中文
- 适用范围与运营者
- 账号与注册资料
- 您主动提交的文字反馈
- 本地作品与设备权限
- 在线连接与邮件服务方
- 信息保存与清理
- 您的选择与账号注销
- 信息访问与保护
- 未成年人使用安排
- 联系与政策更新
1 适用范围与运营者
BeLovePiano 由厦门白鹭数码钢琴有限公司（Amoy Digital Piano Co., Ltd.，以下简称“我们”）运营。隐私联系邮箱为 sales@amoypiano.com。本政策说明您使用 BeLovePiano 的本地功能，以及选择使用账号、学习进度同步、在线资源和文字反馈时，相关信息如何处理。
基本乐器连接、演奏及本地乐器功能可免登录使用。注册为可选择的账号服务；不注册或不同意注册相关信息处理，不影响继续使用这些游客功能。在线资源仍需要网络，部分功能需要您允许相应的设备权限。
2 账号与注册资料
新账号通过邮箱验证码验证。新注册要求填写邮箱、您自行选择的国家或地区，以及带国际区号的手机号码。邮箱验证成功后，您需要补全注册资料并主动同意注册隐私说明；同意选项默认未勾选。手机号是新注册的必填服务联系资料。已有邮箱账号可通过邮箱验证码登录，无需重复注册；之前未填写手机号的账号无需补填也可继续登录。
邮箱用于验证码投递、账号识别和必要的账号服务。国家或地区由您自行选择，用于账号资料和服务支持，不从 IP 地址或手机号前缀推断。新注册需提供带国际区号的服务联系手机号，供账号服务支持联系使用；邮箱验证码仍是账号认证方式。
手机号码仅作为您提供的未验证联系方式保存。系统只检查号码格式，不验证号码归属、真实可达性或持有人身份；本版本不向该号码发送验证码短信，不用它登录、找回、合并账号或认定营销许可。请只提供您有权使用的服务联系方式。
账号服务保存已验证邮箱、账号标识、昵称、国家或地区、您提供的未验证联系手机号（旧账号可能未提供）、账号创建及更新时间、注册隐私同意的版本和时间，以及必要的验证、会话与服务操作记录。注册不会开通营销订阅；注册隐私同意与营销同意相互独立，另行营销须另行征得您的同意。
使用已登录账号学习时，App 会同步课程标识和学习进度位置，在登录后和保存该账号学习进度时与账号服务交换相关记录。游客学习记录不会自动归入新登录账号。本地录音、视频和作品文件不属于这项进度同步。账号服务还可能保存已有的人工服务权益及到期状态；注册本身不构成购买或订阅。
3 您主动提交的文字反馈
您可主动提交问题或建议。提交内容包括反馈类型、涉及模块、文字说明、您自愿填写的联系方式，以及 App 版本与构建号、操作系统平台和界面语言。反馈不要求登录，也不自动附带账号标识、乐器标识、录音、视频、截图或运行日志。请勿在正文中填写密码、验证码或不必要的个人信息。
反馈草稿先保存在本机。只有您点击提交且已配置可用的接收服务时，才会发送到我们的反馈服务；网络失败时草稿可保留供您重试。服务端保存成功后才返回回执，同一次请求的重试不会重复创建反馈。我们使用这些内容排查问题、处理建议及按您留下的联系方式提供支持。后台不会自动发送营销信息或打开反馈中的链接。
4 本地作品与设备权限
演奏事件、本地学习记录、您导入的素材，以及录音和视频作品主要在设备上处理和保存。MIDI 是演奏控制信息，不等于麦克风音频；连接蓝牙或 USB MIDI 乐器本身不表示 App 正在录制其声音。录音和录像取决于您选择的模式、设备实际输入及权限。
蓝牙或附近设备权限用于发现并连接乐器；部分较旧 Android 版本可能要求前台位置权限才能扫描蓝牙。App 的蓝牙扫描不用于推断您的物理位置。麦克风权限用于您启动的录音功能；相机权限用于相应录像或扫码功能；媒体、照片或文件访问用于您选择的导入、播放、导出或保存。您可在系统设置中管理权限，拒绝某项权限可能使依赖它的功能无法使用。
家庭乐队的本地网络功能在同一局域网的设备之间交换协作状态和演奏提示，不通过该局域网会话传输麦克风音频。
账号注册、登录和进度同步不会自动上传您的录音、视频或作品到外部 AI 或内容生成平台。导出到本机或相册与对外分享是不同操作；您通过系统分享或自行使用第三方平台时，由您选择接收方，相关接收方按其规则处理信息。设备或系统备份、您另行保存的导出副本，也由相应设备、系统或服务管理。
5 在线连接与邮件服务方
访问在线目录、乐谱、伴奏、课程或教学视频时，App 会向相应资源服务器请求或下载内容。网络连接所需的信息，例如 IP 地址、请求目标和时间，会到达相关服务器。下载资源不等于上传本地作品。账号与反馈请求通过配置的 HTTPS 服务处理；选择自行打开的外部网页时，该网站也会接收浏览连接信息。
验证码邮件使用阿里云邮件推送 DirectMail，配置地域为中国杭州（cn-hangzhou）。发件地址为 verify@notify.amoypiano.com，显示名为 BaiLu验证码。为投递验证码，邮件服务方处理收件邮箱、验证码邮件内容以及必要的投递信息。注册填写的未验证手机号和国家或地区不作为这封验证码邮件的投递字段发送给 DirectMail。
DirectMail 的配置地域不代表所有数据或每个收件邮箱均位于同一地域。邮件还会经收件人的邮箱服务处理，具体投递路径可能涉及收件邮箱所在地域。账号数据库、资源服务、运营备份与邮件服务具有各自的处理范围；不会仅因邮件服务配置为杭州就推定其他系统的存储地点。您可通过本政策末尾的联系方式询问与您使用情况有关的处理安排。
6 信息保存与清理
账号资料及账号学习进度通常保留到您注销账号。退出登录仅结束该次登录状态，不会注销账号或删除云端资料。验证码的有效期为 5 分钟，会话的有效期为 24 小时；到期后不能继续用于验证或访问。用于安全和重试的记录按各自有效期及清理规则处理。有效期届满与记录从存储中删除不是同一时刻。
反馈正文连同其中的自填联系方式和诊断上下文，在保存满 30 天后进入到期清理。服务正常运行且存储可用时执行清理；服务停机或存储故障可能导致实际删除延迟，恢复后需继续清理。30 天不适用于本机尚未提交的草稿，也不表示所有相关副本同时被物理删除。
为避免相同请求再次产生反馈，服务保留独立去重回执，包括请求标识、回执标识、保存时间及带密钥的内容摘要。反馈正文清理后这些回执仍保留，当前没有自动按天删除期限；回执不保存原始反馈正文或明文联系方式。
一般管理审计记录也没有自动按天删除期限。我们在处理删除请求、服务维护或备份处置时人工复核这些记录及备份的保留必要性，并对不再需要保留的资料安排删除或去标识处理。账号注销会清除与该账号关联的审计目标和详情；其余审计事件、独立反馈回执、私有备份及供应商投递记录不因此即时全部消失。
私有备份和供应商记录按实际人工复核、轮换或服务方规则处理，当前不承诺自动备份轮换或统一的自动删除天数。需要了解或请求处理特定记录时，请联系我们；我们会核实记录范围及实际可执行的处理方式。依法确需保留的资料，仅在相应需要的范围内保留。
7 您的选择与账号注销
您可以不注册、退出账号、停止提交反馈，并在系统设置中管理设备权限。您也可以联系 sales@amoypiano.com，提出查阅、更正、删除个人信息或撤回相关同意的请求。我们会按请求范围核实必要信息；请勿发送密码或验证码。
在 App 内注销账号，需要取得并输入一枚新的邮箱验证码确认。注销成功后，服务撤销该账号的会话，删除账号、身份联系方式、资料、未验证手机号、账号学习进度及关联服务权益，并清除与该账号关联的审计目标和详情。为支持同一次删除请求的短时安全重试，系统会保留 5 分钟有效的摘要回执。
App 同时尝试删除本机该账号的学习进度缓存；若本机删除未确认，App 会提示。注销不会自动删除游客进度、其他账号缓存、本地录音视频、资源库、相册或您另行导出的文件，您可在相应位置管理这些内容。
文字反馈独立于账号提交，不携带账号登录凭据，因此注销账号不会自动识别并删除您曾提交的独立反馈。您可提供反馈回执并联系我们请求处理。反馈内容、去重回执、备份和服务方记录分别按上一节处理。
8 信息访问与保护
账号与反馈服务采用访问控制，按后台角色限制操作。普通账号页面和后台列表显示脱敏联系方式；获授权的支持人员可在工作所需范围内查看单人详细资料。仅获授权的编辑角色在明确打开单人详情时可查看完整的未验证服务手机号，并留下审计记录；只读角色无法取得该原号码。
公开账号与反馈接口使用 HTTPS，验证码及会话验证资料使用带密钥的摘要等方式保护。联系方式需要用于账号和服务支持，不能将这理解为所有存储内容均已匿名或端到端加密。请妥善保护您的邮箱和设备；网络、设备和存储措施都无法保证绝对安全。
9 未成年人使用安排
我们建议未成年人优先在监护人指导下使用免登录的基本乐器和本地功能。如需账号服务，请由监护人办理或监督账号使用，阅读本政策，并使用监护人管理的邮箱；新注册所需的服务联系手机号应使用监护人的联系号码；既有未提供手机号的账号仍可登录。不要在反馈中提交不必要的儿童身份、学校或其他个人信息。
当前注册流程没有实施年龄检查、监护人身份核验或自动确认监护关系。填写联系方式、通过邮箱验证码或勾选隐私同意，都不代表已完成年龄或监护人验证。监护人如对未成年人信息的收集或使用有疑问，可通过 sales@amoypiano.com 联系我们请求核实及处理。
English
- Scope and operator
- Accounts and registration information
- Text feedback you choose to submit
- Local works and device permissions
- Online connections and the email provider
- Retention and cleanup
- Your choices and account deletion
- Access and protection
- Use by minors
- Contact and policy updates
1 Scope and operator
BeLovePiano is operated by 厦门白鹭数码钢琴有限公司 / Amoy Digital Piano Co., Ltd. (“we”, “us”). Our privacy contact is sales@amoypiano.com. This policy explains information handling for local features and for account services, learning-progress synchronization, online resources and text feedback that you choose to use.
Basic instrument connection, playing and local instrument features are available without signing in. Account registration is optional. Declining registration or its related information processing does not prevent use of these guest features. Online resources still require a network connection, and some features require the corresponding device permissions.
2 Accounts and registration information
New accounts are verified with an email one-time code. New registration requires an email address, a country or region that you select, and a phone number with an international dialing code. After successful email verification, you must complete the registration details and actively accept the registration privacy notice; the acceptance box is initially unchecked. A service-contact phone number is required for new registration. Existing email accounts can sign in with an email code without registering again, including accounts created without a phone number; those accounts can continue signing in without adding one.
Your email is used for code delivery, account identification and necessary account services. Your selected country or region is used in your account profile and service support; it is not inferred from your IP address or phone prefix. New registration requires a service-contact phone number with an international dialing code for account support contact. Email verification codes remain the account authentication method.
The phone number is stored only as an unverified contact that you provide. The system checks its format, not ownership, reachability or the holder’s identity. This version does not send verification SMS to that number and does not use it for sign-in, account recovery, account merging or marketing authorization. Provide only a service-contact number that you are entitled to use.
The account service stores your verified email, account identifier, nickname, country or region, the unverified phone you provide (older accounts may have no phone), account creation and update times, the version and time of registration privacy consent, and necessary verification, session and service-operation records. Registration does not subscribe you to marketing. Registration privacy consent is separate from marketing consent; any separate marketing requires your separate consent.
When you learn while signed in, the App synchronizes course identifiers and progress positions with the account service after sign-in and when that account’s progress is saved. Guest learning history is not automatically assigned to a newly signed-in account. Local audio, video and work files are not part of this progress synchronization. The account service may also retain existing manually assigned service entitlements and their expiry status; registration itself is not a purchase or subscription.
3 Text feedback you choose to submit
You may choose to submit a problem or suggestion. A submission includes its type, affected module, description, any contact details you voluntarily enter, and the App version and build number, operating-system platform and interface language. Feedback does not require sign-in and does not automatically attach an account identifier, instrument identifier, recording, video, screenshot or runtime log. Do not include passwords, verification codes or unnecessary personal information.
A feedback draft is saved locally first. It is sent to our feedback service only when you choose Submit and an available receiving service is configured; a failed submission can leave the draft available for retry. The server returns a receipt only after successful storage, and retries of the same request do not create duplicate submissions. We use the content to investigate problems, handle suggestions and provide support using any contact details you supply. The administration tool does not automatically send marketing messages or open links in feedback.
4 Local works and device permissions
Performance events, local learning records, imported material, and audio and video works are primarily processed and stored on your device. MIDI carries performance-control information, not microphone audio. Connecting a Bluetooth or USB MIDI instrument does not itself mean that the App is recording its sound. Recording depends on your selected mode, the device’s actual input and the permissions you grant.
Bluetooth or nearby-device permissions are used to discover and connect instruments. Some older Android versions may require foreground location permission for Bluetooth scanning; the App does not use Bluetooth scanning to infer your physical location. Microphone permission supports recording that you start; camera permission supports the relevant video or scanning features; media, photo or file access supports importing, playing, exporting or saving material you select. You can manage permissions in system settings. Denying a permission may prevent features that depend on it from working.
Family-band local-network features exchange collaboration state and performance prompts among devices on the same local network. That local-network session does not transmit microphone audio.
Account registration, sign-in and progress synchronization do not automatically upload your recordings, videos or works to external AI or content-generation platforms. Exporting to your device or photo library is separate from sharing. When you use system sharing or a third-party platform yourself, you choose the recipient, whose own rules apply. Device or system backups and separate copies you export are managed by the corresponding device, system or service.
5 Online connections and the email provider
When you access online catalogs, scores, backing tracks, courses or tutorial videos, the App requests or downloads content from the corresponding resource servers. Information needed for the network connection, such as IP address, request target and time, reaches those servers. Downloading a resource does not upload a local work. Account and feedback requests use the configured HTTPS services. An external website you choose to open also receives browsing-connection information.
Verification emails use Alibaba Cloud DirectMail configured in China (Hangzhou), region cn-hangzhou. The sender address is verify@notify.amoypiano.com and the display name is BaiLu验证码. To deliver a code, the email provider processes the destination email, verification-message content and necessary delivery information. The unverified phone and selected country or region entered during registration are not sent to DirectMail as delivery fields for that code email.
The configured DirectMail region does not mean that all data or every recipient mailbox is in the same region. The recipient’s email service also processes the message, and delivery may involve the mailbox’s region. Account storage, resource services, operational backups and email delivery have separate processing scopes; the location of other systems cannot be inferred from the Hangzhou email configuration. You may contact us below about arrangements relevant to your use.
6 Retention and cleanup
Account information and account learning progress are generally retained until you delete the account. Signing out ends that sign-in state; it does not delete the account or its cloud information. Verification codes are valid for 5 minutes and sessions for 24 hours, after which they cannot authorize verification or access. Security and retry records follow their own expiry and cleanup rules. Expiry and removal from storage do not necessarily happen at the same moment.
Feedback content, including contact details and diagnostic context inside it, becomes eligible for cleanup 30 days after storage. Cleanup runs while the service and its storage are working. Service downtime or storage failure can delay actual deletion, and cleanup must continue after recovery. The 30-day period does not apply to unsubmitted local drafts and does not mean that all related copies are physically erased at the same time.
To prevent the same request from creating feedback again, the service retains separate deduplication receipts: request identifier, receipt identifier, storage time and a keyed content digest. These remain after feedback-content cleanup, with no automatic age-based deletion period at present. A receipt does not store the original feedback body or plaintext contact details.
General administrative audit records also have no automatic age-based deletion period. When handling deletion requests, maintaining the service or managing backups, we manually review whether these records and backups remain necessary and arrange deletion or de-identification of information no longer needed. Account deletion clears linked audit targets and details. Other audit events, independent feedback receipts, private backups and provider delivery records do not all disappear immediately as a result.
Private backups and provider records are handled through actual manual review, rotation or provider rules. We do not currently promise automatic backup rotation or a single automatic deletion deadline. Contact us about particular records; we will check their scope and the available handling process. Information that must be retained by law is retained only within the relevant need.
7 Your choices and account deletion
You can remain a guest, sign out, stop submitting feedback and manage device permissions in system settings. You may also contact sales@amoypiano.com to request access, correction or deletion of personal information, or withdrawal of relevant consent. We will verify information necessary for the request. Do not send passwords or verification codes.
Account deletion within the App requires a fresh email verification code. After successful deletion, the service revokes the account’s sessions, removes the account, identity contacts, profile, unverified phone, account learning progress and associated service entitlements, and clears linked audit targets and details. A hashed retry receipt, valid for 5 minutes, supports safe retries of the same deletion request.
The App also attempts to remove that account’s local learning-progress cache and displays a message if local removal is not confirmed. Deletion does not automatically remove guest progress, other accounts’ caches, local audio or video, the resource library, photo-library items or separately exported files. You can manage those in their respective locations.
Text feedback is submitted separately without account sign-in credentials, so account deletion does not automatically identify and erase your independent feedback submissions. You may contact us with the feedback receipt to request handling. Feedback content, deduplication receipts, backups and provider records follow their separate arrangements described above.
8 Access and protection
Account and feedback services use access controls and restrict actions by administrative role. Ordinary account views and administrator lists mask contact information. Authorized support personnel may view individual details as needed for their work. Only an authorized editor can explicitly open an individual record to view the full unverified service-contact phone, and this action is audited. A read-only viewer cannot obtain that raw number.
Public account and feedback interfaces use HTTPS, and verification-code and session-verification records are protected with measures such as keyed digests. Contact details are retained for account and support use; this does not mean all stored information is anonymous or end-to-end encrypted. Protect your mailbox and device. No network, device or storage measure can guarantee absolute security.
9 Use by minors
We recommend that minors start with guest instrument and local features under guardian guidance. If account services are needed, a guardian should arrange or supervise account use, read this policy and use an email address managed by the guardian. Use the guardian’s contact number for the service-contact phone required for new registration. Existing accounts without a phone number can continue signing in. Avoid including unnecessary information about a child’s identity, school or other personal details in feedback.
The current registration flow does not implement age checks, guardian-identity verification or automatic confirmation of a guardian relationship. Entering contact details, verifying an email or accepting the privacy notice does not constitute age or guardian verification. Guardians with concerns about a minor’s information may contact sales@amoypiano.com to request review and handling.