Privacy policy

This Privacy Policy describes how we collect, use and protect information in connection with:

• the HiRemote mobile application for iOS, iPadOS, watchOS and macOS (the “App”); and
• the website at https://hiremote.app, including any interactive web remote available on it (the “Website”).

Together we refer to them as the “Services”. By using the Services you acknowledge the practices described below.

1. Information we collect through the App

We use three third-party software development kits inside the App. Each receives only what is required for its function.

Apphud — manages subscriptions on top of the Apple App Store. Receives a random per-install user identifier (UUID), the App Store subscription receipt, the iOS push notification token (if push is granted) and the App Store country code. No payment-card data is processed by the App; payments are handled exclusively by Apple.

Firebase Analytics — records funnel events such as “discovery started”, “connect succeeded”, “paywall shown” or “purchase completed”, each tagged with the platform (VIDAA, Roku, Google TV, Fire TV) and outcome. Firebase derives a coarse country and region from the request IP address. The same random user identifier issued by Apphud is associated with these events so that a crash, a paywall view and a purchase by the same install can be correlated.

Bugsnag — records stack traces, handled errors and the last 100 in-app events preceding an error, together with the device model, iOS version and App version. For diagnostic purposes the locally-assigned IP address of the television (e.g. 192.168.x.x) is included; remote-control issues are almost always network issues. The same random user identifier is attached.

The App also reads and writes the following data locally on the device only; none of it leaves the device:

• TV pairing secrets (VIDAA pairing UUID, Fire TV client token, Android TV pairing certificate) stored in the iOS Keychain.
• Discovered TV identifiers, preferred app icon, onboarding progress and review-prompt counters stored in UserDefaults.

Remote-control commands sent from the App to the television travel directly over the local Wi-Fi network. They do not pass through any server we operate.

Identifiers

• The IDFA (Identifier for Advertisers) is not requested. The App Tracking Transparency prompt is not shown.
• The IDFV (Identifier for Vendor) is collected automatically by Apphud and Firebase. IDFV is per-vendor and resets when all of our apps are removed.

Permissions the App requests

• Local Network — required to discover and communicate with the television.
• Bluetooth — used only by the Google Cast SDK for Cast proximity detection.
• Microphone — required by iOS solely so the screen-mirroring Broadcast Extension can include audio from the apps being mirrored. The App does not record from the microphone.
• Notifications — used for transactional messages such as trial-end reminders. Optional.
• Location (When In Use) — requested only to satisfy iOS prerequisites for Wi-Fi APIs. No iOS API that returns location coordinates is invoked, and no location data is collected.

Information we do not collect through the App

Contents of what is watched on the television; names of television apps launched; precise location; photographs, contacts, calendar, health, financial or biometric data; browsing or search history; the content of remote-control commands transmitted between the App and the television.

2. Information we collect through the Website

The Website is a marketing and support site. It includes an interactive web-based Roku remote at https://hiremote.app/hisense-roku-tv-remote that allows a visitor to control a Roku-based Hisense television directly from the browser by entering the television's local IP address.

Analytics scripts load only after your first interaction with a page (scroll, tap or key press) or after 30 seconds, and only within the consent rules in section 3. The Website uses the following services:

Google Analytics 4 (Google Ireland Limited / Google LLC) — counts page views and interactions such as taps on the App Store button, together with the referring page, device type, browser and a coarse location (country, region, city) that Google derives from the IP address. Google Analytics 4 does not log or store IP addresses. No advertising signals are sent: the ad_storage, ad_user_data and ad_personalization consent signals are always “denied”. Where analytics cookies have not been accepted, Google Analytics runs in Consent Mode v2 and receives cookieless pings without a visitor identifier.

Microsoft Clarity (Microsoft Corporation) — records session replays (mouse movement, clicks, scrolls, page navigation) and heatmaps. Form inputs and any sensitive fields, including the television IP address entered into the web remote, are masked at the SDK level before recording. Clarity sets cookies (listed in section 3), so it is not loaded at all until consent is given where consent is required.

Ahrefs Web Analytics (Ahrefs Pte. Ltd.) — cookieless page-view statistics: page, referrer, country, browser and device type. It sets no cookies, stores nothing in your browser and does not store IP addresses.

Our own visit counter (first party) — when a page opens and when you tap an App Store or Google Play button, your browser sends a single word (“visit”, “page view”, “App Store” or “Google Play”) to our own server, which adds one to a daily total. Nothing else is recorded: no IP address, no User-Agent, no page address, no identifier. It sets no cookies and stores nothing in your browser, so it runs without a consent banner — but not when your browser sends Do Not Track or Global Privacy Control.

Vercel (Vercel Inc., hosting) — writes standard access logs containing IP address, User-Agent, referring URL, requested path and response status, retained for a short period and then aggregated. During an attack, Vercel's firewall may show a short “security checkpoint” page before the Website; passing it sets a strictly necessary security cookie.

Sanity (Sanity Inc.) — article images are delivered from Sanity's CDN (cdn.sanity.io), so your browser's request for an image, including its IP address and User-Agent, reaches Sanity's servers. No cookies are set.

When the web remote is used, the television IP address entered by the visitor is transmitted from the visitor's browser directly to the television over the visitor's local network using the Roku External Control Protocol. We do not receive that IP address.

The Website does not include any newsletter signup or contact form; the only way to contact us is via a mailto: link to support@hiremote.app. Email correspondence is therefore not processed by any of the services above.

3. Cookies, local storage and your choices

How consent works

• EEA, United Kingdom and Switzerland. Analytics cookies are off by default. A banner asks for your consent, with “Accept” and “Decline” shown equally. Until you accept, Google Analytics runs without cookies and Microsoft Clarity is not loaded. We recognise these regions from your device's time zone, so no location lookup is needed; Google additionally applies the same “denied” default by IP address to visitors from these countries.
• Everywhere else. Google Analytics and Microsoft Clarity cookies are set by default. You can refuse them at any time with “Cookie settings”.
• Do Not Track and Global Privacy Control. If your browser sends either signal, no analytics script loads at all — not Google Analytics, not Microsoft Clarity, not Ahrefs, not our own visit counter — in any region.
• Changing your mind. The “Cookie settings” link in the footer of every page, or the button below, reopens the choice. Declining deletes the _ga, _ga_*, _clck and _clsk cookies already set on hiremote.app and tells Clarity to stop using cookies. Cookies that Microsoft sets on its own clarity.ms domain can only be removed in your browser settings.

Change cookie settings

Cookies set on the Website

No advertising, remarketing or social-media cookies are set. Ahrefs Web Analytics, Vercel hosting and the Sanity image CDN set no cookies on the Website.

Local storage (not cookies)

The Website keeps a few values in your browser's local storage. They are never sent to us and stay until you clear the site data:

• hr_consent_v1 — your cookie choice (“granted” or “denied”), so the banner doesn't ask again. Strictly necessary.
• hiremote.roku.ip — the television IP address you typed into the web Roku remote, only if you use it.
• hiremote:code-finder:v1 — your progress in the remote-code finder, only if you use it.

4. How we use the information

The information described above is used to:

• provide the Services and verify subscription state;
• diagnose and fix bugs and stability issues;
• measure and improve the product and the Website;
• respond to support enquiries.

Legal basis for the Website (EEA, UK, Switzerland)

• Analytics cookies and similar technologies (the Google Analytics and Microsoft Clarity cookies above): your consent (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive and its national laws such as UK PECR). You can withdraw it at any time with “Cookie settings”; withdrawal does not affect processing that took place before.
• Cookieless measurement (Google Analytics without cookies, Ahrefs Web Analytics), hosting logs, the security checkpoint and image delivery: our legitimate interest in running a secure, working Website and understanding its use in aggregate (Art. 6(1)(f) GDPR).

5. Sharing and transfers

We do not sell or rent personal information. We do not share personal information with advertising networks or data brokers.

Information is shared only with the providers listed above, each of which acts as our processor: for the App, Apphud, Google (Firebase) and Bugsnag; for the Website, Google (Google Analytics), Microsoft (Clarity), Ahrefs (Web Analytics), Vercel (hosting) and Sanity (image CDN). Those providers may store and process data in the United States, the European Union and other countries; where data leaves the EEA or the UK, the transfer relies on the provider's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

6. Retention

7. Your rights

You may request access to, correction of, or deletion of data tied to your install or your visit. To do so, contact support@hiremote.app. If the request concerns App data, please include the Apphud user ID shown in Settings → About inside the App. If the request concerns Website data, please include the approximate date and time of your visit. We will reply within thirty days. If you are in the EEA, the UK or Switzerland, you may also lodge a complaint with your local data-protection authority.

You can withdraw consent to analytics cookies at any time with “Cookie settings”, turn on Global Privacy Control or Do Not Track in your browser (no analytics will load), block third-party scripts, or uninstall the App.

8. Children

The App is rated 4+ in the Apple App Store. The Services are not directed to children under thirteen and we do not knowingly collect information from them. A parent or guardian who becomes aware that a child has provided information may contact support@hiremote.app to request deletion.

9. Security

All network traffic between the Services and their processors uses TLS. TV pairing secrets are stored exclusively in the iOS Keychain on the user's device and are never transmitted to us.

10. Changes to this Policy

We may update this Policy. Material changes will be reflected by updating the “Effective date” above and, where appropriate, surfaced in the App at next launch.

11. Contact

support@hiremote.app