Privacy Policy

Account information. When you sign in with Google, we receive and store your name and email address. We do not store your Google password, profile photo, or Google account ID.

Content you upload. Video clips, images, and voiceover audio recordings you upload for editing — up to 4 GB per file. This is footage of your own life, and may include your face, your voice, and the faces and voices of other people who appear in it.

Onboarding & persona information. Your answers to our onboarding questions — what you do for work, where you went to school, your social handles, where you're based, your hobbies, your travel history, and what you're passionate about — plus any free-text conversation with our onboarding interview and style chat. We use this to generate a written “creator persona” that guides your content plan.

Content plan & feedback data. The video ideas, shot lists, and voiceover scripts generated for you; any notes or events you add; and feedback you give on a rendered video (thumbs up/down, “more like this”, or a free-text note).

Derived data. Transcripts of your speech (produced by transcribing your uploaded audio), and, if you connect your TikTok, analysis of your posting patterns — see §6.

Third-party account tokens. If you connect TikTok, Instagram, or YouTube to publish or pull analytics, we store an encrypted access token for that connection, its granted scopes, and basic account metadata (e.g. platform username). Tokens are encrypted at rest and used only for the actions you authorize.

What we do not collect. We do not compute or store a biometric identifier such as a faceprint or voiceprint from your footage — our face-detection and background-segmentation features locate a face in a frame or separate a subject from the background for editing purposes only, and do not produce anything that could re-identify you across other footage. See §5 for what is nonetheless sent to third parties for processing.

• Directly from you — sign-in, the onboarding questionnaire and interview, file uploads, feedback you give on a video.
• Automatically — transcripts and analysis are generated by processing the content you upload.
• From TikTok — only if you give us your handle, we fetch your public profile and video metadata (§6). If you use official TikTok sign-in to publish, TikTok provides basic profile info under the scopes you approve at connection time.

We use the information above to:

• Generate your creator persona, content plan, shot lists, and voiceover scripts;
• Transcribe, analyze, and edit the footage you upload into finished videos;
• Match your content to music in our library and select on-screen text and pacing;
• Tune future plan items and hooks based on the feedback you give us (§1, feedback data);
• Publish content to platforms you've explicitly connected, at your direction;
• Operate, secure, and improve the Service, including preventing abuse; and
• Communicate with you about your account, e.g. a waitlist confirmation email.

We do not use your data for advertising, and we do not run behavioral analytics of any kind (§10).

If you are in the European Economic Area or United Kingdom, we process your data on these legal bases:

• Contract — processing your uploads, generating your plan, and rendering videos is necessary to provide the Service you asked for.
• Consent — connecting a TikTok/Instagram/YouTube account, and analyzing your public TikTok profile, are actions you take affirmatively and can withdraw at any time.
• Legitimate interests — securing the Service, preventing abuse, and maintaining the minimum operational logs needed to run it.

To provide the Service, we share data with the following processors. This list is published and we commit to keeping it current.

We do not use Sentry, Google Analytics, PostHog, or any similar error-tracking or analytics vendor — there is none integrated into the Service. A small, currently-disabled feature may in the future send a sample of system-level AI outputs (not directly tied to your identity) to Anthropic for internal quality review; we will update this table if and when that is turned on for any user.

If you give Kria your TikTok handle during onboarding, we fetch your public profile — follower count, and up to 30 recent videos' captions, hashtags, and engagement metrics (views, likes, comments, shares) — the same information anyone could see by visiting your profile. We use AI to analyze this into a summary of your posting style, which feeds into your persona, content plan, and generated video hooks.

This is separate from, and does not require, connecting your TikTok account via official sign-in (§5). We do not currently download or analyze the video files themselves from this public-profile flow. A related feature that would do so — downloading your TikTok videos for AI visual-style analysis — exists in our codebase but is switched off for all users as of this policy's effective date; if we turn it on, we will update this section and notify users first.

Kria's infrastructure and processors (Fly.io, Vercel, Google, OpenAI, Resend) are US-based. If you are located in the EEA, UK, or elsewhere outside the US, your data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or an equivalent legally recognized transfer mechanism with our processors.

We keep data for as long as needed to provide the Service, specifically:

• Account data (name, email) — for as long as your account is active, then deleted on request per §9.
• Uploaded footage and rendered videos — retained until you delete them or close your account. We do not currently auto-delete finished videos or the source footage behind them, because you may want to re-edit or re-download them later.
• Anonymous or session-only uploads (e.g. a not-yet-signed-in trial) — automatically deleted after 24 hours.
• Voiceover recordings and generated music renders — automatically deleted after 24 hours once incorporated into your final video.
• Speech transcripts — cached to avoid re-processing identical audio; we are moving this cache onto the same 24-hour retention window described above.
• Internal AI processing logs tied to a specific job — deleted after 30 days.

When you delete your account, we delete your account record and uploaded/rendered media from our active storage; residual copies in short-lived backups are purged on our normal backup rotation (no longer than 90 days).

Depending on where you live, you have the right to:

• Access a copy of the personal data we hold about you;
• Correct inaccurate data;
• Delete your account and associated data (“right to be forgotten”);
• Export your data in a portable format;
• Restrict or object to certain processing; and
• Withdraw consent for anything based on consent (e.g. TikTok analysis), at any time.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, request its deletion, correct it, and opt out of its “sale” or “sharing.” We do not sell or share your personal information, and we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email usekria@gmail.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

Kria uses only the cookies required to keep you signed in — session, CSRF-protection, and sign-in-flow cookies set by our authentication provider. We do not use analytics cookies, advertising cookies, or any third-party tracking pixels. Because we only use strictly necessary cookies, we do not display a cookie consent banner.

We run no analytics platform of any kind — no Google Analytics, no product analytics tool, no session-replay tool, and no advertising network. Your IP address is read transiently to rate-limit abuse on certain endpoints and is not stored in our database.

We use encryption in transit (HTTPS/TLS) across the Service, and encrypt sensitive credentials — such as connected third-party account tokens — at rest. Access to production data is restricted. No system is 100% secure, and we cannot guarantee absolute security of information transmitted to or from the Service.

Kria is intended for users 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact usekria@gmail.com and we will delete it.

Questions, requests, or concerns about this policy: Emir Erben, usekria@gmail.com, Istanbul, Turkey.

If you are in the EEA or UK and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority. This policy is governed by the laws of England and Wales, without prejudice to any mandatory data-protection rights available to you locally.

We may update this policy as the Service changes. For material changes — such as adding a new sub-processor, a new category of data, or a new use of your data — we will notify you by email or an in-app notice before the change takes effect, and update the “Effective” date above.