Web Proxy Privacy Policy

Prominent disclosure

If you only install the extension and stay on Direct connection, settings stay on your device. Optional rule-list updates may contact the list host you configure.

If you turn on System / PAC / Global and connect, we process: the username and password you enter; the hostname and port of each HTTPS CONNECT target; your client IP; and traffic bytes. The extension also reads the current tab URL and recent request hostnames on this device for the toolbar icon and one-click rules. Those hosts leave the device only if you later sync rules in the user center.

We use this solely to provide the proxy, prevent abuse, and enforce the quota you see in the user center. We do not sell this data or use it for advertising.

Prominent disclosure

If you turn on System, PAC, or Global proxy, this product processes: the username and password you enter; the hostname and port of each HTTPS CONNECT target; your client IP; and traffic volume. On your device the extension also reads the current tab URL and recently requested hostnames to draw the toolbar icon and to write one-click rules. Optional: a remote rule-list download and speed tests you start. We use this only to run the proxy, enforce the quota, and save your local settings. We do not sell it or use it for advertising.

1. What this policy covers

This policy describes how the Web Proxy extension and the hongkong.web-proxy.tech service handle information. We do not sell personal data. We do not show ads. We do not use advertising or analytics SDKs in the extension.

If you only load the extension and leave it in “Direct connection” without entering an account, almost no data leaves your device except optional list updates described below.

2. Data stored on your device (extension)

The extension stores settings in the browser’s local extension storage (chrome.storage.local), including:

• Proxy host, port, and scheme that you enter
• Username and password that you enter (used only to authenticate to your proxy)
• Proxy mode, custom allow/deny domain rules, and a cached copy of the remote AutoProxy rule list
• Cached quota text, last error, and last speed-test result

This copy stays on your computer. Uninstalling the extension or clearing extension data removes it. We cannot read this storage unless you later send the same account to our server when you connect.

3. Data processed when you use the proxy

If you enable System / Global / Rule proxy and connect to our server, the service must process:

• Account credentials — username and password (or a short-lived user-center session). Passwords are stored as one-way hashes, not plaintext.
• Destination of proxied requests — hostname and port of HTTPS CONNECT targets, so the tunnel can be opened. We use this for providing the proxy, abuse prevention, and traffic accounting.
• Client IP and traffic volume — source IP, bytes in/out, and hourly distinct IPs, to enforce the quota and IP limits you see in the user center.
• User-center activity — login, registration (if enabled), password change, and self-service views of your own usage.

The extension may read the current tab URL and recently requested hostnames on your device to draw the toolbar icon and to add “one-click direct / one-click proxy” rules. Those hostnames are written into your local rule lists. They are uploaded only if you later sync rules in the user center; the server accepts domain/IPv4 lines only and disables accounts that submit malicious code.

4. Permissions (why the extension asks for them)

• proxy — apply Direct / System / Global / Rule modes.
• storage — save your server and rules locally.
• tabs — know the active tab URL for the icon and page rules.
• scripting — read this page’s already-loaded resource URLs when you click one-click rules.
• webRequest / webRequestAuthProvider — attach proxy username/password and remember request hosts for one-click rules.
• declarativeNetRequest — remove Alt-Svc so video can stay on the TCP proxy.
• privacy — tighten WebRTC so it does not bypass the proxy.
• <all_urls> — the browser proxy API and request hosts apply to sites you visit, not because we scrape the web into our servers.

5. Third-party requests

• The extension may download a public AutoProxy rule list (HTTPS text file) from the URL you configure, or from a public mirror, to update PAC routing. That host may see your IP.
• The website (not the extension) may load the ECharts library from jsDelivr to draw usage charts after you log in.
• Speed tests you start send traffic to our server and/or a public speed endpoint you choose to probe (for example Cloudflare speed pages) through your current mode.

We do not share account or traffic records with third parties except as required by law, or with processors that only host this same service for us.

6. Retention and your choices

• Local extension data: until you clear it or uninstall.
• Account and usage on the server: kept while the account exists; hourly IP/traffic history is periodically trimmed (about 7 days for IPs, 90 days for hourly traffic).
• You may change your password in the user center (except the reserved free account). An administrator can delete or disable an account they issued.
• You can stop proxying at any time by switching the extension to Direct connection.

7. Children

The product is not directed at children under 13, and we do not knowingly collect their data.

8. Changes and contact

We may update this page when the product changes. The “Last updated” date will change. Questions: open https://hongkong.web-proxy.tech/ or contact the person who gave you the account.

隐私政策（中文）

本政策适用于 Web Proxy 浏览器扩展（兼容 Google Chrome™ 与 Microsoft Edge）以及 hongkong.web-proxy.tech 上的 HTTPS 正向代理服务。Google Chrome 是 Google LLC 的商标。我们不出售个人信息，扩展内无广告、无统计分析 SDK。

本机存储：扩展把你填写的服务器地址、用户名、密码、代理模式和自定义规则保存在浏览器本地存储中。卸载扩展或清除扩展数据即可删除。我们无法直接读取该本地存储。

使用代理时：服务端会处理账号认证（密码以哈希保存）、CONNECT 目标主机与端口、来源 IP、流量字节和每小时独立 IP，用于提供代理、防滥用和配额。用户中心登录后可查看自己的用量。

当前标签与请求主机：仅在本机用于工具栏图标和「一键直连 / 一键代理」规则，不会作为独立分析数据上传。

第三方：扩展可能按你配置的地址（或公开镜像）更新远程规则列表，该主机可能看到你的 IP；网站图表可能从 CDN 加载 ECharts。测速由你主动发起。

权限用途：proxy 切换模式；storage 保存配置；tabs / scripting / webRequest 用于当前页规则与代理认证；declarativeNetRequest 与 privacy 用于减少视频与 WebRTC 绕过代理。

保留期限：账号存续期间保存必要用量；IP 约 7 天、小时流量约 90 天会清理。可随时在扩展中改回「直接连接」。疑问请打开 用户中心。