Later edit: a lot of the users are complaining about the clock advancing a few minutes per day. You need to decide if you can live with that or ask the seller to provide details. I couldn't test this, as my unit runs from an intermittent supply.
Edit 2: see a hand-drawn schematic at the end to help you with wiring.
The thermostat can switch both heating and cooling loads, but the product page does not list any instructions. Fortunately, I have a cell photo of those:
In the box, the thermostat comes with the leaflet above, the unit, two drywall(?) screws and an external sensor.
The pinout is listed on the back and this is where you should pay attention:
While usually the thermostat just closes a relay, in this case it acts a bit differently. There relay actually bridges L1 to L (line) and N1 to N (neutral). In my case, the heating relay requires a high signal, so the "remote" wire gets connected to L1. Do not try to bridge L to L1 or N to N1 or you might trip the fuse. It's not required, but also not documented.
The manual states that the "LCD polycarbonate bezel should be removed" but this is false. Instead, the rear mounting frame should be removed. This is done by pressing the plastic clip above and sliding the metal frame down.
The display has the thermal sensor in the bottom-left corner, as pictured above. It's a 10k NTC thermistor. Same specs for the outside sensor.
The unit separates into two parts: low voltage and high voltage, connected through a pin header:
The high voltage parts consists of a ~12V supply and the relay.
It does look tame at first sight, but underneath the yellow transformer an SMD is hidden, pictured below bottom-center:
I have not taken it apart further than this, it's probably your basic SMPS USB charger controller. The capacitors are rated at 105C, if that matters. Over-current and over-voltage protection is decent.
The low-voltage part is a bit more interesting.
It features a G80F915U MCU which is an 8051 derivative with 32k Flash, 1280 bytes RAM, LCD controller, 12-bit ADC running at 16MHz.
Next to the chip there is a buzzer, driven by a transistor (PWM) from the 12V supply.
The chip at 10-o'clock is a 1117 voltage regulator supplying 3.3V.
Above it is a CHMC D1302F real-time clock that's keeping the time.
At 8-o'clock the chip 16 SOIC chip is marked 8M7S16. I couldn't find any datasheet but I assume it's a buffer/isolator/darlington, since it ties the MCU to the high-voltage board and the pin header.
At 6-o'clock is the flat flex header for the backlit display.
My guess is that a lot of parts were soldered by hand. The resistors have random orientations, the parts are not aligned, there are large blobs of solder. It looks like a school project...
A better example would be the RTC chip and crystal below:
A lot of experienced EEs would jump around with a wick and resolder those parts, but I know better: sometimes the "mistakes" are actual reworks done at the factory. For example, with C9 above the bridge might be intentional because there was a mistake with the PCB layout.
I doubt that, but, nevertheless, I only remove the loose solder balls on the PCB, and leave the solder joints intact, unless there is something obviously wrong or a cold joint.
The LCD is marked HzC14041 - no point in showing any pictures on that. It's controlled by 7 lines (including backlight) so I assume it's SPI. However, the controller is integrated and drives 2x13 signals.
The picture is taken intentionally in a dark environment to highlight the backlight (how ironic).
Not mounted permanently since the wall does not have a standard electrical box hole.
It does the job fine, but there's no way to set PID parameters (how long till the room heats up); however, you can set the hysteresis, from 0.5C to 5C.
I've set the hysteresis to 0.5C since it overshoots 1C. That is, with a set temperature of 19C, the thermostat will stay on until 19.5, residual heat will work until 20.5C, the thermostat will turn on once temperature drops below 18.5C.
I intend to document the UART port (if possible) and the control signals, but waiting for the 30-days return warranty to expire.
The manual hints to a WiFi icon, so I assume the WiFi module mounts to the pins next to UART (bottom of board). The same company makes a similar unit with WiFi functionality.
My choice was between buying the WiFi unit (has bad reviews), making my own (expensive and error-prone) or hacking this one. So you know what to expect next...
In the meantime, if you do want the WiFi version: EDIT it has been taken down from Amazon.
I paid 20€ for this version (Lightning deals), the WiFi one costs about 60€.
Wire at your own risk and double-check the voltages! Basic electrical knowledge required, at least how to use a voltage pen and a multimeter!
Internal relay wiring diagram:
Explanation: inside the red rectangle is the self-contained unit. The DPST relay has the following connections: L to A1, N to A2, L1 to B1 (N/O), N1 to B2 (N/O). N/O means they are normally open. When the thermostat switches the load on, L will get connected to L1 and N to N1.
See the small schematic at the right of the picture, where a typical 3-wire thermostat is drawn. Usually these have 3 connections, corresponding to L, L1 and N. Double-check the existing wiring!
Replacing a 2-wire thermostat will not work. In this case, you only have L and L1 available, you need to bring N from outside. This is not a rule, you could have N and N1 instead.
If your heating requires 12 or 24V to work, this thermostat will not work. You could try to remove the internal connections between L to A1 and N to A2. Then you can use your modified B1 (L1) and B2 (N1) terminals and connect them to the 2 wires going to the heater signal.