1. Who we are
PRUP TECHNOLOGIES S.A.C., a company incorporated in Peru with offices in Lima, is the data controller responsible for the personal data described here. You can reach us at any time at afernandez@prup.app.
2. What we collect and why
We collect only what the app needs to work. We do not sell your personal data, and we do not share it with advertising networks for advertising purposes.
| Category | What it includes | Why we collect it |
|---|---|---|
| Account data | Email address, display name, and the identifier from your sign-in method (Sign in with Apple or Google Sign-In). | To create and secure your account, authenticate you, and let you recover access. |
| Training data | Routines, exercises, sets, weights, reps, RPE, rest times, personal records, workout history, and timestamps. | To deliver the core function of the app: recording your training, showing your progress, and generating coaching suggestions. |
| Media you upload | Videos of personal-record attempts that you choose to submit, and thumbnails generated from them. | To display your personal records and to allow our team to verify a record before it appears in rankings. Uploading a video is always optional. |
| Free-text prompts | The text you type when asking the AI coach to build a routine. | To generate the routine you asked for. |
| Push notification data | Push notification token and an associated user identifier. | To send you training reminders and messages from your coach. You can turn notifications off at any time in iOS Settings. |
| Purchase data | Your subscription status and a pseudonymous subscriber identifier. | To unlock Prup Pro features for you. Payment is processed entirely by Apple — Prup never receives or stores your card or bank details. |
| Usage and diagnostic data | Screens viewed, in-app events (for example, starting a plan or completing a workout), app errors, and network failures, together with the device and app identifiers assigned by Google Analytics for Firebase. | To understand which features are used, to detect crashes and bugs, and to measure the performance of app install campaigns. |
We do not collect your precise location, your contacts, your photo library beyond the videos you deliberately submit, or data from Apple Health.
3. Legal basis for processing
- •Consent: Under Ley N.º 29733 we rely on your prior, free, express, and informed consent, which you give when you create an account and accept this Policy. Optional processing — uploading a personal-record video, or allowing push notifications — relies on the separate consent you give at that moment.
- •Performance of the service: Some processing is necessary to provide the service you asked for, such as storing your workout history or activating a subscription you purchased.
- •Withdrawal: You may withdraw your consent at any time by deleting your account or writing to us. Withdrawing consent does not affect processing carried out before the withdrawal.
4. How the AI coach uses your data
Prup's coaching features — routine generation, exercise prescription, and weekly summaries — are produced by an external AI provider, OpenAI, which processes the request on our behalf as a data processor.
- •What is sent: Aggregated training data only: exercise names, weights, reps, RPE values, weekly totals, your training preferences, and the free-text prompt you typed.
- •What is not sent: We do not send your name, email address, or account identifier to the AI provider. The training data sent is not used to identify you personally.
- •Training of AI models: We use the AI provider's business API. Your data is used to generate your response and is not used by the provider to train its models.
5. Who we share data with
We share personal data only with the service providers listed below, only for the purposes described, and only to the extent each one needs. Each acts as our processor under contract.
| Recipient | What it receives | Purpose |
|---|---|---|
| Supabase | Account data, training data, and uploaded videos. | Backend, database, file storage, and authentication. |
| OpenAI | Aggregated training data and your free-text prompts. No name, email, or account identifier. | Generating routines, exercise prescriptions, and weekly coaching summaries. |
| OneSignal | Push notification token and a user identifier. | Delivering push notifications. |
| Apple | Your Apple ID sign-in credential (via Sign in with Apple) and your purchase transactions. | Authentication and processing subscription payments. |
| Google (Firebase, Google Sign-In, Google Analytics for Firebase, App Check) | Google account credential when you sign in with Google; usage and diagnostic events; app and device identifiers. | Authentication, app infrastructure and abuse prevention, product analytics, and measuring app install campaigns. |
| RevenueCat | A pseudonymous app user identifier and your purchase status. | Managing and validating subscriptions. |
| Telegram | The personal-record video you submit, together with your username, the exercise, and the weight lifted. | Sending the record to a private internal channel so our team can manually approve or reject it before it is published in rankings. This happens only when you choose to upload a personal-record video. |
We may also disclose data where we are legally required to do so by a competent Peruvian authority, or to establish or defend a legal claim.
6. International transfers
Prup operates from Peru, but the providers listed above store and process data on servers located outside Peru, primarily in the United States and other countries. This means your personal data is subject to a cross-border transfer under Ley N.º 29733. By accepting this Policy you consent to that transfer. We only work with providers that commit contractually to appropriate security and confidentiality safeguards.
7. How long we keep your data
- •While your account is active: We keep your account data, training history, and uploaded media for as long as your account exists, because that history is the product.
- •After you delete your account: Your account and associated personal data are deleted from our production systems immediately. Encrypted backups may retain copies for up to 30 days, after which they are overwritten.
- •Records we must keep: Records of subscription transactions are retained for the period required by Peruvian tax and commercial law. These are held by Apple and RevenueCat and contain no payment card details.
- •Analytics: Usage and diagnostic events are retained by Google Analytics for Firebase for a maximum of 14 months.
8. Deleting your account
You can delete your Prup account and everything in it at any time. There are two ways:
- •In the app: Open Profile, scroll to the bottom, and tap Delete Account. You will be asked to confirm. The deletion is immediate and cannot be undone.
- •By email: Write to afernandez@prup.app from the email address on your account. We will complete the deletion within 10 business days and confirm when it is done.
Deleting your account removes your login credentials, profile, routines, workout history, personal records, and any videos you uploaded. Deleting your account does not cancel an active subscription: because Apple processes the payment, you must also cancel it in your Apple ID Account Settings to stop further renewals.
9. Your rights
Under Ley N.º 29733 you have the rights of access, rectification, cancellation (deletion), and objection over your personal data, as well as the right to receive a copy of it in a portable format.
- •Access: Ask us what personal data we hold about you and how it is being processed.
- •Rectification: Correct data that is inaccurate or incomplete. Most profile and training data can be edited directly in the app.
- •Deletion: Delete your account and data, as described in section 8.
- •Objection: Object to a specific processing activity, such as receiving push notifications.
- •Portability: Request an export of your training data in a machine-readable format.
To exercise any of these rights, write to afernandez@prup.app from the email address associated with your account. We will respond within the time limits set by Peruvian law. If you believe we have not handled your request properly, you may file a complaint with the Autoridad Nacional de Protección de Datos Personales of Peru.
10. Security
Data is transmitted over encrypted connections (HTTPS/TLS) and stored on encrypted infrastructure. Access to production data is restricted to authorized personnel. No system is perfectly secure, but if a breach affects your personal data we will notify you and the competent authority as required by law.
11. Children
Prup is not directed to children under 13, and we do not knowingly collect personal data from them. Under Peruvian law, processing the personal data of a minor under 14 requires the consent of a parent or legal guardian. If you are a parent or guardian and believe your child has created an account, write to afernandez@prup.app and we will delete it.
12. Changes to this Policy
We may update this Policy as the app changes. The effective date at the top of this page always reflects the current version. If a change materially affects how we handle your personal data, we will notify you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use Prup after a change means you accept the updated Policy.