BANDSIM PRIVACY POLICY

Effective date: November 12, 2026

BandSim is a seated, hands-only WebXR band-management simulation for Meta Quest and web browsers. This Privacy Policy explains what information BandSim processes, how voice clips and microphone audio are handled, and how you can report content or delete your data.

1. No Personal Account Required

BandSim does not collect your real name, email address, Meta account identifier, phone number, or payment details. When you play, the app stores comfort settings, look preferences, band progress, and a pseudonymous guest token (bandsim.guest_token) in your browser's local storage on your device.

2. Microphone Audio & Voice Clips

BandSim uses your headset or browser microphone only when you actively trigger a voice feature:

• Spoken Band Names & Lyric Ideas (SAY IT voice clips): When you press SAY IT (to speak a band name or a lyric idea) and press DONE, a short mono audio clip (up to 10 seconds, 16 kHz WAV) is sent over HTTPS to the BandSim API (POST /lyrics/transcribe) and transcribed into text using Cloudflare Workers AI speech-to-text. The resulting text is screened for safety and returned to your session. Voice clips are processed transiently in memory and are immediately discarded after transcription — they are never saved to any database or storage bucket, never shared with other players, and never used to train AI models.
• Live Singing (RAW / POLISHED) & Hum-to-Riff: Pitch detection and vocal effects for live singing and humming a melody into the keyboard run locally on your device using Web Audio. Raw singing and humming audio is never uploaded to our servers.
• Optional Voice Commands: If you turn on voice commands in Comfort settings, browser speech recognition is used only while enabled to match short studio navigation commands.

3. XR Hand Tracking, Head Pose & Passthrough

• In-Session Interaction: WebXR hand joint positions and head pose are used on-device to render your studio hands, detect pokes and pinches, and calibrate desk height.
• Passthrough & Room Meshes: BandSim never accesses raw camera images and never uploads room meshes or physical environment data.
• Stage Performance Replay Streams: When you publish a record or record a guest take, a compact 30 Hz quantized stage-performance stream (avatar head/hand targets and instrument note events, up to 30 seconds) is uploaded with the song so the Ghost Bandmate and music-video stage can replay the performance.

4. Published Band & Record Content

When you create a band or release a record to the community crate, the following user-generated and AI-assisted data is stored in Cloudflare D1 and R2:

• Band name, selected genres, character customization profile (outfit, body/head/colourway choices), and generated band logo image.
• Song title, lyric lines, musical recipe (deck loops, BPM, melody notes), and generated audio track and sleeve artwork.
• Votes, jam lineage (parent/child record links), and content reports.

All typed or transcribed band names and lyrics pass through automated safety filters before generation or publication.

5. Service Providers

• Cloudflare (Workers, D1, R2, Workers AI): Hosts the application, database, media storage, speech-to-text transcription for SAY IT voice clips, text safety screening, lyric assistance, and FLUX.2 band logo generation.
• Mureka API: Generates full-band studio audio tracks and album sleeve artwork from your studio recipe and screened lyrics when you press Release.

6. In-App Content Reporting & Moderation

You can report any community record directly inside the headset from two places:

• Release Desk → CHARTS: Select a record, choose a reason (OFFENSIVE, SPAM, or OTHER), and press REPORT.
• Title / Palm Menu → HELP: Choose a reason and press REPORT RECORD.

Reporting a record immediately hides it from your crate on your device and submits a report to the BandSim API. Records that reach the community report threshold are automatically hidden from public charts and feeds.

7. Data Retention, Deletion & Contact

• Voice clips: Discarded immediately in memory upon transcription (0 seconds storage retention).
• Local device data: Clear your browser site data or local storage at any time to reset your guest token, settings, and local progress.
• Published records & privacy inquiries: To request deletion of a published guest record or ask a question about this policy, open an issue or contact the maintainers at github.com/FastCloud-Labs/BandSim.