Privacy Policy

Last updated: 8 August 2026

Kru AI is operated by Na Xu, trading as Relda Meta, a sole trader based in New Zealand. This policy explains what the service collects, who else processes it, and what you can do about it. It is written to comply with the New Zealand Privacy Act 2020.

Contact for any privacy question, request or complaint: listmyjob.co.nz@gmail.com.

1. What we collect

Account information

• Your email address, and a one-way hash of your password — never the password itself.
• Your name, if you provide one, and your Google account’s basic profile if you sign in with Google.

Training profile

• Experience level, stance, goals, how much you can train, and available equipment.
• Injuries and physical limitations you choose to tell us about. This is health information, and section 4 is entirely about how it is treated. It is optional, it is used to keep your training plan safe, and it is sent to the AI provider that generates your plans and coaching replies.

Video you upload

• The video file itself, stored in object storage.
• A processed version of it, and a small number of still frames sampled from it.
• Pose data — numeric coordinates describing where your joints are in each sampled frame. These coordinates are computed inside the processing job, used to decide how well the camera saw you, and then discarded when the job ends. We do not store them, and they are never sent to an AI provider. Section 3 says exactly what is.

What you generate by using the service

• Technique analyses, training plans, Academy progress and assessments.
• Your messages to the coach chat, and its replies.
• Counts of how much you have used each feature, for quotas and fair use.
• Your IP address, held briefly and only to rate-limit sign-in and sign-up attempts against abuse.

Payment information

If you subscribe, your card details are collected and held by Stripe, not by us. We never see or store a card number. We keep only your subscription status, plan and renewal date, plus Stripe’s identifiers for your customer and subscription records.

2. What we never collect

• We do not use advertising cookies, tracking pixels, or any analytics script that runs in your browser. There is no third-party JavaScript on any page of this site.
• We do not sell personal information, and we do not share it for advertising.
• The only cookie we set is the one that keeps you signed in.

Product measurement

We do measure whether the product works — how many people sign up, build a training camp, try an analysis, reach the upgrade screen and subscribe. Six events, and that is the whole list. Because there is no browser script, we choose exactly what is sent rather than a third party reading the page for itself, and what is sent is:

• which of those six steps happened, and when;
• an account identifier — a random internal id, not your email or name, and meaningless to anyone without our database; and
• a small fixed label where it helps: which upgrade screen you saw, whether a subscription was monthly or annual, whether a trial applied.

No video, no still frames, no pose data, no injury or health information, no chat messages, no coaching feedback, and nothing you typed is ever sent to a measurement provider. If one is switched on, it is listed in section 5.

3. AI processing — what actually leaves our systems

This is the part most people want specifics on, so here they are. Your video file is never sent to an AI provider. It stays in our object storage. For a technique analysis, what the AI model receives is exactly three things:

• Up to six still frames sampled from the clip, as images.
• Summary statistics about the pose data — not the pose data itself. The model is told how many frames were sampled, in what percentage of them a body was detected, the average detection confidence, and the names of any joints the camera saw poorly. No joint coordinate is ever sent. The model cannot reconstruct your movement from what it receives; it reads the frames.
• Text — the training context you chose, the clip length, any notes you added, and, if the footage has more than one person in it, the description you gave of how to recognise yourself.

For training plans and coach chat, the model receives the text of your profile and your messages, which includes any injury notes you have written. No video, frames or pose data are involved in those.

The still frames can show you, your surroundings, and anyone else who happens to be in shot. Please read section 7 before uploading footage containing other people.

Which provider

Analyses, plans and chat replies are generated by Google using the Gemini API on a paidplan. Under Google’s paid terms, Google does not use your prompts or responses to improve its products, and logs them for up to 55 days solely to detect abuse of its service.

Google processes this outside New Zealand, and we cannot control in which country a given request is served.

If you connect your own OpenAI account, then every AI request of yours — analyses, plans and chat alike — goes to OpenAIinstead, under your own account and your own agreement with them, not ours. Nothing of yours goes to Google while that connection is in place. Google’s paid-tier protections described above are ours, not yours: what OpenAI does with your data is governed by whatever terms you hold with OpenAI, and you should read them. Disconnecting the account returns you to Google.

We may also use Anthropic as an alternative to Google; if that changes for your account, this page will be updated first.

4. Health and injury information

Injuries and physical limitations are health information. New Zealand’s Privacy Act treats it as sensitive, and if you are in the EU or the UK the GDPR treats it as a special category of personal data under Article 9, which may not be processed at all without a specific legal basis. So we are explicit about it:

• It is always optional. The injury field can be left empty, and every feature works without it. If you leave it empty, no health information about you is collected, stored or sent anywhere.
• Our legal basis is your explicit consent (Article 9(2)(a)). Typing an injury into that field, having read this, is that consent. You can withdraw it at any time by clearing the field in your profile — it is deleted from our database when you save.
• What we do with it. It is included in the prompt text sent to the AI provider named in section 3, so that a training plan does not prescribe something that would hurt you. That is its only purpose. It is never used for advertising, never sold, and never shared with anyone outside the providers listed in section 5.
• It is not a medical record and we are not clinicians. Kru AI does not diagnose, and the coach is instructed to refer anything that looks like a real injury to a professional rather than work around it.
• Withdrawal is not retroactive.Clearing the field stops future use immediately, but a plan already generated from it still exists until you delete that plan or your account, and text already sent to the AI provider is subject to that provider’s retention window (section 6).

Who at Kru AI can see it

Kru AI has an internal support view that shows an account’s profile — including the injury field — to an administrator, so that a support request can be answered. It is read-only, and every time it is opened, that access is recorded with who looked, whose account, and when. Today the only administrator is the operator named at the top of this policy.

5. Who else processes your information

We use the following providers to run the service. All of them process data outside New Zealand, mainly in the United States.

By using Kru AI you accept that your information is transferred to and processed in these countries, which may not provide the same legal protections as New Zealand.

6. How long we keep it

• Your account and its content are kept while your account exists. Delete your account and we delete your database records and your stored video files.
• If you deactivate rather than delete, your data is retained for a short grace period so the account can be restored, then permanently removed.
• Pose coordinates are never retained at all — they exist only for the minutes a processing job runs, and go with it.
• Data already sent to Google is logged by Google for up to 55 days, solely so it can detect abuse of its API. Deleting your Kru AI account does not shorten that window and we cannot recall it early. After it elapses, Google deletes it. This applies to everything in section 3 — including still frames of you and anyone else in your footage, and including injury notes.
• Limited records may be kept longer where the law requires it — for example, transaction records for tax purposes.

7. Video of other people

If you upload footage containing anyone else — a sparring partner, a training partner, a coach, or bystanders — you are responsible for having their permission before you upload it. Still frames from that footage are sent to an AI provider as described in section 3. Do not upload footage of people who have not agreed to it, and never upload footage of someone under 16.

8. Your rights

Under the Privacy Act 2020 you may:

• ask what personal information we hold about you and get a copy of it;
• ask us to correct anything that is wrong;
• delete your account and its data at any time from your profile settings; and
• complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner.

Email listmyjob.co.nz@gmail.com for any of these.

9. If you are in the EU or the UK

Kru AI is a New Zealand service and is not aimed at the EU or the UK, but if you use it from there the GDPR applies to us and you have rights the Privacy Act does not spell out. We honour them rather than argue about whether we have to.

• Why we are allowed to hold your data. For your account, profile, analyses, plans and payments: because we need it to provide the service you asked for (Article 6(1)(b), performance of a contract). For rate-limiting your IP address: our legitimate interest in not being attacked (Article 6(1)(f)). For injuries and health information: your explicit consent only (Article 9(2)(a)) — see section 4.
• Your rights. Access, correction, erasure, restriction, objection, and portability — a machine-readable copy of what you gave us. Email us and we will answer within one month.
• Automated decisions. Kru AI generates coaching feedback with a model, but nothing it produces has a legal or similarly significant effect on you — it is training advice. No automated decision determines your access to anything.
• Transfers out of the EEA and the UK. New Zealand holds a European Commission adequacy decision, so data reaching us is covered by that. Data reaching the providers in section 5 goes mainly to the United Statesand relies on those providers’ own transfer mechanisms — standard contractual clauses or the EU-US Data Privacy Framework. We do not have a Data Protection Officer; the operator named at the top of this policy is the controller and answers these requests personally.
• Complaints. You may complain to your national supervisory authority as well as to the New Zealand Privacy Commissioner.

10. Security

• All traffic is encrypted in transit.
• Passwords are stored only as a one-way hash.
• Any AI credential you connect is encrypted before it is stored.
• The application connects to the database with a restricted role that cannot alter its structure.

No system is perfectly secure. If we discover a privacy breach that is likely to cause you serious harm, we will notify you and the Privacy Commissioner as the Privacy Act requires.

11. Children

Kru AI is not for people under 16. We do not knowingly collect information from anyone younger. If you believe someone under 16 has an account, email us and we will delete it.

12. Changes

If this policy changes materially — particularly which providers receive your data — we will update this page and the date at the top, and tell existing users before the change takes effect.

See also our Terms of Service.