Privacy Policy

Policy Dates

Last updated: September 7, 2026
Effective date: September 7, 2026

Music Lab is an integrated music service offering exams, practice, and learning, provided by Shenzhen Shumiao Technology Development Co., Ltd. (referred to as Shumiao Technology or we). We take users' personal information and data seriously. Before using any products or services in this app, please read this Policy carefully and make sure you understand how we handle your personal information. Contact us if you have questions. If you disagree with any term, stop using the app immediately. Choosing to use our products and services, or continuing to use them after a Policy update of which the app will promptly notify you, means that you acknowledge and accept this Policy, including its updates, and agree to our collection, use, storage, and sharing of your information as described here.

IMPORTANT NOTICE ABOUT SENSITIVE INFORMATION (with reference to Appendix B of GB/T 35273-2020). Sensitive personal information processed by this app includes, but is not limited to: mobile phone numbers, identity document numbers, facial recognition biometrics, microphone recordings, precise GPS location, permanent device hardware identifiers such as IMEI/MAC/IMSI, payment accounts, web browsing activity logs, and all personal information of children under 14. Disclosure, unlawful provision, or misuse of this information can seriously endanger your personal safety or property. Sensitive information is highlighted in bold throughout this Policy. We seek separate, explicit consent for each category, and you may withdraw the corresponding authorization at any time. The national standard is available at:

https://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=4568F276E0F8346EB0FBA097AA0CE05E

Definitions (with reference to Appendix B of GB/T 35273-2020, Information Security Technology — Personal Information Security Specification). The standard is available at:

https://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=4568F276E0F8346EB0FBA097AA0CE05E

1. Personal Information

Information recorded electronically or otherwise that relates to an identified or identifiable natural person.

2. Sensitive Personal Information

Personal information whose disclosure, unlawful provision, or misuse could readily endanger personal safety or property, damage a person's reputation, or cause discrimination. It includes, but is not limited to, identity document numbers, biometrics such as facial recognition data, bank card and bank account information, precise location, browsing history, audio recordings, mobile phone numbers, permanent device hardware identifiers, and all personal information of children under 14. See the list in Appendix B of the national standard above for the specific scope.

3. Data Minimization

We collect only the information necessary for the relevant business function. You may refuse to provide nonessential information without affecting the product's basic learning functions.

1. Information We May Collect

Our products and services display exam and practice content and enable you to answer questions. During these activities, we collect certain information based on how you use the products or services, including the following personal information:

1.1 Device Information

Information about the device you use to access our products or services includes device model and name, browser type and settings, language settings, operating system and app versions, network access method, network quality data, mobile network information including carrier name, product version, and login IP address. Resettable identifiers such as OAID, Android ID on Android, and IDFA/IDFV on iOS distinguish guest users and support account security and risk controls. SPECIAL NOTICE ABOUT SENSITIVE INFORMATION: only for account security verification, and after you actively give separate consent, will we temporarily read MAC, SIM, IMEI, or IMSI information. Refusing authorization does not affect basic functions such as answering questions, browsing the question bank, or online practice. We do not retain these permanent sensitive hardware identifiers long term. We request device information permissions and obtain the relevant information according to your authorization.

1.2 Log Information

When you use our products and services, we automatically collect your online activity and save it in operation or service logs. This includes browsing, likes, shares, comments, interactions, favorites, follows, playback history, playback duration, and access dates and times.

1.3 Running Processes

When you use our products or services, we check running processes on the device to determine whether this app is in the foreground so that its business logic can operate normally. We make this instantaneous check only while the app is in the foreground. The data is processed transiently; no process-related data is cached, uploaded, or persistently stored, and there is no long-term retention.

1.4 Location Information

(a) Approximate Region (Nonsensitive Information)

Used to adapt content to your region. You may turn off location permissions in your system settings at any time.

(b) Precise GPS Location (Sensitive Location Information)

Used only for the Nearby People social feature. A separate pop-up explains the purpose and requests separate consent. If you turn off location permissions, we immediately stop all location collection and do not retain your historical location trails. Location information may include real-time information supplied by you or others, such as your region in account details, shared information indicating your current or previous location, or geotags in shared photos. You can stop location collection by turning off location access.

1.5 Audio Recordings

Microphone input and audio recordings are sensitive biometric personal information and are used only for listening-based score recognition and mock listening exams. Basic functions such as browsing questions, organizing mistakes, and learning from video courses do not require microphone access. You may turn off this permission at any time; only listening-specific features are affected, while other services remain available. Recordings are used only for real-time audio frequency analysis and are not stored or uploaded.

1.6 Installed App Lists

Unauthorized parties have recently produced pirated versions of Music Lab through decompilation, repackaging, and other unlawful methods, which may expose your personal information and harm your rights. We verify only Music Lab's own package name and version to identify piracy and protect accounts. We do not enumerate or read other installed third-party apps or obtain app lists in bulk.

1.7 Photo Library and SD Card Contents

When you post content, take mock exams, or change your avatar, we need access to your photo library and SD card to obtain image data and cache exam results for faster access later. This supports the core service of displaying your exam results. Refusing these permissions prevents posting, changing avatars, and uploading screenshots only; basic question practice and mock exams remain available. Device information and log information alone cannot identify you.

2. How We Collect and Use Personal Information

Below, we describe the personal information necessary for each function. We will prompt you for the required permissions when you use that function.

2.1 Mock Exams, Theory Practice, and Mistake Review

You can use basic functions, mainly mock exams and practice, as a guest. To provide these functions and fulfill network security obligations, we collect necessary device information, including model, operating system version, and resettable identifiers such as Android ID, IDFA, and IDFV. We assign you a unique identifier and use it to record guest activity, including browsing and favorites, in log files. We may request storage permissions to record logs and cache content, and location information to provide more relevant content.

You may also register for enhanced and personalized services. You may refuse the personal information requested for any function below. Refusal affects only that specific function, not the basic functions. We collect personal information for the following purposes:

2.2 Creating and Maintaining Your Account

2.2.1 Basic Account Creation

To create an account and receive registered member services, you must provide (1) a mobile phone number and (2) a username that you set in the Music Lab app. This information enables account login and protects account security. Without a mobile phone number you cannot register or create a basic account, but you can continue using Music Lab's other functions.

2.2.2 Account Recovery

You can recover a lost account. If you forget your password, you can verify by SMS or contact customer support to recover or reset it. We need information to verify your identity and may request identity information, your mobile phone number, usual login locations and devices, frequently listened-to content, registration time, and city. Where necessary, facial recognition may also be used to verify your identity.

2.2.3 Uploading, Publishing, and Connecting with Friends

If you upload videos or photos, post on-screen comments, comments, messages, or other content, applicable laws and regulations may require the following additional information:

(a) Required Real-Name Information

a. To ensure content safety, prevent suspicious accounts from disturbing users and audiences, and fulfill our duty to maintain a safe online environment, we may require users who frequently or in bulk upload spam advertising, spam videos, or prohibited content, or whose total audio uploads reach a certain duration, to provide an identity document number and a photo showing their face together with their identity document for real-name verification. If you refuse, we may temporarily disable your audio publishing function.

b. National regulatory requirements call for full real-name verification of accounts registered outside the country. We therefore require those users to provide real-name information and obtain platform approval before video uploading and publishing are enabled.

This information is necessary for uploading and publishing audio, video, and information on our platform. Not providing it does not affect basic services.

(b) Connecting and Sharing

Our services let you connect with friends and share content. When communicating, transacting, or sharing, you choose the recipients, who can see your membership level, public nickname, and the information you share. Public information includes anything you share publicly, such as comments, on-screen comments, replies, avatars, nicknames, and usernames. Shared content may contain other people's personal information; please ensure that you have their lawful authorization. You must also protect your own information and disclose or display it to others only when necessary. Contact Music Lab customer support immediately if your personal information, particularly your account or password, is exposed.

2.2.4 Personalized Recommendations and Security

To recommend more suitable personalized content, improve search results, show relevant rather than general results and content, generate personalized listening reports, understand compatibility across hardware, maintain a secure operating environment, and detect abnormal account activity, we collect the following information:

(a) Device Information

Based on your installation and use, we receive and record device information including model, operating system version, settings, unique identifiers such as Android ID, IDFA, IDFV, and UUID, necessary mobile app list information, software, hardware, device and device environment information, and sensor information. We also collect device location information: to determine regional content rights, this includes precise GPS location authorized by you (sensitive information), WLAN access points, base stations, and sensor information.

(b) Log Information

When you use our website or client, we automatically collect detailed usage information as network logs. These include searches, browsing, follows, playback history, purchases, visit counts, playback duration, IP address, Wi-Fi and carrier networks, language, and access dates and times.

From this information we extract preferences and create indirect audience profiles using feature labels to display or deliver personalized content and possible commercial advertisements. We aim to protect your user experience. If you are not interested in recommendations or no longer want personalized services, you can turn them off under Me > Study Reminders.

2.2.5 VIP Membership and Subscriptions

When you pay for VIP membership, we record your payment method, financial account, and order transaction information (sensitive financial information) to enable refunds through the original payment method, promotional reward withdrawals, cancellation of recurring monthly services, and after-sales support. Depending on your payment method, we share payment details, order security information, and information required by anti-money-laundering laws through embedded third-party payment SDKs. To maintain payment security and trace online transactions as required by law, we also record, retain, and display orders for memberships, individual papers, or practice activities. Refusal prevents VIP membership or subscription services but does not affect other Music Lab functions.

Lifetime VIP lasts until the product reaches the end of its lifecycle and ceases operating, whether voluntarily or involuntarily. Voluntary cessation means the company announces that it will stop operating. Involuntary cessation includes closure, bankruptcy, app removal, market policy changes, force majeure, or other circumstances preventing continued operation. Lifetime VIP ends automatically when operations cease. Music Lab VIP and SVIP are virtual online products paid for before service is provided. Membership fees are the price of the purchased online service, not an advance payment, deposit, security deposit, or stored-value card. Once activated, membership is nonrefundable. Under the Consumer Rights Protection Law of the People's Republic of China, the product is not subject to the seven-day no-reason return rule.

2.2.6 Security Features

To fulfill network security obligations, improve service safety, secure the operating environment, and prevent phishing, fraud, vulnerabilities, viruses, attacks, and intrusions, we investigate potential unlawful activity and breaches of our agreement, policies, or rules. Examples include abnormal membership activity, multiple-device logins, unusual traffic, frequent refunds, or low-price membership transfers. We and embedded security SDKs automatically collect device information in the background, including model, operating system version, settings, unique identifiers (Android ID, IDFA, IDFV, UUID), necessary mobile app list information, software, hardware, and device environment information. We also collect logs including searches, browsing, follows, playback records, visits, playback duration, IP address, Wi-Fi and carrier networks, language, and access dates and times. We may use or combine account, transaction, payment, and other information shared with your authorization or under law to assess account and transaction risks, verify identity, detect and prevent security incidents, and take legally required recording, auditing, analysis, and response measures to protect all parties' lawful rights.

2.2.7 Account Deletion

After account deletion, you cannot log in or use our products and services with that account. All unused entitlements and expected future benefits are removed. Associated content, information, data, and records are deleted or anonymized unless laws, regulations, or regulators require otherwise. Deletion cannot be reversed. If you still wish to proceed after careful consideration, submit a request through the relevant settings or instructions, for example Me > Account Management > Delete Account. If the request fails, contact customer support; we will respond within 15 working days. After you voluntarily delete your account, we stop providing products or services to you.

3. Special Protections for Sensitive Personal Information (Requirements of Appendix B of GB/T 35273-2020)

3.1 Separate Notice and Consent

Before collecting sensitive personal information such as facial biometrics, identity document numbers, mobile phone numbers, precise location, recordings, permanent device hardware identifiers, or payment accounts, we display a separate pop-up explaining the purpose, storage period, and risks. You must actively check a box to authorize collection. Consent is not bundled with basic services, and you may refuse individual categories of sensitive information.

3.2 Encrypted Storage

All sensitive personal information is stored with AES encryption and tiered access controls. Access is limited to designated internal compliance and risk-control staff. All access is recorded in audit logs to prevent disclosure, alteration, or loss.

3.3 Minimum Retention Periods

(1) Real-name and facial verification information is retained while the account remains in use and permanently deleted within 15 working days after account deletion. (2) Real-time location and temporary audio data are processed immediately and are not stored long term. (3) Payment transaction records are retained for the legally required financial regulatory period, then automatically de-identified and destroyed.

3.4 Withdrawing Authorization

You may withdraw any sensitive information authorization at any time under Me > Settings > Privacy Management. We immediately stop the corresponding collection. Basic learning functions such as question practice and mock exams remain unaffected.

4. Your Personal Information Rights

Under the Personal Information Protection Law of the People's Republic of China, you have the following rights:

4.1 Right to Be Informed

You may consult this Policy at any time to learn the types and scope of personal information we collect.

4.2 Access, Copies, and Exports

You may request a personal data export under Me > Settings > Account and Privacy Management. We will send a copy to your registered email address within seven working days.

4.3 Correction and Completion

If your personal information is incorrect, contact customer support to request a correction or addition.

4.4 Deletion and Withdrawal of Consent

You may turn off individual permissions and personalized recommendations, withdraw authorization to collect sensitive information, and request deletion of the corresponding personal information.

4.5 Account Deletion

The product has a self-service account deletion option. All personal information and sensitive data will be cleared within 15 working days after deletion review is completed. Deleted data cannot be recovered.

4.6 Objections and Complaints

For questions or objections about personal information processing, email customer support at kefu@itheory.net. We will respond and address your request within 15 working days.

4.7 Restrictions on Profiling

You may ask us to stop creating personalized user profiles from browsing and behavioral records.

5. Purposes and Rules for Using Information

5.1 Purposes of Use

When providing products and services, we use information for identity verification, customer support, security, archiving, and backups to ensure safety and normal operation. For example, personalized recommendations require understanding how you access and use the app so we can respond to your needs, such as language settings, personalized assistance and instructions, and other responses to you and other users.

To improve existing products, services, and user experience, we may analyze browsing information and interests you select in account settings to display relevant service information or content you may be looking for in searches.

We may also obtain other information reasonably needed to provide and improve services, including information you give customer support, questionnaire responses, and information obtained during interactions with the app.

We may associate information collected from your different devices to provide consistent services across them, and combine information from different services to provide services, personalized content, and suggestions or design new products and services. For example, users may be invited to a User Experience Improvement Program. For participants, we compile function usage statistics as needed to improve quality and introduce useful innovations. You may turn off the relevant function in the product or service if you do not wish to participate.

We may use relevant information to provide more relevant advertising or promotions, or send marketing messages through the app, email, or other channels to offer or promote our or third parties' products and services. If you do not want these uses, you can ask us to stop through the relevant channels provided in the products or services.

Software authentication or software update management. In the following circumstances, laws and regulations permit collection and use of relevant information without your authorization:

1. Matters relating to national security or national defense.
2. Matters relating to public safety, public health, or significant public interests.
3. Criminal investigation, prosecution, trial, or enforcement of judgments.
4. Protecting the life, property, or other major lawful interests of the data subject or another person where obtaining consent is difficult.
5. Necessity for the secure and stable operation of the products or services, such as identifying and handling faults.
6. Necessity for lawful news reporting.
7. Necessity for statistical or academic research conducted by academic institutions in the public interest, provided that personal information in published research or descriptive results is de-identified.
8. Other circumstances prescribed by laws and regulations.

Other purposes you consent to. Subject to applicable laws, we may use information collected through one product or service in another, in aggregated or personalized form, to improve your experience and our services or for other purposes you agree to. For example, information collected in one service may be used in another to offer specific content or relevant, nongeneral information. Where an option is provided, you may authorize information supplied and stored in one service to be used in other services.

5.2 Rules for Using Personal Information

We use collected information in accordance with this Policy to implement product or service functions. We technically de-identify personal information after collection so that the resulting information cannot identify individuals. You understand and agree that we may use such de-identified information and analyze and commercially use the user database without disclosing your personal information.

Unless you delete information or refuse collection through system settings, your authorization for us to use personal information provided while using the products or services continues for the duration of that use. On account deletion, we stop using and delete your personal information. We compile usage statistics and may share them publicly or with third parties to illustrate overall trends. These statistics contain no information identifying you.

We compile product and service usage statistics and may share them with the public or third parties to show overall usage trends. These statistics do not contain information identifying you.

When displaying personal information, we protect it through masking methods such as content replacement and anonymization.

Before using your personal information for a purpose not stated in this Policy, or using information collected for one purpose for another, we request your prior consent through an actively selected checkbox.

6. Permissions for Additional Services

For additional services that personalize products and improve your experience, we request the following device permissions and obtain personal information only when you use the relevant function.

6.1 Camera

Camera access lets you scan QR codes, capture video or photos, log in, or capture and upload videos and images.

6.2 Photo Library and Storage

Photo library access lets you upload photos, images, videos, and locally cached audiovisual files to change your avatar, publish and share comments, or communicate problems to customer support.

6.3 Microphone

Microphone access enables Music Lab exam and practice functions. Even after permission is granted, the microphone stays off by default and captures audio only when you actively start the practice accompaniment function.

6.4 Notifications

If you use subscriptions, we may request notification permissions to send album updates and reminders. A pop-up asks whether you want to enable notifications.

6.5 Clipboard Access

The product temporarily reads clipboard content only when you actively tap Share or manually enter a redemption code. Temporary data is cleared after reading. We do not silently or automatically read the clipboard on a cold start or while suspended in the background.

6.6 Auto-Start and Linked Launch

Auto-start and linked app launch permissions are off by default. For push notifications, you must manually enable them in your phone's system settings. Without explicit consent, we do not request or activate wake-up permissions. To disable them, go to Settings > Apps > App Launch Management > Music Lab and turn off linked launch and auto-start. Opening a Music Lab content notification launches the relevant content only with your explicit consent. Without consent, no linked launch occurs. Opening a file downloaded within Music Lab launches an associated third-party app.

To receive broadcast push messages while closed or in the background, the app needs auto-start capability. System broadcasts may periodically wake the app through auto-start or linked launch as necessary to provide the functions and services.

When you open a Music Lab content notification, the app opens the relevant content after obtaining your explicit consent. No linked launch occurs without consent.

Opening a file downloaded within Music Lab launches an associated third-party app.

7. Third-Party SDK Privacy Disclosures

Restrictions on sharing sensitive information with third parties: we do not send facial data, identity documents, precise location, recordings, or other sensitive information to Alipay or WeChat SDKs. We transmit only the minimum ordinary device information necessary for payments and sharing. Confidentiality agreements require third parties to process data under the Personal Information Protection Law and GB/T 35273-2020, define permitted uses, and require destruction on expiry. When you use third-party services, we share relevant information after obtaining your consent or ensuring that the third party has obtained it, or in other circumstances permitted by law. The list below explains how third parties process personal information. We also strictly restrict their collection practices to protect your information.

To ensure WeChat's stable operation or enable relevant functions, we may integrate third-party software development kits (SDKs). These SDKs are listed below. Follow the links to see their data use and protection rules. SDK processing categories may change with version upgrades or policy adjustments; refer to each provider's published official explanation.

8. Sharing, Transfer, and Disclosure

8.1 Sharing

We do not share your personal information with any outside company, organization, or individual except in the following cases:

1. With your prior explicit consent or authorization.
2. Where required by applicable laws, regulations, legal procedures, or mandatory administrative or judicial requirements.
3. Where permitted by law and necessary to protect the interests, property, or safety of the app, its partners, you, other users, or the public from harm.
4. Where sharing is necessary to deliver core product or service functions or the services you request.
5. To handle a dispute or disagreement with another person at your request.
6. As provided in agreements signed with you, including electronic agreements and platform rules, or other legal documents.
7. For academic research.
8. For public interest purposes consistent with laws and regulations.

We may share personal information with our affiliates, but only where necessary and subject to this Policy. If an affiliate changes its processing purpose, it will seek your authorization and consent again.

Companies, organizations, and individuals receiving personal information must comply with confidentiality commitments and process it according to our instructions, this Policy, and relevant confidentiality and security measures.

We may exchange information with other companies and organizations to comply with law, enforce our terms and other agreements, or protect our, your, or other customers' rights, property, or safety, for example to prevent fraud and reduce credit risk. This does not include selling, renting, sharing, or otherwise disclosing personal information for profit in violation of this Policy.

8.2 Transfer

We do not transfer your personal information to any company, organization, or individual except in the following cases:

1. With your prior explicit consent or authorization.
2. Where required by applicable laws, regulations, legal procedures, or mandatory administrative or judicial requirements.
3. As provided in agreements signed with you, including electronic agreements and platform rules, or other legal documents.
4. In a merger, acquisition, asset transfer, or similar transaction involving personal information, the new holder must remain bound by this Policy. Otherwise, we require it to obtain your authorization and consent again.

8.3 Public Disclosure

We publicly disclose personal information only in the following circumstances and with safeguards meeting industry standards:

1. You consent to or authorize disclosure.
2. You use sharing functions.
3. Where laws, regulations, mandatory administrative enforcement, or judicial requirements require it, we may disclose the requested categories of information in the required manner. Subject to law, we require supporting legal documents and carefully review every request for a lawful basis. Disclosure is limited to data that law enforcement is legally entitled to obtain for a specific investigation.
4. In an emergency, to protect the lawful rights of you, the app, and other users, or public safety and interests.
5. As provided in the relevant user agreement or a similar agreement for our products or services.

9. Protecting Minors' Information

Under Appendix B of GB/T 35273, all personal information of children under 14 is highly sensitive personal information.

1. Before collecting any information about a child under 14, we must obtain the guardian's explicit written consent. Children must not independently submit sensitive information such as identity documents, facial data, phone numbers, recordings, or location.
2. Users aged 14–18 need their guardian's informed confirmation to use sensitive functions such as microphone access, precise location, and real-name verification.
3. Guardians may contact customer support at any time to access or delete all of a minor's sensitive personal information or delete the account. We encourage guardians to guide minors' use and read this Policy with them. Guardians bear primary responsibility for protecting minors' online privacy. We protect minors' information according to applicable national laws and regulations.

10. Limitations of Liability

We cannot disclaim legal liability for personal information breaches caused by our failure to implement security safeguards or process data in accordance with laws, regulations, and GB/T 35273. We are not responsible in the following circumstances:

1. A breach caused by your voluntarily disclosing your account password or sharing your sensitive personal information.
2. Force majeure, such as earthquakes or floods, where we have promptly taken reasonable remedial measures.
3. Risks arising from a third party's unauthorized collection after you navigate to an independent external website or platform, unrelated to this product. In addition, you bear responsibility for disclosure, loss, theft, or alteration of personal data caused by telling others your password, sharing your registered account, or otherwise failing to safeguard it.

11. Scope of This Policy

This Policy applies to all products and services of the app. Specific privacy terms for particular products or services will be detailed in their service agreements or separate privacy policies and form part of this Policy. If those specific terms conflict with this Policy, the specific terms apply.

This Policy applies only to information collected by this app. It does not apply to third-party products, services, or information practices, including information collected by third-party services or websites accessed through our products or services. We assume no responsibility for third parties' use of information you provide to them.

For questions about this Policy while using our products or services, contact us through the officially published feedback channels for the relevant product or service or by email.

12. Updates to This Policy

1. General wording revisions and improvements: we will send an update notice within the product.
2. Material changes, including changes to collection scope, sensitive information processing rules, or third-party sharing scope: a separate pop-up will display the changes, and you must actively agree again before continuing to use the product. If you disagree with the updated Policy, you may stop using the product.

13. Contact Us

If you have questions, comments, or suggestions, please contact us using the following details:

Email: kefu@itheory.net

Compliance references for this Policy: the Personal Information Protection Law of the People's Republic of China and the sensitive personal information list in Appendix B of GB/T 35273-2020, Information Security Technology — Personal Information Security Specification.