Privacy Policy

1. Who we are

PRUP TECHNOLOGIES S.A.C., a company incorporated in Peru with offices in Lima, is the data controller responsible for the personal data described here. You can reach us at any time at afernandez@prup.app.

2. What we collect and why

We collect only what the app needs to work. We do not sell your personal data, and we do not share it with advertising networks for advertising purposes.

Messages with your coach. If you have a coach on Prup, the messages you exchange, the workouts you share and the videos and photos you upload to the chat are stored on our servers, encrypted in transit and at rest. Only you and that coach can see them. Deleting a message also deletes its video or photo. Messages are not end-to-end encrypted.

The PR feed, likes and sharing. Every approved personal-record video appears in the app's PR feed, which signed-in users can scroll, not only your best mark on the ranking board. With it they see your username, your profile photo, the gym of the submission, the weight, the exercise and the date. If you like a PR, signed-in users can see that you liked it, with your username, your profile photo and your current gym, even if you have never submitted a PR. If you share a PR, your phone's share sheet sends a text with the username, the weight and the exercise, plus a link to prup.app; it does not send the video. We record when you open the feed (not what you watch) to measure its use.

Comments, reports and blocks. If you comment on a PR, signed-in users can see your comment with your username and your profile photo. Before your first comment the app shows you the community rules: by tapping “I agree” you also accept the Terms of Service and this Policy, and we record that acceptance with its date and version. An automatic filter checks every comment before it is published: it rejects words from a list and links, and limits how many comments you can post in a short time; it is not used to profile you. Any user can report a comment or a PR, with a reason and an optional note. The person reported does not know who reported them; Prup does, in order to review the report. If several users report the same comment, it is hidden automatically until Prup reviews it. Prup reviews reports and may remove the content, hide or reject a PR, and limit or close the account of whoever breaks the rules. If you block someone, they are not told: from then on neither of you sees the other's PRs in the feed or their comments, and that person cannot like or comment on your PRs; Prup can see blocks when it reviews reports. If you delete a comment, it stops being shown at once. When someone likes your PR or, once we switch those notices on, comments on it, we may send you a push notification: we limit how many we send you per day, we do not send them between midnight and 7:00 (Lima time), and you can turn them off in your phone's settings. Section 8 explains how long we keep comments and reports.

The SBD belt draw. If you sign up for the draw at prup.app/sorteo-sbd, we process your username, your account email, the date of birth on your account, your PRs from the draw period, whether you declared you are a minor, and a hash of your IP address (never the address itself), and we email you through Resend. The draw is streamed on Instagram (Meta). By signing up you also allow us to share the PR videos you entered, credited to your username, on Prup's and the partner coach's Instagram accounts and on prup.app, and, if you win, to publish your name and photo; if you are 14 to 17, only with your parent's or guardian's written permission. Its rules (clauses 12 and 13) set out these uses, how long the data is kept and your rights.

We do not collect your precise location, your contacts, your photo library beyond the videos and photos you deliberately submit, or data from Apple Health.

3. The prup.app website

The website is separate from the app. You do not need an account to use it, and reading a page collects nothing about you on its own.

We use Google Analytics to understand which pages are useful, and only after you accept it. Until you do, no analytics cookie is written and no measurement is sent. Accepting stores two cookies (_ga, and _ga_ followed by our stream identifier) that give your browser a random identifier, and lets us see which pages were viewed, the country and approximate city derived from your IP address, your device and browser type, and the site or search that brought you here. Google does not log or store the IP address itself. None of it tells us your name or your email address.

• •No advertising: We run no ads and do no cross-site tracking. The advertising signals in Google's consent framework stay denied permanently, whatever you choose.
• •Separate from the routine generator: If you ask the website for a training routine, the email address you type is stored so we can send it to you and so the plan is waiting when you sign up. That is not analytics and does not depend on this choice.
• •Retention: Google Analytics keeps these usage events for a maximum of 14 months.

You can change your mind at any time. The Analytics link in the footer of any page reopens the choice, and declining or withdrawing deletes the analytics cookies from your browser immediately. If you decline, the website works exactly as it does otherwise.

4. Legal basis for processing

• •Consent: Under Ley N.º 29733 we rely on your prior, free, express, and informed consent, which you give when you create an account and accept this Policy. Optional processing — uploading a personal-record video, commenting on a PR (when you tap “I agree” on the community rules), or allowing push notifications — relies on the separate consent you give at that moment.
• •Performance of the service: Some processing is necessary to provide the service you asked for, such as storing your workout history or activating a subscription you purchased.
• •Withdrawal: You may withdraw your consent at any time by deleting your account or writing to us. Withdrawing consent does not affect processing carried out before the withdrawal.

5. How the AI coach uses your data

Prup's coaching features — routine generation, exercise prescription, and weekly summaries — are produced by an external AI provider, OpenAI, which processes the request on our behalf as a data processor.

• •What is sent: Aggregated training data only: exercise names, weights, reps, RPE values, weekly totals, your training preferences, and the free-text prompt you typed.
• •What is not sent: We do not send your name, email address, or account identifier to the AI provider. The training data sent is not used to identify you personally.
• •Training of AI models: We use the AI provider's business API. Your data is used to generate your response and is not used by the provider to train its models.

6. Who we share data with

We share personal data only with the service providers listed below, only for the purposes described, and only to the extent each one needs. Each acts as our processor under contract.

We may also disclose data where we are legally required to do so by a competent Peruvian authority, or to establish or defend a legal claim.

7. International transfers

Prup operates from Peru, but the providers listed above store and process data on servers located outside Peru, primarily in the United States and other countries. This means your personal data is subject to a cross-border transfer under Ley N.º 29733. By accepting this Policy you consent to that transfer. We only work with providers that commit contractually to appropriate security and confidentiality safeguards.

8. How long we keep your data

• •While your account is active: We keep your account data, training history, and uploaded media for as long as your account exists, because that history is the product.
• •After you delete your account: Your account and associated personal data are deleted from our production systems immediately, except as set out in the items below. Encrypted backups may retain copies for up to 30 days, after which they are overwritten.
• •Comments and reports: Your comments are kept while your account and the PR you commented on exist. If you delete a comment or Prup removes it, its text is kept for up to 90 days for safety reviews and then erased; only a record without the text remains (who wrote it, on which PR and when). A comment hidden by reports keeps its text until Prup decides on it. Reports and Prup's decisions are kept for safety. A report about a minor's safety stays open, and Prup reviews it, even if the person who wrote the comment deletes it; Prup may act on that account and, where the law requires it, inform the authorities. If you delete your account, your comments, your PRs and the reports about them are deleted with it; the reports you made and the record of Prup's decisions (what was done and when, without the text of the content) are kept without being linked to your account. Encrypted backups may keep this data for up to 30 more days.
• •Server logs: Technical records containing IP addresses and errors are kept for up to 90 days for security and abuse detection. They are not used to identify you and are not linked to your profile after you delete your account.
• •Records we must keep: Records of subscription transactions are retained for the period required by Peruvian tax and commercial law. These are held by Google Play, Apple, and RevenueCat and contain no payment card details.
• •Analytics: Usage and diagnostic events are retained by Google Analytics for Firebase for a maximum of 14 months.
• •Coach billing records: If you had a coach plan, your account email, your charges, your document (DNI, CE, passport or RUC), the name or business name on your receipts and, if you invoice with a RUC, your fiscal address, each charge authorization with the hashed IP address and browser recorded with it, and the device identifier generated by Culqi's antifraud script for payments you make yourself on prup.app (not automatic renewals), are kept for 24 months, even after you delete your account: to issue receipts and credit notes, and as proof of what you authorised. The document you used for a coach free trial is kept on its own for as long as we offer the trial, only to apply the one-trial-per-document rule.
• •Mensualidades: The records a coach keeps of their students' fees and payments are kept while the coach uses Mensualidades and 12 months after they turn it off, and at most 5 years after each due date. If the student deletes their account, the coach keeps them under a label with the student's first name and surname initial, no longer linked to the account. The other periods, including those of the captures and the WhatsApp data, are in section 13.

9. Deleting your account

You can delete your Prup account and everything in it at any time. There are two ways:

• •In the app: Go to Profile → Settings → Delete account. You will be asked to confirm. The deletion is immediate and cannot be undone.
• •By email: Write to afernandez@prup.app from the email address on your account. We will complete the deletion within 30 days and confirm when it is done.

Deleting your account removes your login credentials, profile, routines, workout history, personal records, and any videos you uploaded. Deleting your account does not cancel an active subscription: the store processes the payment, so you must also cancel it in Google Play or in your Apple ID Account Settings — whichever you subscribed through — to stop further renewals. A coach plan paid on prup.app is different: deleting your account cancels it and stops the charges, and the billing records described in section 8 are kept. Mensualidades records follow section 13: a coach's whole history is deleted, and a student's months stay with their coach under a label such as «Mateo P.», while the captures are deleted, and so is the WhatsApp number unless it is still linked to another student. The full list of what is erased and what is kept is on the account deletion page.

10. Your rights

Under Ley N.º 29733 you have the rights of access, rectification, cancellation (deletion), and objection over your personal data, as well as the right to receive a copy of it in a portable format.

• •Access: Ask us what personal data we hold about you and how it is being processed.
• •Rectification: Correct data that is inaccurate or incomplete. Most profile and training data can be edited directly in the app.
• •Deletion: Delete your account and data, as described in section 9.
• •Objection: Object to a specific processing activity, such as receiving push notifications.
• •Portability: Request an export of your training data in a machine-readable format.

To exercise any of these rights, write to afernandez@prup.app from the email address associated with your account. We will respond within the time limits set by Peruvian law. If you believe we have not handled your request properly, you may file a complaint with the Autoridad Nacional de Protección de Datos Personales of Peru.

11. Security

Data is transmitted over encrypted connections (HTTPS/TLS) and stored on encrypted infrastructure. Access to production data is restricted to authorized personnel. No system is perfectly secure, but if a breach affects your personal data we will notify you and the competent authority as required by law.

12. Children

Prup is not directed to children under 13, and we do not knowingly collect personal data from them. Under Peruvian law, processing the personal data of a minor under 14 requires the consent of a parent or legal guardian. If you are a parent or guardian and believe your child has created an account, write to afernandez@prup.app and we will delete it.

13. Mensualidades (payments to your coach)

Mensualidades is a tool on the Prup coach dashboard for keeping track of students' monthly fees. Prup never receives money: students pay their coach directly, by the means the coach indicates, and the coach records each payment. Prup does not check that a payment was made. A coach who accepts the conditions for it can also have Prup send payment reminders by WhatsApp, from Prup's own number, to whoever activates them, and receive the captures of the payments to show them to the coach.

If your coach uses Mensualidades. Your coach is the data controller of your payment records: your fee, your months, the payments and the captures you send. Prup processes them on your coach's behalf, as a data processor, only to provide Mensualidades. Prup is the controller of the WhatsApp data (your number, your consent and the message log) and of the check that the same image is not used twice.

• •What your coach records: Your monthly fee, your due dates and the payments you make: amount, date, method, operation number, and the app or bank you paid from. If someone else pays for you, your coach may add their name and phone number, to send them your link from the coach's own phone and to warn your coach if the WhatsApp reminders were activated from another number.
• •Your payment link: A private page on prup.app with your first name (or the name your coach chose for you), what you owe and when it is due, your coach's payment details and, if your coach offers them, how to activate the WhatsApp reminders. It does not show your phone number or other students, and Prup does not add your surname. Anyone who has the link can open it, so share it only with whoever pays. The page uses no analytics and is not indexed by search engines.
• •WhatsApp reminders: If you or whoever pays sends us the code from your link, Prup (PRUP TECHNOLOGIES S.A.C.) sends reminders from its own WhatsApp number: up to 3 days before each due date, on the day and, if it is still pending, 3 and 7 days later, plus at most one more a month that your coach asks for after the due date; and it tells you when your coach confirms a payment or not. Each reminder carries your coach's payment details. If the student is under 14, the link asks their mother, father or guardian to activate them. Answer BAJA to stop them at any time, and ALTA to have them again.
• •What we keep about your WhatsApp: Your WhatsApp number and the identifiers WhatsApp gives it; that you activated or left the reminders, and when; the delivery data of the messages Prup sends you, not their text (your coach sees whether they arrived, not whether you read them); and the short texts you send us, kept 7 days, only to understand commands such as BAJA or DATOS.
• •The captures you send: When you pay, you can send us the capture of the payment (an image or a PDF) or write «Pagué en efectivo». We keep the image, the message you write with it and when it arrived, and show them only to your coach, who reviews them and confirms the payment. We also keep a fingerprint of each file, to warn the coaches concerned when the same image arrives from another WhatsApp number. Answer BORRAR, within 24 hours and before your coach opens or decides on it, to delete the last image you sent.
• •What your coach sees: Whether the reminders are active and whether they arrived, the last 3 digits of the WhatsApp that activated them, whether you asked for help or left them, and the captures you send.
• •Who sees your payment status: Your coach, you through your link, and whoever activated the WhatsApp reminders. Your coach agrees to share it only with you or with whoever pays: never in groups, on notice boards or with other students.
• •Your rights: To access, correct or delete your payment records, ask your coach. If you write to us instead, we pass your request on to your coach. To delete your WhatsApp data (the number, its reminders and the captures not yet matched to a student), answer BORRAR MIS DATOS from that number; if you ask us by email, we ask you to send that message, so that no one else can erase your reminders.
• •How long: your payment records: While your coach uses Mensualidades. If your coach turns it off, 12 months more; if your coach deletes their account, they are deleted with it. If you delete your Prup account, your coach keeps the amounts and dates, no longer linked to your account, under a label such as «Mateo P.» (your first name and the initial of your surname); the name and number of whoever paid and the captures are deleted, and so is the WhatsApp number unless it is still linked to another student. In every case, each month is deleted at most 5 years after its due date.
• •How long: the captures: The image of each capture is kept 13 months from when it arrives; the message you write with it, up to 60 days after your coach decides on it; an image your coach marks as «No es un comprobante», 7 days; and a capture that is never matched to a student, 30 days.
• •How long: your WhatsApp: The log of the WhatsApp messages (when they arrived and whether they were delivered) is kept 90 days. The record of when you activated or left the reminders is kept 24 months, under a keyed hash (HMAC) of your number and its last 3 digits, to prove your consent. If a student no longer trains with the coach or is no longer charged, and for 90 days nothing is owed, waiting or happening, their WhatsApp is unlinked and the number of whoever pays is deleted. A WhatsApp number not linked to any student that does not write to us for 90 days is deleted. When the reminders end because your coach left Mensualidades, an account was deleted or the fee is no longer charged, we keep a keyed hash of the number for 90 days, only to tell you, if you write again, that your coach no longer receives captures through Prup and whether one was left unreviewed. A WhatsApp number that a coach or Prup blocked for abuse is kept, with nothing else, while the block lasts, so that it cannot activate the reminders again with a new code.

If you are a coach and use Mensualidades. You are the controller of the records you keep about your students, the captures they send you included, and Prup is your processor, under the conditions you accept when you turn it on and Article 10-A of the Terms of Service.

• •Your payment details: Your Yape and Plin numbers, your QR codes, your bank account and CCI, the holder names and your cash note are shown to each student who opens a payment link you shared, go in the message Prup prepares for you to send them yourself and, once you accept the WhatsApp conditions, reach whoever activated the reminders inside every WhatsApp reminder and the DATOS reply. Meta (WhatsApp) processes them to deliver those messages, and the image of your QR is uploaded to Meta to send it. A number or account you changed less than 24 hours ago does not go out by WhatsApp until those 24 hours pass.
• •Captures «Por confirmar»: The captures and the «Pagué en efectivo» messages your students or whoever pays for them send reach you under «Por confirmar», with only the last 3 digits of the WhatsApp they came from; images stay blurred until you tap them. You decide each one, and Prup can tell whoever paid whether you confirmed the payment.
• •Protecting the shared number: To protect Prup's number, we count each day the reminders sent on your behalf and the BAJAs, blocks and reports they receive, and keep those counts 13 months. Prup may pause or suspend your reminders if they generate complaints.
• •Changes to your details: Each time a number or account changes, we email you a «No fui yo» link in case it was not you. The history of your details (holder name and last 4 digits) is kept 13 months after each change, to check changes you did not make. If another Prup coach already entered the same number or account, we tell you it is shared, never who.
• •Operation numbers: The operation numbers of the payments you record are kept 25 months, even if the student deletes their account or you mark the payment as not received, so the same operation cannot be recorded twice. If you undo a payment, its number is released.
• •Review: We review the names and notes you enter, and whether the holder name matches your account's name, in a daily email to Prup, so that no one can pass as a bank, a wallet or Prup.
• •Your actions: We keep when you accepted the Mensualidades conditions, and the browser you used to accept them and to record each payment.
• •Weekly summary: If you turn on the weekly summary, every Monday Prup sends the list of your students who owe by email, only to you.
• •Captures waiting for you: When something new waits for you «Por confirmar», Prup emails you, only to you, a summary with your students' names. You can turn it off.
• •When you stop: After «Desactivar Mensualidades» your history is kept 12 months, so you can see and download it (we email you 30 days before deleting it). If you delete your account, your whole Mensualidades history is deleted with it, the captures still «Por confirmar» included, unreviewed, so download it and review them first.

Processors. Mensualidades runs on Meta (WhatsApp: the reminders, and the messages and captures exchanged with Prup's number; Meta keeps messages and media for its own period), Supabase (database and file storage), Vercel (the website and its servers) and Resend (the emails to coaches, which include students' names and amounts, and Prup's daily review email), in the United States (section 7).

14. Changes to this Policy

We may update this Policy as the app changes. The effective date at the top of this page always reflects the current version. If a change materially affects how we handle your personal data, we will notify you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use Prup after a change means you accept the updated Policy.