369 Privacy Policy

1. Who is responsible

The controller of your data is:

• Legal name: MVAE PERU S.A.C.
• Tax ID (RUC): 20616227492
• Email for privacy matters: hola@369app.lat

In this policy, "369", "we" and "our" mean MVAE PERU S.A.C.

2. What data we process

2.1 Your account

• Your email and your password. The password is kept by Google Firebase Authentication and we cannot see it.
• Whether you verified your email.
• The date you created the account.

2.2 Your profile

• Your username (the @), the name you choose to show, your photo, your bio, your bib number and your main sport.
• Your city, if you choose one. You pick it from a list of Peruvian cities and we never infer it from your location. We also keep, without showing it to anyone, the centre point of that city. It is the centre of the city, not where you are.
• Whether your account is public or private.
• Your counters: followers, following and posts.
• A private history of your previous usernames, names and photos. It lets you see what you changed and helps us if you write to support. Nobody else sees it.

2.3 Data used to estimate calories

• Your weight and your birth year. Both are optional and private: they are not on your profile and nobody else sees them.
• If you connect Apple Health, your weight can come from there (see section 4).

2.4 Apple Health workouts

If you connect Apple Health, we bring in your workouts and show you your daily steps, without storing them. Details are in section 4.

2.5 Activities you record in 369

• The publishable trace of your route. It is a simplified version (up to 400 points), already trimmed by your privacy zone (see section 5).
• The metrics: sport, date and time, duration, moving time, distance, pace, elevation gain, splits, estimated calories and your time zone.
• The title you give it.

The full series of GPS points is kept only on your phone while you record, so you can recover a recording that was cut off. It is deleted from the phone once the activity is uploaded. That full series is not uploaded to our servers.

2.6 Posts

• The image of your post and its thumbnail. The photos you pick in the composer are merged into that image; the original photo is not uploaded.
• The video clip, if you add one, and the layer with the trace and the metrics on top of it.
• The metrics you choose to show and the template you used. The template is private.

2.7 What you do with other people

• Your comments, your reactions and the likes you give to comments.
• Views: we record which posts by other people you viewed, in order to count them. Only the author of the post can access that record.
• Your network: who you follow, who follows you, follow requests and the accounts you blocked.
• Suggestions of who to follow. We compute them every night from people in your city.
• The notices in your inbox, for example when someone comments on your post or starts following you.

2.8 Your phone

• An install identifier created by the app, the notification token (Firebase Cloud Messaging and Apple Push Notification service), the platform and the app version.
• The token is deleted when you turn notifications off or sign out.
• From version 1.0.11 of the app, Google Analytics also creates its own random install identifier (section 2.16).

2.9 Competitions

• The competitions you add to your profile from the 369 catalogue, the route and the time you declare.
• If a competition's organizer gives us their list of entrants, we do not keep your email. We keep an encrypted fingerprint of the email (an HMAC with a secret key), the route and the bib number. It is used to mark your entry as verified when you sign in with that email. If you don't have an account yet, the fingerprint is deleted 60 days after the competition ends.

2.10 Moderation

• The reports you make and the ones other people make about your content or your account.
• Moderation case files and your account status: warnings, limitations or suspensions.

2.11 Consents

• What you authorised, which version of the text you accepted and on what date. The date is set by our server.
• When you accepted the Terms of Use, which version, and your statement that you are 14 or older.

2.12 Technical logs

• Our server keeps a log of each operation, with your internal user identifier, the time and how long it took. It is used to find errors and for security.

2.13 Early access (on the website)

If you reserve an early access spot on 369app.lat, or join the launch list when no spots are left, we process:

• Your first name, your last name and your email.
• Your spot number (from 1 to 369), or that you are on the launch list, and the language of the page.
• That you ticked the form's box: the date and the version of this policy in force at the time. Our server sets the date.
• The status of the emails we send you: whether and when they went out.
• A fingerprint of your IP and another of your email (a hash, not the IP or the email in plain text), only to count attempts and stop abuse of the form. They last as long as the limit, one hour, and are then deleted automatically.

The email is used for three things only: confirming your spot, writing to you when we open early access and letting you know about the launch. We do not use it for anything else, we do not sell it and we do not give it to Apple or to anyone outside the providers in section 8. If you are on the launch list, we only write to you on launch day.

You can unsubscribe at any time with the “unsubscribe” link in any of those emails. When you unsubscribe we delete your data and your spot is freed: the number goes to the next person who signs up. It cannot be undone; if you want to come back, you can sign up again while there are spots left.

2.14 What we do not collect

• In the app we use no advertising or crash-reporting tools.
• From version 1.0.11, the app uses a single analytics tool, Google Analytics for Firebase, to know how it is used (section 2.16). We do not use it for advertising.
• The website uses a single analytics tool, Google Analytics, to measure its visits (section 2.15). We do not use it for advertising.
• We do not use Apple's advertising identifier (IDFA) and we do not track you across other apps or websites.
• We do not read your contacts.
• There are no in-app payments.

2.15 The website's analytics (Google Analytics)

369app.lat uses Google Analytics, a Google service, to know how many people visit the website and how many end up signing up for early access. What the app measures is set out in section 2.16. On the website, Google Analytics is not loaded on the pages you open from our emails to recover your password or to unsubscribe: those links carry a private code.

When you visit the website, Google Analytics collects:

• The 369app.lat pages you visit and where you came from, for example a search engine or a link on another network.
• Your device, your browser and its language.
• Your approximate location (country and city), which Google infers from your IP. Google Analytics does not store your IP.
• If you sign up for early access, that you signed up (the sign_up event), without your email, your name or your spot number.

To tell one visit from another, Google Analytics stores two 369app.lat cookies in your browser: _ga, which tells one visitor from another, and _ga_HL0RG0T22T, which keeps your session. Google sets them to last 2 years from your latest visit, but your browser may delete them sooner: Chrome after 400 days, and Safari after 7 days if you do not come back.

What for: to measure visits and how many end in an early access sign-up. We do not use it for advertising: we have Google signals and ads personalization turned off, so this data is not linked to your Google account and is not used to show you ads.

How long it is kept: the data of each visit, 2 months, Google Analytics' default retention; then it is deleted automatically. What remains are totals, such as how many visits there were and from which countries, with nothing that identifies you.

How to avoid it: block 369app.lat's cookies in your browser, or install Google's add-on to opt out of Google Analytics in desktop browsers (https://tools.google.com/dlpage/gaoptout). The website works the same, the early access form included.

2.16 The app's analytics (Google Analytics for Firebase)

From version 1.0.11, the app uses Google Analytics for Firebase, a Google service, to measure how it is used.

When you use the app, Google Analytics collects:

• A random install identifier, created by Google Analytics. It is not linked to your 369 account.
• Your sessions and the screens you open.
• Your approximate location (country and city), which Google infers from your masked IP. It does not use your iPhone's GPS or location permission for this.
• Your phone model, the iOS version, the app version and the phone's language.

The actions it measures, and no others:

• Creating your account, signing in, and finishing or skipping the welcome.
• How you answer when the app asks for permission to use Apple Health or to send you notifications, whether you connect Apple Health, and whether you give, decline or withdraw your health consent.
• Starting, finishing, saving or discarding a recording.
• Publishing: which template you use, whether it has a photo, a collage or a video, and who it is for ("anyone" or "my followers"). Also when you leave the editor without publishing and when you decide not to publish an activity or undo that.
• Sharing a post, yours or someone else's, or saving its image to Photos.
• Following and unfollowing someone, accepting or declining a request to follow you, blocking someone and reporting. From a report, only what you reported (an account, a post, an activity or a comment) and the reason you pick from the list, never what you write.
• Adding a competition from the catalogue to your profile.
• Searching for people: how many results came up, in ranges, never what you searched for.
• Reacting to a post and with which reaction, commenting or replying to a comment, and liking a comment.
• Opening a notice, from the notification or from your inbox, and what kind it is (for example, a comment or a follow request).
• Deleting your account.

Five facts about how you have the app set up, updated when they change:

• Whether your account is public or private.
• The main sport you chose in your profile.
• Whether you connected Apple Health: only yes or no.
• Whether you have notifications turned on.
• Whether you installed the app from the App Store or from TestFlight.

It never sends data about your workouts: not the sport, distance, duration, pace or route of any activity, whether you recorded it in 369 or it came from Apple Health. Nor does it send anything the app reads from Apple Health.

What for: to know how many people use the app and how they use it. We do not use it for advertising: it does not use Apple's advertising identifier (IDFA) or the identifier for vendors (IDFV), which is why the app does not ask your permission to track you; we have Google signals and ads personalization turned off, and it is not linked to Google Ads. So this data is not linked to your Google account and is not used to show you ads.

It does not know who you are: we do not give it your account, your email or your @, so what it measures is not linked to your 369 account. Nor do we give it what you write, such as your comments, what you search for or the details of a report, or your precise location.

How long it is kept: usage data, 2 months, the same as the website's; then it is deleted automatically. What remains are totals, such as how many people opened the app and from which countries, with nothing that identifies you.

The app has no setting to turn analytics off.

3. What we use your data for, and the legal basis

You can withdraw a consent at any time (section 11). Withdrawing it does not affect what was done before.

We do not use your data to make automated decisions that significantly affect you. Automatic hiding after reports (section 7) is provisional and is always reviewed by a person.

4. Apple Health

Connecting Apple Health is optional. The app works without Health.

What we read, with your permission:

• Workouts: sport, start and end date and time, duration, distance and active calories.
• The average and maximum heart rate of each workout. We do not keep the second-by-second heart-rate series.
• Your latest weight. It is used to estimate calories and replaces the one you typed only if it is newer.
• Your daily steps, to show them to you on Home. They are read on your phone each time you open the app and are not stored on our servers.
• The Health app that recorded each workout.
• When you connect, we bring in the last 30 days, so your profile does not start empty. From then on, new workouts.

What we do not read: Health routes. 369 neither requests nor queries them. That is why an activity that comes from Health has no map.

What we write to Health, with your permission: the workouts you record in 369, with the sport, duration, distance and calories. We do not write the route.

Who sees it:

• What comes from Health is visible only to you until you decide to post it.
• If you post it, whoever can see that post can also see the activity's metrics: distance, time, pace, calories and heart rate.
• Nobody else sees your weight or your birth year.
• Only you see your steps, on your phone. They are not posted and do not add to your totals.

What we never do with your Health data:

• We do not use it for advertising or marketing.
• We do not sell it.
• We do not use it for data mining or to build profiles of you.
• We do not store it in iCloud.
• We only share it with the processors that provide our infrastructure (section 8), under contract and to provide the service to you.

How to withdraw permission:

• In the app: Settings › health › Apple Health › disconnect. You can choose "disconnect and delete what was imported". This deletes from 369 the activities that came from Health and that you did not post. The ones you posted stay, with their comments. Nothing is deleted in Health.
• On the iPhone: Health › your profile › Apps › 369. There you choose what to share, or turn it all off.
• Weight and birth year are cleared in Settings › health › data for calories › clear this field.

5. Location

When we use it:

• While you record an activity, to draw your route and measure distance and pace.
• On the "record" screen, before you start, so the GPS signal is ready. Those points are not stored. When you leave the screen, the GPS turns off.
• To show you where you are on the map when you open it.

Why we ask for "always": so the recording keeps going if you lock the phone or open another app. It is only used while you record: when you finish the recording, the app stops following your location.

What we store:

• The full series of GPS points stays on your phone and is deleted once the activity is uploaded.
• Only the publishable trace is uploaded to our servers, already simplified and trimmed by your privacy zone.

The privacy zone:

• It trims the start and the end of the trace you publish, so it does not show where you start or finish, which is often your home.
• On new accounts it is off: the whole trace is published. Accounts created with an earlier version of the app (up to 1.0.8) keep their setting, which is 200 m unless you changed it.
• The trim is not an exact circle around your starting point. It has an offset unique to your account, which nobody else knows, so the gap does not give away where your door is.
• You can change the radius or turn it off in Settings › privacy › privacy zone. If you turn it off, the whole trace is published, from the exact point where you started.
• If the trim cannot be applied to a recording, the activity is published without a trace.

Your city is chosen by you. We never infer it from your location.

Maps are provided by Mapbox. When you view a map in the app, Mapbox may collect data under its own terms (see section 8).

6. What other people see

• Your profile card is always visible to anyone with a 369 account, even if your account is private. The card shows your username, your name, your photo, your bio, your bib number, your main sport, your city if you choose to show it, and your counters.
• Public account: anyone with an account can follow you and see your public posts. Those posts can also appear in "explore" for people who do not follow you.
• Private account: your posts are seen only by the followers you approve. A private account cannot post for "anyone". You change it in profile › edit profile › who sees your profile.
• Each activity has its own audience: "anyone" or "my followers". You set the starting audience in Settings › privacy › new activities, and it also applies to what comes from Health; you can change each one later in its detail. Nobody else sees an activity until you post it, and then it is seen by whoever can see its post.
• Your comments are seen by whoever can see the post you commented on, with your username, your name and your photo.
• Your reactions and views are seen only by the author of the post.
• Your competitions are shown with the same audience as your profile.
• Images and videos open from their link, without signing in. The app only gives the link to an image to people who can see the post. But if someone copies that link and shares it, anyone who has it can open the image, even if your account is private. The same goes for video clips, which play from their identifier. The link stops working when you delete the post.
• If you block someone, they cannot see your profile or open your posts, and you do not see theirs.
• What is shared outside 369 is out of our reach. If you save an image to your photo library or share it on another network, or if someone else does, we no longer control that copy.

7. Moderation

• When someone reports a post, a comment, an activity or a profile, the report reaches our team. The reported person does not know who reported them.
• If three different people report the same content, it is hidden automatically and provisionally until a person on our team reviews it. Hiding is not a sanction.
• Sanctions are always decided by a person, under the Community Guidelines.
• You can see your account status in Settings › account › account status.

8. Who we share your data with

We do not sell your data. We share it only with these providers, which process the data on our behalf and to provide the service to you:

Mapbox: the app uses Mapbox mapping services. Mapbox collects usage, diagnostic and location data under its terms, its data processing agreement and its privacy policy (https://www.mapbox.com/legal/privacy). You can turn off Mapbox telemetry from the ⓘ button on the map.

Apple Health is not one of our providers: Health data lives on your iPhone and we only read or write it with your permission.

We may also hand over data when a law or a competent authority requires it.

9. International transfers

Your data is stored and processed outside Peru:

• Brazil (São Paulo): the database, the early access list included, and the server functions (Google Cloud, region southamerica-east1).
• United States: images (Google Cloud Storage, us-east1), accounts, notifications and technical logs (Google), the website's and the app's analytics (Google Analytics), videos (Mux), maps (Mapbox), notification delivery (Apple) and sending your account and early access emails (Resend).

We make these transfers to provide the service to you, with providers that commit by contract to protect the data.

10. How long we keep your data

11. Your rights

You have the right to:

• Information: know what data of yours we process and why.
• Access: ask for a copy of your data.
• Rectification: correct inaccurate or incomplete data. You can correct almost all of it yourself in the app.
• Cancellation: ask us to delete your data. You can do it yourself by deleting the account (section 13).
• Objection: object to a specific processing.
• Portability: receive your data in a format another program can read (JSON).
• Withdraw any consent you gave us.

How to exercise them: write to hola@369app.lat from your account's email. Tell us which right you want to exercise and, if possible, your username. If you write from another email, we will ask you to prove the account is yours. It is free.

Early access: to withdraw your consent and delete your data, use the “unsubscribe” link in any of its emails; your spot is freed at that moment. You can also write to hola@369app.lat from the email you signed up with.

Website analytics: to stop Google Analytics from measuring your visits, do what section 2.15 explains.

App analytics: since what it measures is not linked to your account (section 2.16), we have no way to find it from your account to hand it over or delete it. It is deleted automatically after 2 months.

Response times:

• Information: 8 business days.
• Access and portability: 20 business days.
• Rectification, cancellation and objection: 10 business days.

If we need more time, we will tell you before the deadline and explain why.

If you are not satisfied with our answer, or we do not answer in time, you can file a complaint with the National Personal Data Protection Authority of Peru's Ministry of Justice and Human Rights (https://www.gob.pe/anpd).

12. Minors

To create a 369 account you must be 14 or older, and you state it when you sign up. We do not knowingly create accounts for people under 14. If we learn that an account belongs to someone under 14, we delete it. If you are a parent or guardian and believe your child under 14 has an account, write to hola@369app.lat.

13. Deleting your account

You can delete your account from the app: profile › settings (the gear) › account › delete my account.

• Deleted: your activities, your posts with their photos and traces, your followers and who you follow, your profile, your health data, your consents and your sign-in account. It cannot be undone and there is no copy.
• What stays:
  • Your comments on other people's posts, without your name or photo next to them.
  • Your name in notices other people already received.
  • Reports you made or that were made about what you posted.
  • A record of the deletion date, with your reason if you write one.
  • If you had deleted activities one by one before, the receipt for each: sport, date, duration and distance, without the trace or the photos.
  • Technical records that name you only by your internal identifier, without your name: for example, the views you gave or the fact that someone blocked you.
• Timing: deletion starts when you confirm and runs in stages. It finishes within a maximum of 30 calendar days from your confirmation. In practice it takes seconds.
• Your username is not freed: it is reserved for a year so nobody can pass as you.

If you cannot get into the app, write to hola@369app.lat. Details are on the "Delete your account" page.

14. Security and incidents

To protect your data:

• Everything travels encrypted between your phone and our servers, and is stored encrypted on Google's servers.
• Each piece of data has access rules: only you can read your weight, your birth year, your consents and your identity history.
• No app user can read reports or moderation case files.
• Very few people on our team can access the data, and only when needed.

No system is infallible. If a security incident affects your data, we will report it to the National Personal Data Protection Authority within the period set by law (48 hours). If the incident may significantly affect you, we will also tell you what happened and what you can do.

15. Changes to this policy

If we change this policy, we publish the new version with its number and date. If the change is significant, for example if it affects your health data or adds a provider, we will tell you in the app before it takes effect. If the change affects something you consented to, we will ask you to accept it again.

This policy is also published in Spanish. If the two versions differ, the Spanish version prevails.

Current version: 1.5, effective from 2 November 2026.

16. Contact

• Privacy, your data rights and support: hola@369app.lat