Home · Privacy Policy

Privacy Policy

Effective September 24, 2026

This English translation is provided for your convenience only. The legally binding document is the Russian version, which is governed by the laws of the Russian Federation. In case of any discrepancy, the Russian version prevails.

1. General provisions

This policy sets out how personal data is processed and protected in the Krokki service and is published pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter Law 152-FZ). Personal data operator: M. S. Birkin, self-employed individual (payer of the Russian professional income tax), Russian Taxpayer ID (INN) 481501685310; email info@krokki.com; contact address info@krokki.com (a postal address for written correspondence is provided on request).

2. Purposes, data and legal grounds

Purpose	Data	Legal ground	Retention
Registration, sign-in and account management	email, username, display name, phone if provided, password hash, account and device identifiers, IP address	performance of a contract (Clause 5, Part 1, Article 6 of Law 152-FZ), consent	until the account is deleted
Providing access to artificial intelligence models	text of requests and responses, files attached by the user, token counts	performance of a contract, consent to cross-border transfer	request content is not stored on the Operator's servers, except in technical logs for up to 30 days; token accounting until the account is deleted
Server-side speech transcription at the user's request	the audio track of the user's video or audio file (voice and what is said in the recording), transcript text, audio duration	performance of a contract (Clause 5, Part 1, Article 6 of Law 152-FZ)	audio and transcript are deleted right after the result is delivered, no later than 24 hours after upload; duration for billing until the account is deleted
Balance, payments and receipts	email, payment amounts and dates, order number	performance of a contract, tax laws	5 years
Support requests and problem reports	text of the request, contact details, device and app information, attached screenshots and logs	consent	up to 1 year after the request is closed
Security and abuse prevention	IP address, sign-in information	legitimate interest (Clause 7, Part 1, Article 6 of Law 152-FZ)	up to 6 months

Purpose

Data

Legal ground

Retention

Registration, sign-in and account management

email, username, display name, phone if provided, password hash, account and device identifiers, IP address

performance of a contract (Clause 5, Part 1, Article 6 of Law 152-FZ), consent

until the account is deleted

Providing access to artificial intelligence models

text of requests and responses, files attached by the user, token counts

performance of a contract, consent to cross-border transfer

request content is not stored on the Operator's servers, except in technical logs for up to 30 days; token accounting until the account is deleted

Server-side speech transcription at the user's request

the audio track of the user's video or audio file (voice and what is said in the recording), transcript text, audio duration

performance of a contract (Clause 5, Part 1, Article 6 of Law 152-FZ)

audio and transcript are deleted right after the result is delivered, no later than 24 hours after upload; duration for billing until the account is deleted

Balance, payments and receipts

email, payment amounts and dates, order number

performance of a contract, tax laws

5 years

Support requests and problem reports

text of the request, contact details, device and app information, attached screenshots and logs

consent

up to 1 year after the request is closed

Security and abuse prevention

IP address, sign-in information

legitimate interest (Clause 7, Part 1, Article 6 of Law 152-FZ)

up to 6 months

Data subjects: users of the service and people who contact us. The Operator does not process special categories of personal data or biometric data, and asks that you do not include such data, or the personal data of third parties, in requests to models or to support.

3. Storage and transfer

The databases used to record, systematize, accumulate, store, update and retrieve the personal data of citizens of the Russian Federation are located in the Russian Federation. Processing is entrusted, and data is transferred, to Timeweb.Cloud LLC (the Timeweb AI service), to relay requests to models, and to Robokassa LLC, to accept payments and issue receipts.

For server-side speech transcription, the app extracts only the audio track from the user's video and uploads it in chunks to the Operator's own servers with graphics accelerators in the Russian Federation; the audio is not transferred abroad or to third parties. The audio is processed solely to produce the transcript, is not used to train models, and is deleted right after the result is delivered, and in any case no later than 24 hours after upload. The transcript is returned to the project folder on the user's device and is not kept on the server beyond the same period. Instead of server-side transcription, the user may choose local transcription on their device, in which case no audio leaves the device.

When a user chooses models from foreign developers, the request text is transferred to the model developers in the United States of America (OpenAI, Anthropic, Google, xAI) and the People's Republic of China (Moonshot AI, Alibaba Cloud, Zhipu AI, DeepSeek). When the models included in the plan (Gemma 4 31B, GPT-OSS 120B, GPT-OSS 20B, Nemotron 3 Nano 30B, Nemotron 3 Super, Nemotron 3 Ultra) are used, the request text is transferred to the external provider of those models, Ollama (the Ollama Cloud service, ollama.com), in the United States of America. Such cross-border transfer is carried out on the basis of the user's consent and after notifying Roskomnadzor (the Russian data protection authority) in accordance with Article 12 of Law 152-FZ. Only the Muse Glimmer model runs on the Operator's servers in the Russian Federation, and it is not offered at the moment.

4. Cookies and similar technologies

The krokki.com website does not use analytics counters or advertising cookies. The sign-in and registration page auth.krokki.com uses technical cookies that are required for signing in. The website remembers in your browser storage that you have closed the cookie notice. Fonts and other website resources are loaded from the Operator's servers. You can disable cookies in your browser settings, but you will then be unable to sign in to your account.

5. Your rights

You have the right to obtain information about how your data is processed, to request that it be corrected, blocked or destroyed, to withdraw your consent, and to challenge the Operator's actions before Roskomnadzor or in court. Requests should be sent to info@krokki.com or to info@krokki.com (a postal address for written correspondence is provided on request). We respond within 10 business days of receiving a request; this period may be extended by no more than 5 business days, in which case we will let you know.

6. Security measures

The Operator applies legal, organizational and technical measures under Articles 18.1 and 19 of Law 152-FZ: appointing a person responsible for data processing, restricting access to data, encrypting connections (TLS), storing passwords only as hashes, backups, access logging and vulnerability management. The Operator notifies Roskomnadzor of personal data incidents within the time limits set by Part 3.1 of Article 21 of Law 152-FZ.

7. End of processing and destruction

Data is destroyed once the purposes of processing have been achieved, when retention periods expire, when consent is withdrawn, or at the data subject's request, within the time limits set by Article 21 of Law 152-FZ. Destruction is confirmed by a written record and an extract from the log.

8. Changes to this policy

This policy may change. A new version takes effect when it is published on this page. Related documents: Consent to Personal Data Processing, Public Offer.