Privacy Policy

Effective 13 November 2026

Muxun is a browser extension that does one thing: it recognises the video you are watching and finds a subtitle that matches it. We do not sell data, show ads or build profiles, and Muxun uses no AI services.

This policy covers Muxun on the Chrome Web Store and on Microsoft Edge Add-ons. This service is operated by TINGJI (听记), based in New Zealand ("we").

What we read

• Video information on the page: the title, year, season and episode, taken from the page title, structured data, the player's media information, the page address and the video file name. If the page links to Douban, the film's Douban id is taken from that link. Read only on pages with a video, and analysed on your computer.
• The player's audio: analysed on your computer only, to tell whether someone is speaking at that moment, so the subtitle can be checked and its timing synced. This uses a small speech-activity model bundled with the extension and works offline. Audio is never recorded, stored or uploaded. Some sites don't let extensions read the player's audio directly. There, the tab's audio is read only after you click "Sync by listening", and it is handled the same way.
• The site's own subtitle tracks: read on your computer and used as subtitles or as a timing reference.

What we send, and to whom

• To the Muxun server, to find subtitles: the title (including Chinese and English titles and aliases found in the title database), year, season and episode, the film's public ids (such as IMDb and TMDB ids), its original language, the subtitle language you want, and a random ID for the episode (used for your allowance). The server then searches third-party subtitle libraries and downloads from them with Muxun's own accounts, and sends the subtitle back to you. How the server handles this is described in the next section.
• What subtitle libraries receive: only the title, year, season and episode, public ids and subtitle language, sent by the Muxun server. The libraries are run by other companies and organisations in various countries. They never receive your IP address, email or Muxun account, and can't tell who is searching.
• To a public database of film and TV titles: the title and year, or the film's IMDb or Douban id, to look up the canonical title, original language and ids. Like an IMDb id, a Douban id is a public id for the film, not information about you. These requests go straight from your browser, and we never receive them. The database is run by another organisation; as with any website, it sees your IP address and handles it under its own privacy policy.
• An app label: some subtitle libraries and the title database ask each request to say which app it comes from, so Muxun adds a fixed label such as "Muxun v3.0.0". It contains nothing about you.
• We never send page addresses, site names, video file names, browsing history or audio. Apart from your sign-in email and Muxun account, described in the next section, we send nothing that identifies you.
• If you'd like to know exactly which subtitle libraries and title database we use, write to us (see "Contact") and we'll tell you.

What goes to the Muxun server

Finding subtitles, membership and your allowance all use a Muxun account and go through Muxun's own server (api.muxun.app), separate from any other product's accounts. You need to sign in to find subtitles.

• Signing in: you sign in with your email address, without a password. You enter your email, we send a 6-digit code to it, and entering the code signs you in; your first sign-in creates your account. A sign-in lasts 60 days and is extended each time you use Muxun.
• Finding subtitles: the server receives the title and the other details listed in the previous section along with your sign-in token, searches subtitle libraries and downloads from them for you, and sends the subtitle back. Titles, seasons and episodes are never written into any record linked to your account, and never logged.
• Using your allowance: the first time you get a subtitle for an episode, that episode is counted against your allowance, and the server keeps only your account, the episode's random ID and the time. Nothing is counted when no subtitle is found, or when you switch to another subtitle for the same episode.
• Your IP address: as with any website, the server sees your IP address when it receives a request. We don't store the IP address itself; to limit how often codes are sent, we keep a one-way digest of it for 1 to 2 hours.
• When you become a member: the server uses the country of that request (worked out by Cloudflare from your IP address) to choose between Stripe and Paddle: Paddle in the EU and the UK, Stripe elsewhere. The country is used once and not stored.

What the server keeps, and for how long:

• Your sign-in email: used to sign you in and to send codes, receipts, renewal and expiry reminders, and "payment refunded" notices, and shared with the payment platform when you pay (see Payments below). Kept until you delete your account.
• Membership status: when your trial and each paid period start and end, and whether it renews automatically. Kept until you delete your account.
• The amount and currency of each payment: used for the amounts in receipts and reminders. Kept until you delete your account.
• Whether a reminder was sent: whether and when, so each membership period gets only one. Kept until you delete your account.
• Interface language: the language Muxun was using (Chinese or English) when you last became a member, so reminders are written in it. Kept until you delete your account.
• IDs from the payment platform: customer, subscription and payment IDs, used to match renewals and refunds to you. Only once purchases open; kept until you delete your account.
• Signed-in browsers: a name (such as "Chrome on Windows"), when it signed in and was last used, and a one-way digest of its sign-in token, used to limit how many browsers can be signed in and to let you sign out elsewhere. Deleted when you sign out, when a newer sign-in replaces it, or after 60 days without use.
• Allowance records: the random ID and time of each count, used to work out your allowance. Kept for 31 days.
• Download and search counts: for each subtitle downloaded, your account, the episode's random ID and the time, kept for 8 days; how many searches and downloads each account makes a minute, kept for 2 days. Used to limit how many subtitles you download a day, how many you try for one episode and how often you search. Both are deleted with your account.
• Search results: a digest of the search and the results the subtitle libraries returned, with no account, random ID or IP address. The same search within 12 hours uses them directly; when a library is unavailable, results up to 14 days old stand in. Kept for 14 days.
• Kept subtitles: the server keeps a prepared copy of each subtitle, not stored with any account. If you switch computers or clear the cache, the same episode comes straight from this copy instead of another download. Some libraries allow only the person who downloaded a subtitle to get it again, so the server also keeps a digest, computed with a secret key from your account and that subtitle, used only to check whether it can give you the copy; the digest itself doesn't show which account or which film it is. Subtitles and digests are kept for 90 days after they were last used.
• Sign-in codes: only a one-way digest and the number of attempts. Valid for 10 minutes and deleted within an hour after that.
• Code-sending records: one-way digests of the email and IP address, and the time, used to limit how often codes are sent. Kept for 1 to 2 hours.
• Emails sent per hour: just the count, with no email addresses or accounts, used to cap how many emails Muxun sends. Kept for 2 days.
• Payment notification IDs: so each payment notification is handled only once. Only once purchases open; kept for 30 days.
• Refunds and chargebacks that arrive early: the matching payment ID, so that if a refund notice arrives before the payment notice, that payment does not open membership when it arrives. Not linked to your account; deleted automatically after 30 days.
• Unfinished renewal checkouts: the payment platform's ID and the time, so each account has only one open at a time and can't subscribe twice. Kept for 7 days and deleted with your account.
• Emails that have had a trial: only a one-way digest, so each email gets one trial. Kept permanently, including after the account is deleted.
• Error logs: they never contain a full email address, sign-in token, code or title, and Cloudflare keeps them for up to 7 days.

The server never stores page addresses, audio, your IP address itself or card numbers. Search results and subtitles are never stored with your account, and the server keeps no record of who watched what.

• Service providers that handle data for us: Cloudflare runs the server, database and file storage and sends our emails (sign-in codes, receipts, reminders and "payment refunded" notices); requests pass through it, including your IP address, and it receives your email address; Stripe and Paddle process payments. Each handles data under its own privacy policy.
• On your computer: after you sign in, Muxun keeps a sign-in token in the extension's storage. Signing out or uninstalling the extension removes it.
• Without signing in: Muxun doesn't search for subtitles. Importing your own subtitles, automatic sync and fine-tuning still work, without limits, and nothing is sent to the Muxun server.
• Deleting your account: accounts are not deleted automatically, however long they go unused. To delete yours, do it in Muxun and confirm with one more emailed code. If your membership renews automatically, cancel it first under "Manage subscription". After deletion, everything on the server is removed except the one-way digest of emails that have had a trial, described above. What isn't stored with your account is deleted automatically when its time is up: payment notification IDs and early refund or chargeback records after 30 days, search results after 14 days, and kept subtitles and their digests 90 days after last use. Payment records are kept by Stripe and Paddle under their own rules.

Where data is kept, and for how long

• Settings, downloaded subtitles and timing adjustments are kept in the extension's storage on your computer and are never synced through your browser account.
• Up to 400 recently used subtitles are kept; the least recently used go first. Title lookups are kept for up to 30 days (3 days when nothing was found) and search results for 6 hours.
• Clear the cache any time in Settings › Privacy & data. Uninstalling the extension removes all of its data from your computer.

Your choices

• You decide where Muxun runs: on all sites automatically, or on sites you allow one at a time (click the Muxun icon on a site and choose "Use Muxun on this site"; if the video plays in a player from another site, your browser asks for that site too). Without either, Muxun runs only on the page where you clicked its icon. You can change this in Settings and remove sites you allowed there.
• You can turn off automatic search or turn Muxun off for a site.

Payments

Membership is bought on the payment platform: Paddle's checkout window in the EU and the UK (provided by Paddle's own script), and Stripe's checkout page elsewhere. Payments go to the Stripe and Paddle accounts of TINGJI (听记). The Muxun extension itself never handles payments, and we never see your full card number.

• The payment platform receives your account's internal ID (randomly generated, with no personal information) to match the payment to you, and a tag marking it as a Muxun order; if you have bought through Paddle before, Paddle's own customer ID is sent too. Stripe also receives your sign-in email to fill in its checkout page. When you pay with Paddle, the email you enter in Paddle's checkout window is collected by Paddle directly.
• Stripe or Paddle tells Muxun's server the result of each payment, so it can open, renew or take back membership time. What the server keeps about payments is listed in the previous section: when membership starts and ends, whether it renews automatically, and the IDs from the payment platform.
• After a card payment through Stripe, the server asks Stripe once which country issued the card; the answer is used once and not stored. Cards from the EU and the UK must go through Paddle. If one is used through Stripe (for example over a VPN), the server refunds the payment in full, stops the subscription, takes back that membership time and emails you.
• For each new or renewed membership, Muxun sends a receipt to your sign-in email through Cloudflare, with the product, amount, payment method and the date it ends or next renews. Stripe and Paddle also send their own receipts, so you get two emails for each payment.
• Reminders are also sent through Cloudflare: 7 days before a yearly plan renews automatically, one email with the renewal date, the amount and how to cancel under "Manage subscription" in Muxun; 3 days before a membership bought with Alipay ends, one email with the end date, asking you to buy again in Muxun. None are sent for monthly plans, cancelled renewals or refunded payments, and each membership period gets only one.
• The pages you see after paying, cancelling a payment or returning from "Manage subscription" are on Muxun's own server and contain no analytics.
• Stripe and Paddle handle your payment details under their own privacy policies.

Limited Use

Muxun's use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements, and with the Microsoft Edge Add-ons developer policies. Data is used only for the single purpose described above. Apart from the film details sent to the title database and, by our server, to subtitle libraries to find subtitles, and what the service providers listed above handle for us, it is not passed to anyone. It is not sold, not used for advertising and not read by humans.

Changes

When this policy changes, we update this page and its effective date. If a change affects how data is used, the extension will tell you first.

Contact

support@tingji.app
This service is operated by TINGJI (听记), based in New Zealand.