Versions — each applies from its date until the next one takes effect:
Cuatro is a padel matchmaking service operated in Ontario, Canada. In this policy, "we" and "us" mean Cuatro; "you" means the person using the Cuatro app.
We are the organisation accountable for the personal information described here. Our privacy officer, responsible for our handling of personal information and for answering your requests, can be reached at privacy@cuatro.ca.
This policy covers the Cuatro mobile app and the systems behind it. It explains what personal information we collect, why, who can see it, where it lives, how long we keep it, and what you can ask us to do with it.
We are a Canadian service and we build to the Personal Information Protection and Electronic Documents Act (PIPEDA). If you live in Quebec, Law 25 — the Act respecting the protection of personal information in the private sector — also applies to us, and section 9.1 sets out what it additionally gives you.
This policy is published in English and in French. If you reside in Quebec, the French version prevails in the event of any discrepancy between the two; elsewhere, the English version prevails.
We want to be specific about this, because the absences are deliberate:
This is the part of the system we have designed hardest, so it is worth stating plainly. Our database separates your information into three tiers, and the separation is enforced by the database itself — not by a rule the app is trusted to follow.
Other players can see: your first and last name, your skill level (your tier, and on some screens the number), which side you play, your gender, your general neighbourhood, any badges you have earned, and how many times the two of you have played together. If you have connected your World Padel Rating, they also see your two World Padel Ratings (WPR and WPR-s) and how confident World Padel Rating is in each. Some screens show only your WPR-s, the rating the app matches you on.
Other players can never see: your email address, your postal code, the exact square you picked, your exact availability, your travel limits, your gender preference, or your notification settings.
Nobody can see, including you:
Your neighbourhood is deliberately coarse. If you picked your area on the map, it is the name our routing provider gives that ~1 km square. If you gave a postal code, it is derived from the code's first three characters — the Forward Sortation Area, which covers thousands of households — never from the full code, which narrows to roughly fifteen. Either way, other players see something like "Oakville", never a street.
When you take a seat in a game that is still filling up, your name and your avatar are shown to the people the app offers that game to — the players invited to it, and the players browsing suggested games who are shown it. They see the venue and the time as well, so the effect is that they can see you plan to be at that place at that hour.
We show this by default because who is playing is the main thing that decides whether someone joins, and games fill faster when people can see it.
Three limits on it:
What this does not change. Nothing in this section widens what is public about you — your name is already visible on your player card (section 4 above). What it adds is the link between you, a place, and a future time, shown to the players the app suggests that game to. That link is why it has a setting of its own rather than riding on the consent you gave when you signed up.
Writing to the group names you. If you decline an invitation with a note, or suggest a new time, your note or your suggestion appears in the game's chat under your name, whether or not "Hide my name in forming games" is on, because you chose to write to the group. The organiser and the players invited to or in that game can see it.
We rely on your consent, which you gave when you created your account and can withdraw at any time by deleting it.
We use a small number of service providers. Each gets the minimum it needs to do its job. We name the company currently filling each role rather than describing it generically, because a claim you can check is worth more than one you cannot — and the role is the commitment, so if we change provider we update this policy and the limits below still apply to whoever replaces them.
Our hosting provider, currently Supabase, runs our database, authentication, file storage, and server functions. This means its infrastructure physically holds essentially all of the information described in this policy. Our project runs in Supabase's Canadian region (ca-central-1), so your information is stored in Canada.
Our push notification service, currently Expo, delivers notifications to your device. When we send you one, it receives your device's push token and the content of that notification — which may include a sender's first name and a message preview, because that is what the notification says — and passes it to Apple's or Google's push service to reach your phone. Those two are not a choice we make: no notification can reach an iPhone or an Android device without them.
Expo also delivers our app updates, which is a second role and a separate flow of information. Each time you open Cuatro, the app asks Expo whether a newer version is available, so that a fix can reach you without waiting on an app store review. That request carries your device's IP address and basic device and runtime details — the operating system version and the version of Cuatro you are running. It carries no name, no email address, and no account identifier, and it happens on every launch whether or not you use notifications.
World Padel Rating, if you choose to connect it. Connecting is optional, and you can do it during sign-up or later from your profile. It works like signing in with another service:
World Padel Rating is an independent company. The profile you hold with it is governed by its own privacy policy, not this one. You can disconnect at any time from your profile (section 7).
Our routing provider, currently OpenRouteService, calculates driving times between areas and venues, and gives each area its name. It receives the centre of a ~1 km area, or the first three characters of a postal code, and a venue's coordinates. It receives no name, no email address, no account identifier, and no full postal code. It has no way to know which person, or how many people, a given area lookup was for.
Our map and place-search provider, currently Google, has two separate roles:
Our network provider, currently Cloudflare, tells the map where to open before you have picked anything. It works out an approximate position from your device's IP address, rounded to about 10 km — a city, not a street — and returns it to the app. It stores and logs nothing, and it receives no name, email address, or account identifier.
Your stored information stays in Canada, as described above. Five things do not, and we would rather name each than let the first stand for all of them.
Push notifications. Expo, Apple, and Google operate their push infrastructure in the United States, so a notification we send you — your device token and that notification's text — is processed there. You can stop this by turning notifications off. The app works without them; you will simply have to open it to see what has happened.
The update check. Expo's app-update service also runs in the United States, so the IP address and device details described above are processed there too, once on every launch. There is no setting that turns this off, short of not opening the app. It is how a fix reaches an installed copy of Cuatro, and we would rather say so plainly than offer you a switch that does not exist.
The map and search. Google processes the map requests and searches described in section 6 in the United States and elsewhere. A search carries what you typed, a rounded map area, and your language, and no account identifier; a map request carries your IP address and device details. You can avoid search entirely by typing a Canadian postal code, or by using the location button; the map itself cannot be turned off while you are choosing an area.
Where the map opens. Cloudflare answers that question at whichever of its servers is nearest to you, which may be outside Canada. It sees your IP address for the length of one request and keeps nothing.
Your World Padel Rating connection, if you make one. World Padel Rating's systems are outside Canada. Connecting sends it the random Cuatro account identifier described in section 6, and each rating check sends it your World Padel Rating identifier. Your ratings come back and are stored with the rest of your information, in Canada. If you do not connect, nothing about you goes to World Padel Rating.
While any of this is outside Canada it is subject to the laws of that country, including lawful access by its courts and authorities, and our contracts cannot change that.
We have assessed these transfers, as Law 25 requires before personal information is communicated outside Quebec. What leaves is a device token and the text of one notification — at most a sender's first name and a message preview — and, on launch, an IP address with an operating system and app version beside it. Neither carries a profile, a location, a history, or an email address; both are transient rather than stored; they go to three providers operating under published security programmes; and there is no way to deliver a push notification to an iPhone or an Android phone, or to ship a correction to an app already installed, without them. The map and search transfers carry an IP address, device details, a rounded map area and the words of a search — no account identifier, and nothing tying a search to you; they happen while you choose an area, usually once; and showing a map and finding a place by name is not possible without a mapping provider. The World Padel Rating connection sends only identifiers — no name, email address, location or history — happens only if you choose it, and is the only way to use your verified rating instead of an estimate. We consider all five transfers proportionate to their purposes.
We may also disclose personal information where the law requires it — a court order, a subpoena, or a lawful demand from a regulator.
Our hosting provider keeps its own operational logs — for example, records of requests reaching the service — under its retention policy, not ours.
You can delete your account yourself, from Account & security in the app. It is immediate and it is permanent. There is no recovery, no grace period, and no soft delete that quietly keeps your email address on file.
Destroyed: your login and email address, your profile, your area or postal code and availability, your preferences, your community relationships, your push tokens, your notifications, your World Padel Rating connection and ratings, the record of the versions of these documents you accepted, and the content of every chat message you sent. Your World Padel Rating profile itself is World Padel Rating's, and deleting your Cuatro account does not delete it.
Kept, with you removed from it: the games you played in, and the ratings you gave and received.
We want to explain that second part rather than bury it. A padel game involved three other people. Erasing the game itself would delete their record of an evening they had no say in removing, and it would strand their replies in a conversation against a gap. So the game survives with your identity scrubbed out of it, and your messages leave behind a marker reading "message not available" — which keeps the shape of the conversation honest without keeping a word of what you wrote. Ratings persist without any link to you, because they are part of other players' skill history.
The legal position we are taking is that PIPEDA requires the erasure of your personal information, not the destruction of other people's records of a shared event.
Under PIPEDA you have the right to:
We will respond to a request within 30 days.
There is one limit worth stating up front: we cannot show you your ratings or your reliability score, because showing them would disclose other players' assessments of you and would let you work out who said what. If you believe an assessment about you is wrong, write to us and we will look at it.
Law 25 gives you these in addition to everything above. They depend on where you live, not on which language you read this in.
And one that needs stating plainly, because it is the whole product. Cuatro decides which games to show you, and whether to suggest you to a group, by automated processing alone — no person reviews it. The engine reads your skill, availability, location, travel limit, gender preference, and who you have played with and favourited before. It does not currently read your reliability record or your ratings; if that changes, we will say so here before it does. Nobody at Cuatro approves any of this, and nobody is told it happened.
If you live in Quebec, Law 25 entitles you to be told that this is how it works — which is what this section is — and to submit your observations and ask that a person review the outcome. Write to privacy@cuatro.ca and a human being will look at your case and reply. We will also tell you which categories of information were used, and how you can correct them.
Cuatro is for adults. You must be at least 18 to use it, as the Terms of service require. We do not knowingly collect information from anyone younger, and if we learn that we have, we will delete the account.
Access to your information is enforced at the database level, so a bug in the app cannot expose data the app was never entitled to read. Information is encrypted in transit and at rest. Sign-in uses a single-use link or code rather than a password, so there is no password of yours for anyone to steal or reuse.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as PIPEDA requires.
If we change this policy we will update the version and effective date above, and email you before the new version takes effect, with a summary of what changed and a link to it. You do not need to accept it again in the app.
If a change would mean using your information for a new purpose, or giving it to an organisation that would use it for its own purposes, we will ask for your consent in the app, where that use happens, before it starts. If you do not agree, we will not use your information that way.
If you disagree with a change, you can delete your account at any time (section 8).
Questions, requests, or complaints: privacy@cuatro.ca. We do not publish a postal address; email reaches us and is answered.