keep a history of what is watched on the TV, and does not report what anyone watches to the phone.
| What | Why |
|---|---|
| Household names: first names or nicknames you type into "Household names" on the phone (none by default, up to 10), and the "Earn TV time" minutes a parent gives each name. They are never linked to what is watched. | To run "Earn TV time". |
| Now playing (not stored): with your permission (Notification access), the media details apps share with Android: app, title, artwork and play/pause state. Other notifications are ignored and not kept. | To show what is on right now in the phone app, with playback buttons. It is read when the phone asks and is not stored. |
| Family settings: remote lock on or off, bedtime hours (times and chosen apps), volume cap, bedtime timer, scenes and the pairing PIN you set. | To run the family features you switch on from your phone. |
| TMDB lookups (optional): if you add your own key for The Movie Database (TMDB), the key is kept on the TV, and titles you look up are sent from the TV to TMDB to find where to watch them. TMDB's own privacy policy applies to those requests. | To show which apps have a title. |
To delete this information: turn a feature off in the phone app, remove names in "Household names", or clear the Phantom Remote app's storage in the TV's Settings (Apps), or uninstall the app.
4. Family and parental features
Phantom Remote includes features a parent or carer can switch on from the paired phone: remote lock (the TV remote's buttons stop working, and pressing OK five times unlocks it) and bedtime hours (chosen apps close during set hours). They are never hidden from the people watching: the TV shows a message when the remote is locked or unlocked and when bedtime hours are switched on, off or close an app, and a "Phantom Remote is on" notification lists which features are active. Phantom Remote does not record or report what anyone watches. Phantom Remote is intended for adults: it has no accounts, logins or profiles for anyone, including children who use the TV.
5. Our legal basis
Pairing, routing commands, showing your apps and recording terms acceptance are necessary to provide the service you asked for (contract). Security, activity counts, country, how you found us and usage totals are based on our legitimate interests in running, securing and improving the service; we keep them minimal, and you can object (see section 8). Update emails are sent only with your consent, which you can withdraw at any time. Now playing is read only with your permission (Notification access), which you can withdraw in the TV's Settings.
6. How long we keep it
- Pairing and TV records: deleted automatically 12 months after the pairing was last used. Removing a phone, or choosing "Forget this TV", stops its access at once; the record of the removal (which one, when, and by whom) is deleted automatically after 13 months.
- Activity days and usage totals: deleted automatically after 13 months.
- Terms acceptance records: kept while the pairing exists. Once the pairing has been deleted, each record is deleted automatically when it is 6 years old. We keep them as evidence that the terms were agreed, for the period in which a legal claim could be brought.
- Email address for updates: until you unsubscribe or ask us to delete it. Unsubscribing deletes it completely.
- IP addresses: never written to the database in readable form. In the server's working memory they are cleared every hour once a visitor has been quiet for 24 hours (rate limits), and a TV's connection address is cleared an hour after the TV was last online. The scrambled value kept with a pairing code is deleted by the daily clean-up after the code has expired (codes last 10 minutes). Everything held in memory, and the scrambling key, is lost whenever the server restarts.
7. Sharing and where it is kept
We do not sell your data and we do not use it for advertising. We share it only with providers that host and run the service for us, under contract, or where the law requires it.
Our server is hosted by Oracle Cloud Infrastructure, in its London (UK) region, and the information in section 2 is stored there. Oracle acts for us as a hosting provider. We do not choose to send this information to any other country. If that ever changes, we will update this policy first and put suitable safeguards in place.
8. Your rights
Under UK data protection law you can ask for a copy of your information, ask us to correct or delete it, object to or restrict how we use it, withdraw consent for update emails, and complain to the Information Commissioner's Office (ico.org.uk).
- To remove a phone: Settings on your phone, choose your TV, then "Remove this TV", or remove the phone from the TV app.
- To remove a TV and all its phones: "Forget this TV" in the TV app.
- To stop update emails and delete your address: Settings, "Unsubscribe and delete my email", or email us.
- For anything else, including deleting all records about your phone or TV, email clemence@phantomhive.co.uk. Tell us the TV name shown in the app; we may also ask for the pairing code shown on the TV, to check the request is genuine. We will reply within one month.
9. Security
Pairing codes last 10 minutes and wrong guesses are limited. Access tokens are stored only in scrambled form, and the service uses an encrypted (HTTPS) connection. If there is a personal data breach that puts people at risk, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell the people affected where the law requires.
10. Changes
If we change this policy, the version number and date above will change and the app will ask you to accept it again the next time you open it.