Privacy policy
Last updated: 7 October 2026
This policy explains what BandSix ("we") collects when you use bandsix.app, why, who else handles it, and how long we keep it. Questions or requests: support@bandsix.app.
In short
- We collect what we need to run the site: your email, your practice data, your recorded answers for scoring, and your purchases.
- Your recorded answers are processed to score them and are not kept beyond 30 days. Our server doesn't save them at all.
- We don't sell your data, and we don't use advertising or tracking cookies.
- You can export your data or delete your account at any time in Settings.
What we collect and why
Your email address. To create your account and email you sign-in links. We don't send marketing email.
A sign-in cookie. One cookie keeps you signed in for up to 90 days. Page scripts can't read it, and we store only a scrambled (hashed) copy, as we do for sign-in links. It is the only cookie BandSix sets.
Your practice data. Scripts, attempts, your practice schedule, notes and settings are saved in your browser. When you're signed in, a copy is synced to our server so your devices match. Attempts are saved as text: what you said, the time it took, your rating. Never audio.
Your recorded answers (audio). When an answer is scored, the recording goes to our server and on to Microsoft Azure's speech service:
- Azure returns what it heard and how clearly each word came across.
- Our server measures your pace and pauses.
- For interview answers, DeepSeek gets the question, the text of what you said and those measurements, never the audio. It writes the feedback.
- Our server keeps the recording in memory only while scoring, and never writes it to disk.
- We haven't turned on Azure's audio logging, so Azure doesn't keep the recording after it answers.
Recordings in your browser. For playback, your browser keeps the latest take of each practice line on your device. BandSix deletes takes older than 30 days when you open the app. Delete all recordings in Settings removes them at once. Takes never leave the device: they aren't uploaded, synced or included in backups.
Usage counts. For each day, we count how many AI-scored answers each account used and estimate their cost. We use this to apply the daily limits and to watch our costs.
Which link or site brought you. To learn where our learners come from, we record it as a short label, like "reddit", "search", "other-site" or "direct". We never keep the address of the page you came from, and no cookie or IP address is involved:
- Your browser keeps the label of your first visit. Once a day, it tells our server that label, which adds one to that day's count.
- When you create an account, the label is saved with it.
- After the free diagnostic, we ask once how you found BandSix. Answering is optional, and we keep the answer with your account.
Purchases. When you buy a pass, Creem tells us:
- the plan and when you bought it;
- Creem's order and customer numbers, and the amount paid;
- whether it was refunded.
We use these to give you access and to open your Creem receipts. We never see or store your card details.
Server logs. Our server keeps short technical logs, such as errors and refused requests, to keep the site running. It counts requests per IP address in memory to stop abuse.
Who processes your data
We use these companies to run BandSix. Each gets only what it needs for its job:
- Creem (merchant of record): sells the pass, takes the payment, handles tax and sends receipts. It sees your email, payment details and billing country. creem.io/privacy
- Microsoft Azure (Speech service, East Asia region, Hong Kong): turns your recorded answers into text and scores pronunciation. It also makes the sample voices; that needs none of your data.
- DeepSeek (AI model, servers in the People's Republic of China): writes the interview feedback and the coach's answers. It gets the text of your answer, the question and the scoring measurements. It never gets audio or your email.
- Resend: sends the sign-in emails, so it sees your email address and the email.
- Cloudflare: runs our domain name, and may carry traffic to the site, so it can see your IP address and the requests your browser makes.
- Vultr (server in Tokyo, Japan): hosts our server and its database: your account, synced practice data, usage counts and purchases.
- Google Fonts: the site's fonts load from Google's servers, so Google sees your IP address and browser details.
Some features you start yourself send data elsewhere:
- Translate missing cues sends the English line to the public MyMemory translation service.
- In the practice library, speech recognition uses your browser's own engine. In Chrome and Edge, that engine sends your voice to the browser maker.
Where your data goes
Our server is in Japan, and the services above are in other countries, including Hong Kong, the People's Republic of China (DeepSeek) and the United States. Using BandSix means your data is handled in these places, as this policy describes.
How long we keep it
- Recorded answers: never stored on our server. Takes in your browser are deleted after 30 days.
- Sign-in links: expire after 15 minutes. Sessions: 90 days, or until you sign out.
- Your account and synced practice data: until you delete your account.
- Purchases: kept for our accounting even after you delete your account, but no longer linked to your account. Creem keeps its own records as the seller.
- Usage counts: kept to track our costs. When you delete your account, they stop being linked to you.
- Where you came from: daily counts per label are kept, with nothing about who visited. The label saved with your account is deleted with it. Your answer to "How did you find BandSix?" stays in the counts but is no longer linked to you.
Your choices and rights
- See and export: Export backup in Settings downloads everything in your browser.
- Delete: Delete my account and data in Settings removes your account, its sessions, any open sign-in links and every synced record from our server, at once.
- Correct or ask: email support@bandsix.app. We answer within 30 days.
Depending on where you live, you may have more rights under laws such as the GDPR. These include the right to object, to restrict processing, and to complain to your data protection authority. Write to us and we'll help.
Children
BandSix is not meant for children under 13, and we don't knowingly collect their data.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell signed-in users on the site.
隐私政策
最后更新：2026年10月7日
本政策说明你使用 bandsix.app 时 BandSix（"我们"）收集哪些信息、为什么收集、还有谁会处理，以及保存多久。有问题或请求，请写信到 support@bandsix.app。
简要说明
- 我们只收集运行网站所需的信息：你的邮箱、练习数据、用于评分的录音，以及购买记录。
- 你的录音只用于评分，最多保留30天。 我们的服务器根本不保存录音。
- 我们不出售你的数据，也不使用广告或追踪类 Cookie。
- 你可以随时在"设置"中导出数据或删除账户。
我们收集什么、为什么
你的邮箱地址。 用来创建账户和发送登录链接。我们不发营销邮件。
一个登录 Cookie。 让你保持登录，最长90天。网页脚本无法读取它，我们只保存它的加密摘要（哈希），登录链接也一样。这是 BandSix 设置的唯一 Cookie。
你的练习数据。 脚本、练习记录、复习计划、笔记和设置都保存在你的浏览器里。登录后，会同步一份到我们的服务器，让你的各个设备保持一致。练习记录以文字形式保存：你说了什么、用了多久、你的自评。从不保存音频。
你的录音回答（音频）。 给回答评分时，录音会发送到我们的服务器，再转给微软 Azure 语音服务：
- Azure 返回识别出的文字，以及每个词的发音清晰度。
- 我们的服务器测量你的语速和停顿。
- 对于模拟访谈的回答，DeepSeek 会收到题目、你回答的文字和上述测量结果，从不收到音频。它负责写反馈。
- 我们的服务器只在评分期间把录音保存在内存中，从不写入磁盘。
- 我们没有开启 Azure 的音频日志功能，所以 Azure 返回结果后不会保留录音。
浏览器里的录音。 为了让你回放，浏览器会在你的设备上保留每句练习的最新一次录音。每次打开应用时，BandSix 会删除超过30天的录音。在"设置"中点击 Delete all recordings 可以立即全部删除。这些录音不会离开你的设备：不上传、不同步，也不包含在备份中。
使用次数。 我们按天统计每个账户使用了多少次 AI 评分，并估算其费用，用来执行每日上限和控制成本。
哪个链接或网站带你来的。 为了了解学习者从哪里来，我们会记下一个简短的标签，比如 "reddit"、"search"（搜索引擎）、"other-site"（其他网站）或 "direct"（直接访问）。我们从不保存你来源页面的网址，也不涉及任何 Cookie 或 IP 地址：
- 你的浏览器会保存第一次访问时的标签。它每天告诉我们的服务器一次这个标签，服务器给当天该标签的计数加一。
- 你创建账户时，这个标签会随账户一起保存。
- 完成免费诊断测试后，我们会问一次你是怎么知道 BandSix 的。回答是选填的，答案随你的账户保存。
购买记录。 你购买通行证时，Creem 会告诉我们：
- 方案和购买时间；
- Creem 的订单号、客户编号和付款金额；
- 是否已退款。
我们用这些信息为你开通权限，并为你打开 Creem 的收据页面。我们从不接触、也不保存你的银行卡信息。
服务器日志。 我们的服务器会保留简短的技术日志（例如错误和被拒绝的请求），以保持网站运行。为防止滥用，服务器会在内存中按 IP 地址统计请求次数。
谁会处理你的数据
我们使用以下公司来运行 BandSix。每家只获得完成其工作所需的信息：
- Creem（销售方，merchant of record）：出售通行证、收款、处理税务并发送收据。它会看到你的邮箱、付款信息和账单所在国家。creem.io/privacy
- 微软 Azure（语音服务，东亚区域，香港）：把你的录音转成文字并给发音评分。它也生成示范语音，这一项不需要你的任何数据。
- DeepSeek（AI 模型，服务器位于中华人民共和国）：撰写模拟访谈的反馈和教练的回答。它收到你回答的文字、题目和评分测量结果，从不收到音频或你的邮箱。
- Resend：发送登录邮件，所以会看到你的邮箱地址和邮件内容。
- Cloudflare：负责我们的域名，也可能传输访问网站的流量，所以能看到你的 IP 地址和浏览器发出的请求。
- Vultr（服务器位于日本东京）：托管我们的服务器和数据库，包括你的账户、同步的练习数据、使用次数和购买记录。
- Google Fonts：网站字体从 Google 的服务器加载，所以 Google 会看到你的 IP 地址和浏览器信息。
有些功能由你主动使用时，会把数据发到别处：
- Translate missing cues（翻译缺失提示）会把英文句子发送到公开的 MyMemory 翻译服务。
- 在练习库中，语音识别使用浏览器自带的引擎。在 Chrome 和 Edge 中，这个引擎会把你的声音发送给浏览器厂商。
你的数据去向
我们的服务器在日本，上述服务位于其他国家和地区，包括香港、中华人民共和国（DeepSeek）和美国。使用 BandSix，即表示你的数据会按本政策的说明在这些地方处理。
保存多久
- 录音回答： 我们的服务器从不保存。浏览器中的录音30天后删除。
- 登录链接： 15分钟后失效。登录状态： 90天，或直到你退出登录。
- 你的账户和同步的练习数据： 保存到你删除账户为止。
- 购买记录： 即使你删除账户，也会为记账保留，但不再与你的账户关联。Creem 作为销售方会保留自己的记录。
- 使用次数： 保留用于核算成本。删除账户后，不再与你关联。
- 你从哪里来： 只保留每个标签每天的计数，不含任何访问者信息。随账户保存的标签会随账户一起删除。你对"你是怎么知道 BandSix 的？"的回答会留在统计中，但不再与你关联。
你的选择和权利
- 查看和导出： 在"设置"中点击 Export backup，下载浏览器里的全部数据。
- 删除： 在"设置"中点击 Delete my account and data，会立即从我们的服务器删除你的账户、登录状态、未使用的登录链接和所有同步记录。
- 更正或咨询： 写信到 support@bandsix.app。我们会在30天内回复。
根据你所在地的法律（例如 GDPR），你可能还享有其他权利，包括反对处理、限制处理，以及向当地数据保护机构投诉。写信给我们，我们会协助你。
儿童
BandSix 不面向13岁以下的儿童，我们也不会有意收集他们的数据。
变更
如果我们修改本政策，会更新顶部的日期。如有重大变更，我们会在网站上通知已登录的用户。