Kai Muay Privacy Policy

Effective October 28, 2026. Published at kaimuay.app and linked from Google Play. Written to be true today: if the app ever starts syncing or sending more than this page says, this page changes before the code does.

The short version

Kai Muay has no account and no advertising; its only server is Your Plan’s intermediary, which does not store what the app sends it (see below). The only thing the app sends on its own is anonymous usage statistics to TelemetryDeck: which parts of the app are used and where people stop, never your recordings, your results or who you are. One exception, only in the development version: the AI assistant of Your Plan can send your training profile (including anything you write under “Anything we should know?”), what you write when you ask for or change a plan (“Today I want…”) and a summary of your training to an AI service (see below); it does not exist in the version published on Google Play. Turn them off in Settings › Anonymous usage statistics (see below). The Google Play billing library the app uses to sell the Path may also send technical diagnostics to Google, under Google’s privacy policy. The videos of each level after the Base arrive the way app updates do: Google Play downloads them to your phone the first time you need them. Beyond that, two more things can leave your phone, and both depend on you: what you export by hand to an app of your choice, and — if you have Android Backup turned on — your settings, your progress, your session summaries and, in the development version only, your profile for Your Plan and what you write in “Today I want…”, which the system stores in your Google account, encrypted with your phone’s screen lock. The sensor recordings never go to any server. If you buy the whole Path, the purchase is made by Google Play, not by the app: the app never sees your card or your account.

What the app stores, and where

In the version on Google Play, the recordings and the summaries of each session live in the app’s private storage on your device, in the folder Android/data/app.kaimuay/files/ (on Android 10 and earlier, other apps with the storage permission can read that folder; from Android 11 on, only Kai Muay can); your settings, your progress, your profile and what you write in “Today I want…” stay in the app’s own preferences:

• Sensor recordings (sessions/raw_*.csv.gz): accelerometer and gyroscope while the phone is mounted on the bag or lying on the floor, used to count and measure strikes and jumps. They are large files (10–15 MB per class) and expire on their own: by default the last ten are kept (change it in Settings › Keep recordings).
• A summary of each session (resumenes/meta_*.json): strikes, jumps, peaks, pace, which class it was and its grade. This is what History, Statistics and Progress show, and it stays. About 40 KB per class.
• Settings and progress: your stance, your Kru (Mali or Chai, if you chose one), which classes you have completed, your streak, whether the app has already asked for notification permission, and — for reminders — the time you usually train and when the app last reminded you, both calculated on your phone from your own sessions. And what you write yourself: your class settings (Your class: the warm-up and circuit lists, rounds and rests), the routines and combos you save with their names, and any exercise you add yourself, with the name and instructions you typed.
• Your Plan’s profile and what you write in “Today I want…” (development version only): the profile you fill in for Your Plan, including anything you write under “Anything we should know?” — which can hold health information — and the text you write or dictate when you ask for today’s session. The app keeps them in its own preferences, not in the folder above, and the text stays there so a regeneration does not lose it.
• Phone model and Android version, inside each summary, to know how many g your sensor can read. There are no device identifiers and no identifiers of you.
• For the usage statistics (see below): whether they are on, and a random number the app creates for this installation. It is kept out of Android Backup, so a restored backup does not link a new phone with this one.
• Whether the whole Path is open: if you bought it, the app keeps on your phone only that it is open, whether the subscription renews, and when it last checked with Google Play. It does not keep the purchase token, the price you paid or anything about your payment method.

The app on Google Play stores no personal data: no name, no email, no location, no contacts, no photos, no audio, and it does not use the camera or the microphone. The development version also offers the camera to analyze your technique. When you use it, the analysis runs on your phone and the app does not send what the camera sees, or the points it measures, to any server.

What the app does not do

• It sends nothing but the anonymous usage statistics described in the next section, and only while they are on (the one exception, in the development version only, is the request of Your Plan’s AI assistant, explained below). The Google Play billing library, which the app needs to sell the Path, may send technical diagnostics to Google, under Google’s privacy policy, and Kai Muay neither reads nor adds anything to them. Three other things travel, and the app does none of them: Android Backup, which the system does and which is explained below; the videos of each level, which Google Play downloads to your phone (see Videos); and, in the development version, the camera module, which Google Play downloads when you turn the camera on (see above).
• It has no account and no sign-in.
• It does not send crash reports, and the usage statistics say nothing about your training beyond what the next section lists. If your phone shares usage and diagnostics with Google, Google Play may collect crash reports of Kai Muay under Google’s policy; the app does not send them itself.
• It shows no advertising. It sells nothing about you to anyone, and it shares nothing for advertising; TelemetryDeck handles the usage statistics only on our behalf.

Anonymous usage statistics

To know which parts of Kai Muay help and where people get stuck (the welcome, the first class, the subscription screen), the app sends short signals to TelemetryDeck (TelemetryDeck GmbH, Germany), an analytics service built so that nobody can be identified. They are on unless you turn them off in Settings › Anonymous usage statistics. If you were already using Kai Muay before the update that brought them, they stay off until you turn them on.

• What a signal says: what happened, and a few closed details, always one of a short fixed list:

  • the app opened (whether the welcome had already been done, and whether reminders can reach you: on, turned off in the app, Android’s permission not asked yet, or blocked in Android because you denied the permission or silenced the app’s notifications);
  • how many distinct days you have opened the app (in total and in the last 30), how many sessions you have had, the date of the first installation, and how long your last session lasted and how long they last on average (in seconds; a session is each time you open the app after more than five minutes away from it);
  • the app put a notification on your phone, or you opened the app from one: a reminder (and which kind: your first class — and, when the app puts it, whether it is the first, second or third — your training day, an empty week, two days after, or a Sunday streak) or the one about what’s new;
  • you answered Android’s notification-permission question (whether you granted it, and where the app asked: the Home screen, Settings, or when starting to record a workout);
  • the first time the app opens after being installed, where the installation came from, in one word: an ad, the website, one of our links, Google Play itself, somewhere else, or unknown (never the full link, nor an ad’s click identifier);
  • once per installation, what the phone measures with: the accelerometer’s maximum (in g) and how many readings per second it can give, and the gyroscope’s maximum, if it has one;
  • you reached a step of the welcome (choosing your Kru, one of its other screens, or the stance), only the first time;
  • the welcome ended (your stance);
  • you chose a Kru (which one, Mali or Chai, and where: the welcome or Settings);
  • a workout started, ended or you left it halfway (the kind of workout and, for the ones on your own, which option: freestyle, jump rope or timer; the class; the part of it you were in, such as warm-up or bag; whether you did it whole; and how long it lasted, in ranges such as 15–30 minutes);
  • you reached a new part of a workout (which one, such as warm-up, shadow or bag, and its place in the workout);
  • a class ended (the class, such as «0·2»; whether you finished it or left it with LEAVE; whether you did it whole and passed it; whether strikes arrived: none, few, enough, no recording, no bag, or the recording was cut; whether the sensor’s maximum cut strikes short: none, one or several; how many called rounds you skipped; how many of the called strikes landed, in ranges such as 50–70 %, and which strike landed least, such as the cross, with its own range; and how long it lasted, in ranges);
  • a recording could not start (the kind of workout, the class, and why: no storage space, it did not start, or it started but did not record);
  • the videos of a level or of a Kru could not be downloaded (which ones, such as level 2 or Kru Chai’s Base; why: no connection, Google Play did not provide them, it failed or was cancelled; and Google Play’s error code);
  • the app could not move what you had saved to the new class numbers of the Base (once);
  • something failed while analyzing or saving a class at its end, right after saving a session (such as scheduling the reminder again), or while reading your saved timer presets or measurement settings (only which thing failed, never its content);
  • you opened the Path, Techniques, Progress or Settings (each once per session);
  • you used a setting (which one and, when it is a switch or a closed choice, its new value, such as reminders on or off, the stance, the Kru or the voice speed; never a measured number, and never the usage statistics switch itself);
  • you said, while setting up the phone for a class or already during a round, that you have no bag today (and which of the two it was);
  • you picked an option of “Today without a bag”;
  • the subscription screen was shown (where you opened it from, such as the Path, a class, Settings, and whether it came at the end of the Base);
  • a purchase started or ended (the plan, and whether it went through, was cancelled, is pending, failed, was already yours or never got an answer from Google Play; if it failed, the reason Google Play gives, such as “no connection” or “payment declined”; when it goes through, also the product, its price in your currency and roughly in US dollars, and whether it started a free trial).

  Every signal also carries the time it happened, the hour and day of the week on your phone, the app version and build number, the Android version, the phone’s brand and model, the app’s language and the phone’s region, what you said about your bag (hanging, standing, none, or not answered), your Kru (Mali or Chai) and whether you chose it or it is the default one, and a random session number, new each time you open the app after more than five minutes away from it.

• What it never says: your strikes, peaks, grades or recordings; anything you type; your name, email, account or location. No phone identifier (IMEI, advertising ID): only the random number the app creates, turned into a code (below).

• Who sent it: nobody you can be traced back to. Each installation gets a random number, which the app combines with a fixed value and turns into a one-way code (SHA-256) before sending. TelemetryDeck says it scrambles that code again on its servers and never stores IP addresses (its privacy FAQ, how it anonymizes). Clearing the app’s data or reinstalling it gives you a new number. That is what «anonymous» means here: the number that would turn the code back into your phone never leaves your phone, and neither we nor TelemetryDeck keep anything that links the two.

• Where, and for how long: on TelemetryDeck’s servers in the European Union (Amsterdam, Frankfurt and other sites in Germany, according to its FAQ). TelemetryDeck says it has no schedule for deleting the stored events: it expects to do it after seven to ten years, and does not guarantee it.

• When: each signal leaves when it happens. Without a connection it is lost: the app keeps nothing to send later.

Your Plan’s AI assistant (development version)

In the development version — the one installed to try things out, not the one on Google Play — the app can ask an AI assistant to write the training week of Your Plan. This happens when you open Your Plan and there is no week saved yet, or when you ask for or change a plan.

• What leaves your phone for that, in three parts:
  • the profile you fill in for Your Plan: your goal, the days and equipment, and anything you write yourself under “Anything we should know?”;
  • what you write when you ask for or change a plan (“Today I want…”, for example): it goes just as you wrote it, and it can hold health information;
  • a summary of your training: the classes you have already passed on the Path, what you did this week when the app generates or regenerates a session, the effort you marked on your last five sessions, the Path class that is due, the techniques you have measured with the camera, and your class settings, if you ever changed them.
• Where it goes: to kaimuay.app, a Worker we run on Cloudflare, Inc., which holds the provider key and forwards the request over HTTPS to OpenRouter, Inc., which processes it with models by Anthropic. The connection goes from your phone to Cloudflare, so it carries your IP address and technical data about the connection — the device and the system, for example — and Cloudflare handles them as our processor under its own policy (privacy policy, consulted October 28, 2026). The Worker does not store the request or the answer; it only records the status, the time and the tokens the provider charges for, without the text. OpenRouter handles the request on our behalf, and its connection carries the Worker’s IP, not yours.
• What they keep, and whether they train with it (consulted October 27, 2026): OpenRouter says it does not use requests or answers to train models, and that it keeps them for as long as reasonably necessary for its business, regulatory and legal obligations; it publishes no fixed number of days for text (its privacy policy, updated August 31, 2026). It also says each model provider has its own practices and that retention varies; here the provider is Anthropic, which by default does not train on inputs or outputs from its API and deletes them within 30 days of receiving or generating them, except in the cases its policy lists, such as an agreement to keep them longer, its usage policy (up to two years) or the law (training, August 18, 2026; retention, July 1, 2026). OpenRouter routes the request under its own agreements with model providers, so the 30 days are Anthropic’s default, not a promise about this particular request; this covers everything listed above, including any health information you wrote.
• What does not leave: anything that identifies anyone in the request itself. The app has no account and asks for no name or email, so the request carries none of it — unless you write it in yourself (see above). The answer comes back to your phone and is saved there; neither the Worker nor Kai Muay stores the request or the answer. Cloudflare may keep technical connection logs, such as the IP address and the date, under its policy; OpenRouter and Anthropic keep the request and the answer for the time described above. If the app cannot use an answer, it sends it back with the reason, at most twice, so the assistant can correct it. (The answer can also land in the phone’s system log, which only adb or a rooted phone can read — no other app can.)
• This does not apply to the version on Google Play: there, the assistant is switched off. If it ever ships in one, this section will be rewritten first and announced in an update before the feature is switched on.

Permissions it asks for, and why

Android Backup

If Android Backup is on in your phone (Settings › Google › Backup), the system — not the app — stores your apps’ data in your Google account and restores it when you get a new phone, reinstall the app or do a factory reset. From Kai Muay:

• It uploads: your settings (stance, Kru, voice, screen, reminders, how many recordings to keep, the rope sensitivity, the timer presets, which cards you have read and whether the usage statistics are on), your progress along the Path, the summary of each session, with any name you gave it, and what you write yourself: your class settings (Your class: the warm-up and circuit lists, rounds and rests), the routines and combos you save with their names, and any exercise you add yourself, with the name and instructions you typed. In the development version, it also uploads the profile of Your Plan, with anything you wrote under “Anything we should know?”, and what you wrote in “Today I want…”, both of which can hold health information. This is what makes your history, your statistics and your progress come back whole on the new phone.
• It does not upload: the sensor recordings. They are large, they expire on their own, and the app never reads them again once the summary is written. It also leaves out what belongs to this phone and not to you: whether you were already asked for notification permission, so that the new phone asks again.
• Only with a screen lock: the app asks Android to make the backup only if it can be encrypted with your phone’s lock (PIN, pattern or password). Without a lock, there is no cloud backup. Google encrypts the backup in transit and, on top of that, with that lock.
• When moving to a new phone by cable or Wi-Fi, which Android offers when you set one up, the recordings go too (on Android 12 or later; before that, the same as to the cloud): that path never touches a server.
• The backup is yours, in your Google account, and Google’s privacy policy covers it. Kai Muay never sees or touches it. Turn it off in Settings › Google › Backup and delete it from your Google account dashboard. Uninstalling the app does not delete the backup already in your account.

Export and delete

• Export: in Settings › Export the last session, or when a class ends, you can share the recording with an app of your choice (email, Drive, anything). From then on, that copy belongs to you and to that app; Kai Muay does not see it.
• Delete: Settings › Keep recordings removes the raw files you no longer need; uninstalling the app deletes everything on the phone. Whatever remains in your Google account because of the backup is deleted from your account, not from the app.

Videos

The videos in the technique cards, the classes and the defenses are Kai Muay’s own animations, and they play inside the app. Some come inside the app; those of each level after the Base come in a package that Google Play downloads to your phone the first time you open one of its videos, as it does with app updates. The videos are made with two Krus, Mali and Chai, and you only get those of yours: Mali’s Base comes inside the app, and if you choose Chai, Google Play downloads his Base when you choose him and the rest as above; when you change Kru, the packages of the other one are removed once the new ones are on your phone. The download is done by Google Play, under Google’s privacy policy; Kai Muay only tells it which package it needs, and the videos then stay on your phone like the rest of the app.

With the app in Spanish, some technique cards also link to a video on YouTube or another platform. When you open one, you leave Kai Muay and enter that platform, with its own privacy policy. Kai Muay does not embed those videos: it only remembers, on your phone, that you opened the link, as part of what you have read on that card.

Purchases

The whole Path is sold through Google Play’s billing system: a yearly or monthly subscription, or a one-time purchase. Google Play takes the payment, keeps your payment method and your purchase history under Google’s privacy policy, and handles cancellations and refunds from your Google Play account. Kai Muay never sees your card, your name or your email; on each start it asks the Play Store app on your phone whether you own the Path, and keeps only the answer, on your phone. Nothing about the purchase is sent anywhere by the app, except what the usage statistics say about it, while they are on: that a purchase started or ended, for which plan, how it went and, when it goes through, its price (see above). Never the order or anything about you.

Rating the app

After a class you pass, the app may open Google Play’s rating window, without leaving Kai Muay. If you rate the app or write a review, Google Play receives and publishes it under Google’s privacy policy; Kai Muay never sees what you write, or even whether you rated it. The app keeps on your phone only the day it last asked, so as not to ask again for thirty days.

Children

Kai Muay is not directed to children under 13, and it asks nobody, of any age, for personal data: the usage statistics carry no name, no account and no device identifier.

Your rights, and what we keep if you write to us

Kai Muay keeps no data about you, so there is nothing to access, correct or delete on our side. The usage statistics cannot be tied to you, so we cannot find yours either; to stop them, turn them off in Settings. Otherwise, whatever the app stores is on your phone, under your control, and uninstalling removes it (the backup in your Google account, explained above, is yours to delete). If you write to hello@kaimuay.app, we keep your email address and the conversation for as long as it takes to help you and up to twelve months afterwards, for nothing else, and we never share it. If you buy the Path, Google Play holds the purchase under its own policy; we see an order number, the product and the country, never your name or your card.

If you are in the European Economic Area or the United Kingdom, you have the rights the GDPR gives you over that little we hold (access, rectification, erasure, restriction, portability, objection); write to the address above to exercise them, and you can complain to your data protection authority. Binary Vektor LLC is a US company and has not appointed a representative in the EU or in the United Kingdom under Article 27 of the GDPR and of the UK GDPR, because its processing of EU and UK residents’ data is occasional, small and low-risk (support email and Play’s order records only). The legal basis for that processing is our legitimate interest in answering you and, for purchases, the contract you make through Google Play. If that changes, this page changes.

This website

kaimuay.app is served by Cloudflare. It sets one cookie, lang, only if you pick a language with the switch: it remembers that choice for six months and identifies nobody. To know how many people visit and how they find it, each page you open sends one visit to TelemetryDeck, the same service the app uses for its statistics, through TelemetryDeck’s small script, which this site serves itself. The visit says the page’s address, the address you came from (if your browser shares it) and your browser’s language; from the connection, TelemetryDeck works out your country and the kind of browser, system and device. It sets no cookie and stores nothing on your device. To tell visits apart without knowing who you are, it scrambles your IP address together with your browser and a value that changes every day, and does not keep the IP address: the same visitor is recognized only on the same day (its guide for websites). If your browser blocks the script, the site works the same. There are no ads, no other analytics and no other third-party scripts or fonts on the site. If that ever changes, this section will say so, with a new date.

Changes

If the app ever starts doing something this page says it does not do (having its own account and syncing on its own, or sending more than the usage statistics described above, for example), it will ask you inside the app before doing it, and this page will change with a new date.

• October 28, 2026: the usage statistics also say how many distinct days you have opened the app, how many sessions you have had, the date of the first installation, and how long sessions last (the last one and on average). This is what makes retention measurable; nothing else changes.
• October 28, 2026: the Your Plan request no longer goes straight from the phone to OpenRouter: it passes through a Worker we run on Cloudflare, which holds the key and forwards it, and does not store the content. Cloudflare sees the IP address and technical data about the connection and handles them as our processor; its policy was consulted that day, with its link. OpenRouter and Anthropic still keep the request as described above.
• October 28, 2026: the AI section now says that the connection with OpenRouter carries your IP address and technical data about it — the device and the system, for example — and that OpenRouter collects them under its own policy, consulted that day with its version and link. Nothing the app sends changes; the page now says what already happened.
• October 27, 2026: the profile of Your Plan, with anything you write under “Anything we should know?”, and what you write in “Today I want…” are now named among what the app stores (development version) and among what Android Backup uploads; both can hold health information. Nothing about what the app sends changed.
• October 27, 2026: the AI section now says what OpenRouter and Anthropic keep of the request and for how long, and that OpenRouter does not train with it and Anthropic does not by default; both policies were consulted that day, with their versions and links. It also says that a rejected answer is sent back with the reason when the app asks again.
• October 27, 2026: the camera of the development version: the app published on Google Play does not use it; the development version offers it to analyze your technique, and the analysis runs on your phone without sending what the camera sees or the points it measures to any server. The permission table now lists it.
• October 27, 2026: the AI assistant of Your Plan (new section): in the development version, the app can ask an AI service to write the training week; what leaves your phone for that, and to whom, is explained there. The list of what leaves now includes the classes you have already passed on the Path. The version published on Google Play does not have the assistant, and what it sends does not change.
• October 20, 2026: when a class ends, the usage statistics also say whether you finished it or left it with LEAVE, how many called rounds you skipped, how many of the called strikes landed (in ranges) and which strike landed least.
• October 19, 2026: the videos come with two Krus, Mali and Chai, and you choose yours. The usage statistics also say which Kru you have and whether you chose it, and when you choose one; Kru Chai’s videos are downloaded by Google Play like those of each level. They also say whether, when the app opens, the reminders’ permission is not asked yet or denied; what you answered to Android’s notification-permission question, and where; which of the three first-class reminders was put; whether you said you have no bag already during a round; whether you picked today’s class as shadowboxing in “Today without a bag”; and what failed when saving a class or reading your presets or measurement settings.
• October 15, 2026: the usage statistics no longer say whether your install has the paywall, nor anything about the test on the bag or about having nothing to fasten the phone with; they say what you answered about your bag, when you say, while setting up the phone, that you have no bag, and if moving your saved classes to the Base’s new numbers failed; a purchase can also end without an answer from Google Play. The subscription screen no longer comes up at the end of the welcome.
• October 14, 2026: the usage statistics also say whether your install has the paywall, each new part of a workout you reach and, when a purchase fails, the reason Google Play gives; the subscription screen can come up at the end of the welcome, and the reminders include the one for your first class.
• October 13, 2026: the usage statistics also carry the hour and day of the week on your phone, where the installation came from (once, in one word), what the phone’s sensors can measure (once), whether the sensor cut strikes short in a class and, for a purchase that goes through, its price; which options “On your own” are used and how long workouts last (in ranges); which tabs and settings are used; the notifications the app puts on your phone; when a level’s videos cannot be downloaded; the install-referrer permission.
• October 12, 2026, website: kaimuay.app counts visits with TelemetryDeck (the “This website” section). Nothing about what the app sends changed.
• October 12, 2026: anonymous usage statistics with TelemetryDeck (new section), on for new installations and off for anyone who was already using the app; the internet permission is now used by the app itself.
• October 2, 2026: what you write yourself — your class settings, the routines and combos you save and the exercises you add — is now named among what the app stores and what Android Backup uploads. Nothing about what the app sends changed.
• September 29, 2026: the “Rating the app” section: the app may open Google Play’s rating window after a class you pass. Nothing about what the app sends changed.
• September 28, 2026: the Videos section (the app’s own videos, and the level packages that Google Play downloads), the network-state permission, which the app now uses itself, and the data-sync permission that the video-delivery library brings along. The policy is also published in Portuguese and French. Nothing about what the app sends changed.
• September 23, 2026: the internet and network-state permissions that the Google Play billing library brings along, the wake-lock permission, crash reports that Google Play may collect, the storage folder on Android 10 and earlier, and the section on your rights. Nothing about what the app itself does changed.
• September 21, 2026: purchases through Google Play’s billing system (the “Purchases” section and the billing permission). Nothing else changed.

Contact

Kai Muay is made by Binary Vektor LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Questions about this policy: hello@kaimuay.app.

This policy is also available in Spanish; if the two ever differ, the English version governs.