Updated: 2026-10-12 · 2026-10-12.1
iOS: scope and data processing
ios
This section applies to the iOS app. Sections labelled android describe Android and do not describe iOS features or permissions. The provider is Guohao Fang; support: support@baiboki.com; privacy: privacy@baiboki.com. No account, advertising, in-app purchases, subscriptions or third-party analytics SDK is required. Store availability is determined by the Apple listing.
Audio is read and copied into private app storage only after you select it in the system file picker. The app does not scan your music library or use the microphone. File titles, import details, locally estimated rhythm and energy, and playback settings remain on the device. Limits: 32 tracks, 320 MiB total, 80 MiB per file, 8 seconds to 10 minutes. Playback depends on device decoding support. Imported audio is excluded from system backup; backup of other local data depends on system settings.
Settings, achievements, scores, stage records and personal ghosts are stored locally. Compact replays contain compressed drawing commands and AAC audio. Local replays may include imported music; a separate public replay contains game audio and excludes the imported original track. Recent replays rotate with best records protected; replacement removes app-owned recordings, not original music or exported files. iOS exports compact replay files; MP4 export, avatar upload and downloading world-player ghosts are not provided.
Viewing boards or official world replays requests the website service. Scores are submitted only after you enter a public nickname, select results and press Upload. Replay upload is a separate action and sends drawing data, game audio, mode, course and related results, not imported original songs, source paths or your private music list. Published nicknames, results and replays can be viewed or saved by others. Each board publishes up to 30 results; public replays require server top-ten eligibility and size checks. Rejected or failed requests are not retried automatically. Server acceptance rules can change; verify success through the response and board.
Cloudflare processes scores and public replays. Requests contain necessary IP, time and client information; providers may process security and operational logs. The app does not store IP addresses in personal records. Public scores follow the top-30 rules; public replays are removed when they leave the top ten. For moderation and preventing resubmission of processed results, Cloudflare retains nickname/result hashes and moderation actions, times, boards, record identifiers, recorded names, scores and optional reasons on a long-term basis. Tencent Cloud retains server-accepted report records on a long-term basis. Provider backups follow their settings; copies downloaded by others cannot be recalled. For reporting, deletion or privacy requests, email support@baiboki.com or privacy@baiboki.com with the board and record identifier, without unrelated personal information.
Opening privacy or terms requests https://baiboki.com/legal/baibo-starlift.json without songs or private results. Valid updates are cached; bundled or cached documents remain available offline. Document updates do not consent to new purposes. You can decline audio import and uploads, remove app-owned music copies and disable sound or vibration. Uninstalling loses app-local data, not original audio selected through the system picker. Minors should use the app with guardian guidance. Do not place contact details, addresses or another person's private information in public names or replays.
Public features in iOS build 56 and later are for adults aged 18 or older. Birth date is checked on-device and never saved or sent; only the confirmed adult state and accepted terms version are retained. Before uploading, the app reads the current server terms version and requires your active agreement to the Terms and Privacy Notice. Updated terms are never accepted automatically. The first explicit upload generates a random publisher token stored in the app and sent with uploads; its digest links public publications and prevents impersonation, without advertising identifiers. World boards can report a record and its linked replay by sending the board and record IDs, without private music. Blocking by publisher ID or nickname and unblocking are local; the block list is not shared with an external browser. Build 55 lacks these new controls; update before using public uploads.
Provider and scope
android
BaiboStarLift is provided by Guohao Fang. Contact support@baiboki.com; privacy enquiries: privacy@baiboki.com. This notice covers the supplied Android app and official documents, not a promise of an available iOS download.
Local audio and analysis
android
Audio is read only after you select it through the system file picker. The app does not scan your entire library or record microphone audio. A private audio copy, source identifier, title, import time and locally estimated beats, band transients and energy are stored for playback and reactive visuals. They are not uploaded.
The library holds up to 32 songs and 320 MiB in total; each file must be at most 80 MiB and 8 seconds to 10 minutes long. MP3, AAC, FLAC and conventional WAV playback depends on the device decoder. Rhythm analysis is an estimate and cannot guarantee exact drum detection for every song. Selected playlist, order/shuffle and end-of-playlist preferences are saved only on this device and are not uploaded.
Settings and records
android
Local storage contains fastest successful times for 40 revisioned race courses (excluding pauses), 220 badge flags, language, audio, vibration, soft light, music selection, themes, one personal palette, scores and constellation badges. Touch, energy and power-ups are game state only. No account, ads, payments, advertising identifier or third-party analytics SDK is required.
Android stores up to 512 upload receipts locally: the associated result, public name, board and record/replay identifiers, submission time and retention result. They distinguish confirmed uploads, unconfirmed status and results not retained; the local receipt list is not uploaded. An upload marker does not guarantee continued ranking or replay retention. Upload forms check the website's small current-document-version response in the background. A matching validated offline document can be verified; otherwise the current canonical document is downloaded. Failed checks require your explicit retry. A notice beside Publish states that tapping it accepts the current Terms and Privacy Notice. There is no separate consent checkbox or confirmation dialog; the accepted version is saved only for a valid explicit upload action.
New runs use compact compressed drawing instructions with AAC audio, not permanently stored MP4. Playback redraws the game; MP4 is generated only on export. Legacy MP4 remains playable. Last-five and independently protected best-run retention is unchanged. Imported songs are retained only in the local replay, alongside a separate public game-audio track. Temporary decoded data is removed after saving. Format and size limits apply; fonts and renderers can differ between platforms. Pixel-identical output on every device and smaller size for every run are not guaranteed.
Play locally and export MP4 with audio through the system file picker. Check your sharing rights for imported music. Rolling retention only deletes app-owned videos not protected as best runs, never exports, original audio or historical scores. Storage shortage, encoder failure or recording/workspace bounds may prevent saving a replay without preventing score storage. Uninstalling or clearing app data removes local replays.
World boards accept explicit uploads of a public nickname, selected real results and optional avatar. Each board publishes its top 30. A top-10 result needs its matching replay within three days of first entering the top 10, otherwise it is hidden. Existing records start this period on migration; duplicate submissions do not reset it. Up to 30 hidden results are temporarily retained and may requalify with a valid replay. Selected images become metadata-free PNGs at most 128×128 pixels and 32 KiB; original photos are not uploaded. Numeric upload does not automatically send music or replay. Names are not authenticated identities.
Replay upload also submits and binds the same run's result, nickname and optional avatar. Only numeric top-10 results qualify, and races must be cleared successfully. Up to 10 replays per board are retained; leaving the top 10 removes the live replay. Rows show a play button only when a replay exists. Uploads are limited to 160 MiB. Score/distance boards are independent; partial failures are reported separately. Uploads contain compressed drawing instructions, game audio, game position/time samples, mode/course revision and results, but no imported song, song title, source path, touch log or private records. Original music stays local. Public replays/ghosts may be downloaded; third-party copies cannot be centrally deleted. No automatic upload or retry occurs. Legacy MP4 cannot be uploaded publicly; validation is not full anti-cheat certification. Segmented transfers temporarily retain file parts, checksums and random session identifiers for up to 24 hours. Interrupted uploads resume only when you tap Upload again.
Personal ghosts are stored locally: fastest successful clear per race course revision; otherwise farthest distance, breaking ties by shorter time. Each has at most 1024 game position/time samples. Blue personal and pink world ghosts are advisory only. Choose and download one world-top-10 ghost individually, delete it locally, and show at most one world player per run. Cache is limited to 10 per board. New recordings exclude all ghosts; old recordings cannot remove them retrospectively.
A record's nickname/avatar can be reported once. The report button disappears after acceptance and only one email attempt is made to support@baiboki.com. Report timestamp to the second (UTC+08:00), board category, record ID, nickname and result at report time are retained indefinitely in the isolated Tencent Cloud moderation service for handling and audit, without reporter identity. Existing authenticated administrators can edit public names/avatars and manually close alerts. Closing an alert or leaving a board does not delete report history. Uncertain mail delivery is marked for review and is never automatically resent.
The preceding30-entry archive and replay-based restoration apply only to automatic hiding for missing replays. Authenticated administrators may also hide, restore or permanently delete a result on one board. Manually hidden result metadata and its avatar remain until restoration or deletion; public replay and ghost files leave retention. Restoration requires a current top30 result and a new replay upload if top10. Administrator deletion removes that board’s public result, avatar and online replay, not copies already downloaded by others. Cloudflare permanently retains a nickname-and-value digest to reject the same moderated result submitted again; nicknames are not authenticated identities and this is not complete anti-cheat. Administrator actions, full UTC+08:00 timestamps, board, record ID, snapshot nickname/value and optional reason are permanently retained on Cloudflare and visible only to authenticated administrators; original avatar images are not copied into audit logs. Moderation does not automatically close report alerts or delete existing report history.
Permissions and network
android
Android declares vibration and internet permissions, not all-files, screen capture or microphone access. Local games work offline. Under-18, unknown-age and local-only users initiate no requests for boards, avatars, other players’ replays or world ghosts, and read offline legal copies. Adults who enable public features request the official service when viewing boards; opening legal documents can download an update or open the official page without songs or private records. Uploads always require an explicit action and are not retried automatically.
Cloudflare hosts results and compact replays. Tencent Cloud hosts moderation and reuses the official support mail service. Requests convey necessary IP/time information; providers may process security/operational logs, while app code does not persist IPs. The Tencent entry uses Nginx access logs rotated daily with up to 14 rotated files plus the current file, potentially containing IP, time, request path/status and client information, not upload bodies or original songs. Error logs may record operational failures. Cloudflare security logs and provider backups follow their service settings; no uniform retention period is promised. Avatars attach to results rather than separate accounts. Contact privacy@baiboki.com with board and record IDs for removal/privacy requests. Provider backups may remain for provider retention periods; immediate physical deletion is not promised.
Offline documents, retention and deletion
android
The app bundles an offline file generated from the official source and may cache validated updates. Failed requests, invalid documents or older versions leave a valid offline copy available. A document refresh does not consent to new data uses.
Android automatic cloud backup is disabled. Copies and records stay on the device; uninstalling or clearing app data removes them, not the original selected audio. An update does not deliberately clear existing data. Do not treat the app as your only backup.
Each song's delete cross in the music list removes its game copy; left checkboxes and select-all support bulk deletion. Original audio files and game records are not deleted. Deleting the current song switches accompaniment to the selected built-in style.
Choices, minors and changes
android
You may use built-in music without importing files, mute, disable vibration or use Soft Light. Minors may use local games, music, records and replays with guardian guidance, but not public-content features. Public boards, nickname/avatar uploads, other players’ replays and world ghosts require a local age check and age 18+. Birth dates are used only for an immediate age check and are neither stored nor sent; only adult/local-only status is stored, and explicit uploads include an adult-confirmation flag, not the date. Unknown age is local-only. Settings → Public features lets you return to local-only at any time.
An explicit upload sends a randomly generated publication token for this installation. The server stores only its digest with the associated public name, avatar, result and replay to maintain public identity and support blocking. No advertising ID, hardware ID or birth date is used. The original token stays locally and is not a verified account or anti-cheat proof. Its digest is retained with related records; uninstalling or clearing app data loses the local token. Do not publish real contact details, addresses or someone else’s photo.
Block lists stay in the current app or browser, are not uploaded and do not sync between them. Blocking hides matching public identities and nicknames’ records, avatars, replays and downloaded ghosts. Legacy records without publisher IDs match by nickname; identical names may belong to different people, and another identity may evade matching. Manage blocked users to unblock. Blocking does not delete server records. Reports and deletion/privacy requests may be sent to support@baiboki.com or privacy@baiboki.com. Changed documents receive a new version. The upload button's notice links the current Terms and Privacy Notice; tapping Publish accepts the displayed version and publishes your selected content. Viewing documents, checking versions or starting a game neither accepts documents nor submits anything. Documents remain accessible in Settings.