Cuatro is a padel matchmaking service operated by Sami Ghourabi and Karim Younsi, carrying on business as Cuatro in Ontario, Canada. In this policy, "we" and "us" mean Sami Ghourabi and Karim Younsi; "you" means the person using the Cuatro app.
We are the organisation accountable for the personal information described here. Our privacy contact is privacy@cuatro.ca.
This policy covers the Cuatro mobile app and the systems behind it. It explains what personal information we collect, why, who can see it, where it lives, how long we keep it, and what you can ask us to do with it.
We are a Canadian service and we build to the Personal Information Protection and Electronic Documents Act (PIPEDA).
This policy is published in English only. A French version is not yet available.
We want to be specific about this, because the absences are deliberate:
This is the part of the system we have designed hardest, so it is worth stating plainly. Our database separates your information into three tiers, and the separation is enforced by the database itself — not by a rule the app is trusted to follow.
Other players can see: your first and last name, your skill tier, which side you play, your gender, your general neighbourhood, any badges you have earned, and how many times the two of you have played together.
Other players can never see: your email address, your postal code, your exact availability, your travel limits, your gender preference, or your notification settings.
Nobody can see, including you:
Your neighbourhood is deliberately coarse. It is derived from the first three characters of your postal code — the Forward Sortation Area, which covers thousands of households — never from the full code, which narrows to roughly fifteen. Other players see something like "Oakville", never a street.
We rely on your consent, which you gave when you created your account and can withdraw at any time by deleting it.
We use a small number of service providers. Each gets the minimum it needs to do its job.
Supabase hosts our database, authentication, file storage, and server functions. This means Supabase's infrastructure physically holds essentially all of the information described in this policy. Our project runs in Supabase's Canadian region (ca-central-1), so your information is stored in Canada.
Expo, Apple, and Google deliver push notifications. When we send you a notification, Expo receives your device's push token and the content of that notification — which may include a sender's first name and a message preview, because that is what the notification says — and passes it to Apple's or Google's push service to reach your device.
OpenRouteService calculates driving times between areas and venues. It receives the first three characters of a postal code and a venue's coordinates. It receives no name, no email address, no account identifier, and no full postal code. It has no way to know which person, or how many people, a given area lookup was for.
Your stored information stays in Canada, as described above. Push notifications do not. Expo, Apple, and Google operate their push infrastructure in the United States, so a notification we send you — your device token and that notification's text — is processed there. While it is outside Canada it is subject to the laws of that country, including lawful access by its courts and authorities, and our contracts cannot change that.
If you would rather nothing left the country, turn notifications off. The app works without them; you will simply have to open it to see what has happened.
We may also disclose personal information where the law requires it — a court order, a subpoena, or a lawful demand from a regulator.
Our hosting provider keeps its own operational logs — for example, records of requests reaching the service — under its retention policy, not ours.
You can delete your account yourself, from Face ID & Security in the app. It is immediate and it is permanent. There is no recovery, no grace period, and no soft delete that quietly keeps your email address on file.
Destroyed: your login and email address, your profile, your postal code and availability, your preferences, your community relationships, your push tokens, your notifications, and the content of every chat message you sent.
Kept, with you removed from it: the games you played in, and the ratings you gave and received.
We want to explain that second part rather than bury it. A padel game involved three other people. Erasing the game itself would delete *their* record of an evening they had no say in removing, and it would strand their replies in a conversation against a gap. So the game survives with your identity scrubbed out of it, and your messages leave behind a marker reading "message not available" — which keeps the shape of the conversation honest without keeping a word of what you wrote. Ratings persist without any link to you, because they are part of other players' skill history.
The legal position we are taking is that PIPEDA requires the erasure of *your* personal information, not the destruction of other people's records of a shared event.
Under PIPEDA you have the right to:
We will respond to a request within 30 days.
There is one limit worth stating up front: we cannot show you your ratings or your reliability score, because showing them would disclose other players' assessments of you and would let you work out who said what. If you believe an assessment about you is wrong, write to us and we will look at it.
Cuatro is for adults. You must be at least 18 to use it, as the Terms of service require. We do not knowingly collect information from anyone younger, and if we learn that we have, we will delete the account.
Access to your information is enforced at the database level, so a bug in the app cannot expose data the app was never entitled to read. Information is encrypted in transit and at rest. Sign-in uses a single-use link or code rather than a password, so there is no password of yours for anyone to steal or reuse.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as PIPEDA requires.
If we change this policy we will update the version and effective date above, and tell you in the app before the change takes effect where the change is significant.
Questions, requests, or complaints: privacy@cuatro.ca. We do not publish a postal address; email reaches us and is answered.