Cuatro is a padel matchmaking service operated in Ontario, Canada. In this policy, "we" and "us" mean Cuatro; "you" means the person using the Cuatro app.
We are the organisation accountable for the personal information described here. Our privacy officer, responsible for our handling of personal information and for answering your requests, can be reached at privacy@cuatro.ca.
This policy covers the Cuatro mobile app and the systems behind it. It explains what personal information we collect, why, who can see it, where it lives, how long we keep it, and what you can ask us to do with it.
We are a Canadian service and we build to the Personal Information Protection and Electronic Documents Act (PIPEDA). If you live in Quebec, Law 25 — the Act respecting the protection of personal information in the private sector — also applies to us, and section 9.1 sets out what it additionally gives you.
This policy is published in English and in French. If you reside in Quebec, the French version prevails in the event of any discrepancy between the two; elsewhere, the English version prevails.
We want to be specific about this, because the absences are deliberate:
This is the part of the system we have designed hardest, so it is worth stating plainly. Our database separates your information into three tiers, and the separation is enforced by the database itself — not by a rule the app is trusted to follow.
Other players can see: your first and last name, your skill tier, which side you play, your gender, your general neighbourhood, any badges you have earned, and how many times the two of you have played together.
Other players can never see: your email address, your postal code, your exact availability, your travel limits, your gender preference, or your notification settings.
Nobody can see, including you:
Your neighbourhood is deliberately coarse. It is derived from the first three characters of your postal code — the Forward Sortation Area, which covers thousands of households — never from the full code, which narrows to roughly fifteen. Other players see something like "Oakville", never a street.
We rely on your consent, which you gave when you created your account and can withdraw at any time by deleting it.
We use a small number of service providers. Each gets the minimum it needs to do its job. We name the company currently filling each role rather than describing it generically, because a claim you can check is worth more than one you cannot — and the role is the commitment, so if we change provider we update this policy and the limits below still apply to whoever replaces them.
Our hosting provider, currently Supabase, runs our database, authentication, file storage, and server functions. This means its infrastructure physically holds essentially all of the information described in this policy. Our project runs in Supabase's Canadian region (ca-central-1), so your information is stored in Canada.
Our push notification service, currently Expo, delivers notifications to your device. When we send you one, it receives your device's push token and the content of that notification — which may include a sender's first name and a message preview, because that is what the notification says — and passes it to Apple's or Google's push service to reach your phone. Those two are not a choice we make: no notification can reach an iPhone or an Android device without them.
Expo also delivers our app updates, which is a second role and a separate flow of information. Each time you open Cuatro, the app asks Expo whether a newer version is available, so that a fix can reach you without waiting on an app store review. That request carries your device's IP address and basic device and runtime details — the operating system version and the version of Cuatro you are running. It carries no name, no email address, and no account identifier, and it happens on every launch whether or not you use notifications.
Our routing provider, currently OpenRouteService, calculates driving times between areas and venues. It receives the first three characters of a postal code and a venue's coordinates. It receives no name, no email address, no account identifier, and no full postal code. It has no way to know which person, or how many people, a given area lookup was for.
Your stored information stays in Canada, as described above. Two things do not, and we would rather name both than let the first stand for all of it.
Push notifications. Expo, Apple, and Google operate their push infrastructure in the United States, so a notification we send you — your device token and that notification's text — is processed there. You can stop this by turning notifications off. The app works without them; you will simply have to open it to see what has happened.
The update check. Expo's app-update service also runs in the United States, so the IP address and device details described above are processed there too, once on every launch. There is no setting that turns this off, short of not opening the app. It is how a fix reaches an installed copy of Cuatro, and we would rather say so plainly than offer you a switch that does not exist.
While either is outside Canada it is subject to the laws of that country, including lawful access by its courts and authorities, and our contracts cannot change that.
We have assessed both transfers, as Law 25 requires before personal information is communicated outside Quebec. What leaves is a device token and the text of one notification — at most a sender's first name and a message preview — and, on launch, an IP address with an operating system and app version beside it. Neither carries a profile, a location, a history, or an email address; both are transient rather than stored; they go to three providers operating under published security programmes; and there is no way to deliver a push notification to an iPhone or an Android phone, or to ship a correction to an app already installed, without them. We consider both transfers proportionate to those purposes.
We may also disclose personal information where the law requires it — a court order, a subpoena, or a lawful demand from a regulator.
Our hosting provider keeps its own operational logs — for example, records of requests reaching the service — under its retention policy, not ours.
You can delete your account yourself, from Face ID & security in the app. It is immediate and it is permanent. There is no recovery, no grace period, and no soft delete that quietly keeps your email address on file.
Destroyed: your login and email address, your profile, your postal code and availability, your preferences, your community relationships, your push tokens, your notifications, and the content of every chat message you sent.
Kept, with you removed from it: the games you played in, and the ratings you gave and received.
We want to explain that second part rather than bury it. A padel game involved three other people. Erasing the game itself would delete their record of an evening they had no say in removing, and it would strand their replies in a conversation against a gap. So the game survives with your identity scrubbed out of it, and your messages leave behind a marker reading "message not available" — which keeps the shape of the conversation honest without keeping a word of what you wrote. Ratings persist without any link to you, because they are part of other players' skill history.
The legal position we are taking is that PIPEDA requires the erasure of your personal information, not the destruction of other people's records of a shared event.
Under PIPEDA you have the right to:
We will respond to a request within 30 days.
There is one limit worth stating up front: we cannot show you your ratings or your reliability score, because showing them would disclose other players' assessments of you and would let you work out who said what. If you believe an assessment about you is wrong, write to us and we will look at it.
Law 25 gives you these in addition to everything above. They depend on where you live, not on which language you read this in.
And one that needs stating plainly, because it is the whole product. Cuatro decides which games to show you, and whether to suggest you to a group, by automated processing alone — no person reviews it. The engine reads your skill, availability, location, travel limit, gender preference, and who you have played with and favourited before. It does not currently read your reliability record or your ratings; if that changes, we will say so here before it does. Nobody at Cuatro approves any of this, and nobody is told it happened.
If you live in Quebec, Law 25 entitles you to be told that this is how it works — which is what this section is — and to submit your observations and ask that a person review the outcome. Write to privacy@cuatro.ca and a human being will look at your case and reply. We will also tell you which categories of information were used, and how you can correct them.
Cuatro is for adults. You must be at least 18 to use it, as the Terms of service require. We do not knowingly collect information from anyone younger, and if we learn that we have, we will delete the account.
Access to your information is enforced at the database level, so a bug in the app cannot expose data the app was never entitled to read. Information is encrypted in transit and at rest. Sign-in uses a single-use link or code rather than a password, so there is no password of yours for anyone to steal or reuse.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as PIPEDA requires.
If we change this policy we will update the version and effective date above, and tell you in the app before the change takes effect where the change is significant.
Questions, requests, or complaints: privacy@cuatro.ca. We do not publish a postal address; email reaches us and is answered.