Privacy Policy

This Privacy Policy (hereinafter the "Policy") is formulated by Bibixidi (hereinafter "we", "developer", or "bpcd") to explain to you (hereinafter "user" or "you") how we collect, use, store, and protect your personal information and related data when you use the "Hyper Music" application (hereinafter the "App"). This Policy applies to all versions of the App, including but not limited to Windows, macOS, Linux, Android, iOS, and HarmonyOS platform versions. We understand the importance of personal information to you and commit to complying with the following applicable laws and regulations:

• People's Republic of China: the Personal Information Protection Law, the Cybersecurity Law, the Data Security Law, and the Provisions on the Protection of Minors' Personal Information in Cyberspace
• EU/EEA: the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)
• United States: the California Consumer Privacy Act (CCPA/CPRA) and the Children's Online Privacy Protection Act (COPPA)
• Other regions: we also comply with the data protection and privacy laws applicable in your jurisdiction

This App is centred on local music playback: your music library and usage data are stored locally on your device by default; network data transfer occurs only when you use the optional network features described in the "Network Features and Third-Party Services" section of this Policy. This Policy was first published on June 3, 2026, and was last revised on September 11, 2026. Please read and fully understand the entire contents of this Policy before using the App. Once you begin using the App, you are deemed to have read, understood, and agreed to all terms of this Policy. If you do not agree with any part of this Policy, please stop using the App immediately.

As a purely local music player, this App adheres to the principle of minimum necessity (referred to by the GDPR as "data minimisation"): we collect only the data necessary to deliver core functionality. By default, all of the above data is stored locally on your device and is not uploaded to our servers; the handling of data involved in optional network features is described in the "Network Features and Third-Party Services" section.

I. App Usage Data

To provide you with complete music playback services, the App collects and generates the following data locally:

• (1) Music file metadata: title, artist, album, album cover, genre, year, duration, bitrate, sample rate, file path, and file format of audio files;
• (2) Playback records and statistics: play count, play duration, last-played time, playback progress, skip count, playback-mode preference (sequential, shuffle, repeat-one, repeat-list), and volume settings;
• (3) Search history: keywords entered in the in-app search box, search timestamps, and search-result click records;
• (4) User preferences: theme mode (light/dark), interface language, equalizer settings, playback speed, lyric-display preference, notification settings, and window-layout configuration;
• (5) Favorites and playlist data: names, contents, and sort orders of playlists you create and edit, and the list of songs you mark as "liked" or "favorited";
• (6) Download-management data: information about audio files downloaded through the App, download time, source URL, download status, and local storage path.

II. Device Information

To ensure normal operation and adapt to different devices, the App collects the following device-related information:

• (1) Device model and manufacturer;
• (2) Operating system type and version (e.g., Windows 11, Android 14, HarmonyOS 4.0);
• (3) Screen resolution and pixel density, for UI adaptation;
• (4) Audio output device information (e.g., speakers, Bluetooth headphone model), for audio-routing optimisation;
• (5) Storage usage, to determine whether there is enough space to cache audio data.

III. Information We Will NOT Collect

We solemnly undertake that this App will absolutely never collect the following information:

• (1) Any personally identifiable information: including but not limited to your real name, gender, date of birth, ID number, passport number, Social Security Number (SSN), or any other government-issued identifier;
• (2) Any contact information: including but not limited to your mobile number, landline number, email address (except emails you actively send via the "Contact Us" feature), home or work address;
• (3) Any account credentials: including but not limited to social accounts, bank accounts, payment passwords, login passwords;
• (4) Any biometric information: including but not limited to fingerprints, facial recognition data, iris data, voiceprint data;
• (5) Any location information: the App does not access your GPS, Wi-Fi, cellular, or any other form of geolocation data;
• (6) Any contacts, SMS, call logs, photos, videos, or other personal file contents on the device (except music files you explicitly authorise access to);
• (7) Any network-behaviour data: the App does not track your browsing history, search records, or app-usage habits outside the App;
• (8) "Sensitive Personal Information" as defined by the CCPA: we do not collect your SSN, driver's license information, bank account information, precise geolocation, racial or ethnic origin, religious beliefs, private communications, genetic data, biometric information, health information, or sexual orientation information.

Our legal bases for processing your personal data under GDPR Article 6 are as follows:

I. Performance of a Contract (GDPR Art. 6(1)(b))

To provide the App's core functions (music playback, playlist management, search history, etc.), we must process the necessary app-usage data. This processing is necessary to perform the usage agreement between you and us.

II. Legitimate Interests (GDPR Art. 6(1)(f))

To improve app performance and user experience, we process device information and anonymous usage statistics based on legitimate interests. Our legitimate interests include:

• (1) ensuring stable operation and fixing technical defects;
• (2) adapting to different devices and OS versions;
• (3) optimising audio quality and UI responsiveness.

Before processing such data we have conducted a Legitimate Interest Assessment, confirming that our interests do not override your right to privacy.

III. Consent (GDPR Art. 6(1)(a))

For non-core functions (e.g., anonymous crash reports, usage statistics), we process related data only after obtaining your explicit consent. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

IV. Legal Obligation (GDPR Art. 6(1)(c))

Where required by applicable laws and regulations, we may process necessary data based on legal obligation.

V. CCPA Compliance Statement

Under CCPA/CPRA, this App does not "sell" personal information, does not "share" personal information for cross-context behavioural advertising, and does not "disclose" personal information for commercial purposes. Because the App is a purely local architecture, we in fact do not hold a copy of your data; therefore the deletion, correction, and opt-out rights granted to consumers by the CCPA are technically exercisable by you directly through device operations.

We strictly follow the principles of minimum necessity and purpose specification, using collected information only for the clearly stated purposes below, and never for any undisclosed use.

I. Core Function Implementation

We primarily use collected information to:

• (1) Music playback: use audio metadata (title, artist, album, etc.) to build the music library and enable song search, categorical browsing, and lyric display;
• (2) Playback-state maintenance: use playback progress, playback mode, and volume settings to ensure a continuous experience when switching tracks, pausing/resuming, or restarting the App;
• (3) History and recommendations: use playback and search history to provide in-app conveniences such as "recently played", "most played", and search suggestions;
• (4) Favorites and list management: use playlist and favorite data to organise, edit, and synchronise your personal music library;
• (5) Download management: use download records to manage local audio files, providing status queries, re-downloads, and file cleanup;
• (6) UI personalisation: use theme and language preferences to render the interface according to your choices.

II. Service Optimisation and Troubleshooting

We use local diagnostic information to troubleshoot and improve the App. The App currently does not enable any statistics reporting (see the "Network Features and Third-Party Services" section):

• (1) Crash logs: crash time, stack trace, device model, and OS version, to locate and fix defects;
• (2) Performance data: app launch time, page-load time, peak memory, and CPU usage, for performance tuning;
• (3) Feature-usage frequency: click counts and duration per module, to assess feature value and guide iteration.

III. Uses We Will NOT Put Your Information To

We solemnly promise your information will never be used for:

• (1) identifying, contacting, or locating your real identity;
• (2) building user profiles or behavioural analysis to push advertisements;
• (3) selling, renting, or otherwise providing it to any third party for commercial gain;
• (4) any automated decision-making (including automated individual decisions under GDPR Art. 22), including credit scoring, insurance pricing, or recruitment screening;
• (5) any political-affinity analysis, religious-belief inference, or racial-background judgement;
• (6) any purpose beyond those stated in this Policy without your explicit separate consent (GDPR Art. 5(1)(b) "purpose limitation").

We attach great importance to your data security and adopt comprehensive technical and managerial measures to protect your information.

I. Storage Method

This App uses a purely local storage architecture; all data is stored in your device's local storage space:

• (1) Core database: an SQLite engine stores data, encrypted or in plaintext (depending on your device security settings), in the app's private directory. The exact path varies by OS (Android: /data/data/[package]/databases/; iOS: app sandbox Documents; Windows/macOS/Linux: user data directory);
• (2) Configuration files: app preferences stored as JSON or XML;
• (3) Cache files: album-cover thumbnails, lyric cache, and audio-decode cache, stored in the app cache directory;
• (4) Downloaded files: audio files you download are stored in a local directory you specify or the default download directory.

II. Storage Location and Cross-Border Transfer

Your core data, such as your music library, is not uploaded to our servers and is physically stored at the geographic location of the device you use. Network transfer occurs only when you use the optional network features described in the "Network Features and Third-Party Services" section: content services and public information lookups may involve cross-border access (depending on your network environment and the service providers involved), while data flows for the cloud-storage and media services you configure are decided and controlled by you.

III. Retention Period

We follow the data-minimisation storage principle (GDPR Art. 5(1)(e) "storage limitation"):

• (1) Playback records and statistics: retained from creation until you delete them or uninstall the App;
• (2) Search history: the most recent 500 records are kept, older ones are overwritten automatically; you can clear all search history in settings at any time;
• (3) Downloaded files: retained until you delete them or remove them via in-app download management;
• (4) Crash logs and performance data (if anonymous statistics is enabled): retained for the most recent 90 days, then auto-purged;
• (5) When you uninstall the App, the OS automatically clears all data in the app's private directory (database, config, cache), but files in download directories you set manually must be managed by you.

IV. Data Security Measures

Although the App is local, we still implement the following measures:

• (1) Database access control: OS app-sandboxing prevents other apps from unauthorised access;
• (2) Sensitive-operation confirmation: irreversible operations like bulk delete or data wipe require a second confirmation;
• (3) Integrity checks: checksum verification of the core database file to prevent accidental corruption;
• (4) Backup reminders: an in-app database export feature encourages regular backups;
• (5) Security updates: if a vulnerability affecting data security is found, we release a fix promptly via the update channel.

This App is centred on local functionality and communicates with external services only in the optional scenarios described in this section, all on a minimum-necessity basis. Where other sections of this Policy are inconsistent with this section, this section prevails.

I. Content Services Operated by the Developer

To provide update checks, release notes, and community group listings, the App makes read-only requests to servers operated by the developer (hub.bpcd.site / hub.bpcd.tech). Requests contain only the app version, platform type, interface language, and region preference — no personal identity information and no device identifiers — and we do not use these requests to build a profile of you.

II. Services You Configure Yourself (Optional)

When you add a cloud-storage or self-hosted media service (e.g., WebDAV, Subsonic/Jellyfin/Audiobookshelf, Baidu Netdisk, Aliyun Drive, Google Drive, OneDrive, Dropbox), the server address and credentials you provide are stored only on your device, and media data is transferred directly between the service you specify and your device. For Baidu Netdisk and Aliyun Drive, the OAuth authorization-code exchange is relayed through the developer's server due to platform security requirements (the authorization secret may only be kept server-side); the relay neither stores your credentials nor your media data. Please safeguard the services and credentials you configure and assess the data practices of the respective providers yourself.

III. Public Information Lookups (Optional)

When you use song/podcast information lookup or metadata enrichment, the App sends search terms such as song title, artist name, and album name to the public services you invoke (e.g., Apple iTunes, MusicBrainz, Wikidata). Those third parties process the search content under their own privacy policies; whether to use these features is entirely up to you.

IV. Anonymous Statistics (Not Enabled in the Current Version)

The App includes an optional anonymous usage-statistics framework (pointing to the developer's own server for mainland China and to Google Analytics for other regions). Its designed collection scope is limited to event name, timestamp, a randomly generated device identifier, region, language, app version, and platform type — no personal identity information and no content data. The current version does not enable any statistics reporting; if a future version enables it, we will provide prior notice as described in the "Updates to This Policy" section.

We respect and protect your data privacy, strictly adhere to the data-minimisation principle, and apply the strictest possible controls to your information.

I. We Will Not Share Your Information

Except in the following exceptional circumstances, we will not share your personal information with any third party:

• (1) With your explicit consent: after your separate, explicit authorisation, we may share information with a specified third party in the manner you designate;
• (2) Legal requirements: where applicable laws, legal proceedings, government orders, or judicial rulings require us to provide relevant information;
• (3) Public interest: where necessary to protect the life or property of you or others in matters of national security, public safety, major public interest, or emergencies;
• (4) Merger, division, or bankruptcy liquidation: if we undergo merger, division, dissolution, or bankruptcy liquidation, your data transfers as part of the business assets, but we ensure the recipient continues protections no less than this Policy and informs you in advance of the recipient's name, contact, and data-handling method.

II. We Will Not Transfer Your Information

Except for circumstance (4) above, we will not transfer your personal information to any company, organisation, or individual. In any asset-transfer scenario, we require the new holder to remain bound by this Policy, or we require that company/organisation to re-seek your authorisation.

III. We Will Not Publicly Disclose Your Information

We will not disclose your personal information publicly, on the internet, or to unspecified recipients, unless:

• (1) with your explicit consent and your full understanding of the type, purpose, and possible consequences of disclosure;
• (2) required by law or by mandatory demands of government authorities or judicial bodies;
• (3) in legal proceedings or dispute resolution, to protect our legitimate rights within the minimum necessary scope, disclosing to arbitral institutions, courts, or opposing parties.

IV. Exception Note

Because the App is centred on local storage, we do not hold a copy of your data except for the optional network features described in the "Network Features and Third-Party Services" section; data involved in those features (such as search terms) may be processed by the respective service providers according to its nature. Even if a legal demand arises, since your core data exists only on your local device, the relevant law-enforcement or judicial request should normally be directed to you personally.

V. GDPR Data Controller Statement

For GDPR purposes, Bibixidi (bpcd) is the data controller of personal data processed by this App. Except for the optional network features described in the "Network Features and Third-Party Services" section, the App does not transmit any data to servers; third-party services you configure are operated as independent controllers by their respective providers.

Under the PRC Personal Information Protection Law, the EU GDPR, the US CCPA/CPRA, and other applicable laws, you have the following rights regarding your personal information. Because the App is centred on local storage, you can exercise these rights directly through in-app features or OS tools, without our approval.

I. Right to Access

You may review all data the App stores about you:

• (1) Your playback history, search history, favorites, and playlists are presented directly in the corresponding app interfaces and can be reviewed at any time;
• (2) In Settings → Services, view the media sources and cloud-storage services you have configured;
• (3) Use the "Export Database Backup" feature to export the local database as a backup file.

II. Right to Deletion / Right to be Forgotten

You may request deletion of your personal data (GDPR Art. 17). We provide:

• (1) Single deletion: long-press or right-click a record in playback history, search history, or favorites;
• (2) Batch deletion: multi-select in the relevant list;
• (3) Clear data: Settings offers "Clear Database" (with an option to keep theme and interface preferences), "Clear Cache", "Sign out and clear scanned tracks", and "Clear All" in download management;
• (4) Uninstall: uninstalling the App automatically clears all data in its private directory.

III. Right to Restrict Processing

Under GDPR Art. 18, you may restrict our processing of your personal data. Because the App is centred on local processing, you can exercise this right by closing the App, limiting device permissions, or disabling the relevant optional network features.

IV. Right to Object

Under GDPR Art. 21, you may object to processing based on legitimate interests. If you object, we stop the relevant processing unless we demonstrate compelling legitimate grounds.

V. Right to Withdraw Consent

For optional features, you may withdraw consent at any time (GDPR Art. 7(3)):

• (1) The App currently does not enable statistics reporting; the statistics display can be managed in Settings → Statistics;
• (2) You may remove configured cloud-storage and media services and their credentials at any time;
• (3) After withdrawal, we stop the relevant processing without affecting the App's core functions.

VI. Right to Data Portability

You may obtain a copy of your data and transfer it between services (GDPR Art. 20):

• (1) The "Export Database Backup" feature gives you a complete copy of your local data;
• (2) For exports in other formats, submit a request via the channels described in the "Contact Us" section.

VII. CCPA-Specific Rights

Under CCPA/CPRA, California residents also have:

• (1) Right to know what personal information we collect and its use;
• (2) Right to delete;
• (3) Right to correct inaccurate information;
• (4) Right to opt out: the App does not sell personal information, so opt-out is unnecessary.

VIII. Response Time

If you contact us by email to exercise these rights, we respond within 15 business days of receiving the request (GDPR requires 30 calendar days, CCPA 45 extendable to 90; we commit to the shortest applicable period).

This App welcomes users of all ages and imposes no age limit or usage threshold. This section states our commitment to protecting minors' personal information, rather than restricting minors from using the App.

I. Our Commitment

As a purely local music player, the App involves no user registration, login, or identity verification, so we do not actively collect any information identifying a minor, including name, school, grade, or guardian contact details. All user data is stored locally on each device; we cannot access it.

II. Applicable Law

Jurisdictions differ on minor-data protection:

• Mainland China: the Provisions on the Protection of Minors' Personal Information in Cyberspace apply to children under 14
• EU/EEA: GDPR Art. 8 applies to minors under 16 (some member states lower to 13)
• United States: COPPA applies to children under 13
• Other regions: the local statutory age for minors applies

Because the App does not collect or upload any information capable of identifying a user, the consent requirements of these laws are naturally satisfied by the App's architecture.

III. Guardian Rights

If you are a guardian of a minor, you have:

• (1) Access: review all data the App stores on your child's device;
• (2) Correction: request correction of any inaccurate or incomplete local data;
• (3) Deletion: request deletion of the minor's personal information by uninstalling or clearing app data;
• (4) Withdraw consent: if you previously consented to a minor's use, you may withdraw it;
• (5) COPPA-specific: if you are a US resident who believes we may have inadvertently collected a child's personal information under 13, contact us immediately and we will take steps to delete it.

IV. Contact Us

Email: bpcd@foxmail.com

We will verify and respond within 15 business days; in emergencies we will contact you within 24 hours to confirm.

We may revise this Policy from time to time as laws, business, or technology change. We undertake that no revision will lower the standard of your rights or expand the scope of information we collect or use.

I. Update Methods

Updates are notified via:

• (1) In-app notice: a prominent update prompt at launch or on Settings → About → Privacy Policy;
• (2) Release notes: major privacy changes described in the update log when a new version is published on app stores;
• (3) Website: the privacy policy page on our official site https://www.bpcd.tech is updated synchronously.

II. Material Change Notification

If a change qualifies as "material" (defined below), we send a dedicated notice before it takes effect, via in-app popup, push notification, or email.

III. Definition of Material Change

The following constitute material changes:

• (1) a major change in our service model, e.g., the purpose, type, or manner of processing personal information changes;
• (2) a change in the main recipients of sharing, transfer, or disclosure;
• (3) a major change in your rights regarding personal-information processing or how to exercise them;
• (4) a change in our contact or complaint channels;
• (5) a personal-information security incident that may affect your rights;
• (6) any other change that may materially affect your rights.

IV. Binding Effect

If you continue using the App after an update, you are deemed to have read, understood, and agreed to the updated Policy. If you disagree, you may stop using the App and delete your local data as described in the "Your Rights" section.

We have established a dedicated channel for personal-information protection. If you have any questions, comments, suggestions, or complaints about this Policy, or wish to exercise any right under it, contact us as follows.

I. Contact

Developer: Bibixidi (bpcd)

Email: bpcd@foxmail.com

Website: https://www.bpcd.tech

Data Protection Officer (DPO) email: bpcd@foxmail.com

II. Response Time

We commit to replying within 15 business days of receiving your email. Complex issues needing verification or technical support may take up to 30 business days, with prior notice of the reason. Issues involving security incidents or urgent rights protection are prioritised, with initial feedback within 24 hours.

III. Complaint Channels by Jurisdiction

If you are dissatisfied with our reply, or believe our processing harmed your rights, you may complain to:

• (1) Mainland China: the Cyberspace Administration or local cyberspace authority, or the Market Regulation Administration;
• (2) EU/EEA: your member state's Data Protection Authority (full list: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en);
• (3) California, US: the California Privacy Protection Agency or the Office of the Attorney General;
• (4) Other regions: your jurisdiction's consumer-protection or data-protection authority;
• (5) Judicial: you may file suit in a court of competent jurisdiction.

We are always committed to protecting your privacy. Thank you for choosing Hyper Music.