Versions — each applies from its date until the next one takes effect:
Cuatro is a padel matchmaking service operated in Ontario, Canada. In this policy, "we" and "us" mean Cuatro; "you" means the person using the Cuatro app.
We are the organisation accountable for the personal information described here. Our privacy officer, responsible for our handling of personal information and for answering your requests, can be reached at privacy@cuatro.ca.
This policy covers the Cuatro mobile app and the systems behind it. It explains what personal information we collect, why, who can see it, where it lives, how long we keep it, and what you can ask us to do with it.
We are a Canadian service and we build to the Personal Information Protection and Electronic Documents Act (PIPEDA). If you live in Quebec, Law 25 — the Act respecting the protection of personal information in the private sector — also applies to us, and section 9.1 sets out what it additionally gives you.
This policy is published in English and in French. If you reside in Quebec, the French version prevails in the event of any discrepancy between the two; elsewhere, the English version prevails.
Our team can see, in our admin tools, every message from Cuatro sent to you and when it arrived, how many you have had in the last 7 days and in all, and what you did with each: whether you opened it, closed it or put it off, tapped its button, took the step it suggested, or answered its question. It can list the players who have not yet taken a given step, and sort the player list by how many messages each has had. It sees that you answered a question even when your answer was kept without your name, but it can see your answer only when that question kept answers with names. An answer kept without a name is shown only as part of that question's totals, and the totals are hidden until at least five people have answered that way.
We want to be specific about this, because the absences are deliberate:
This is the part of the system we have designed hardest, so it is worth stating plainly. Our database separates your information into three tiers, and the separation is enforced by the database itself — not by a rule the app is trusted to follow.
Other players can see: your first and last name, your skill level (your tier, and on some screens the number), which side you play, your gender, your general neighbourhood, any badges you have earned, your kudos, and how many times the two of you have played together. When they choose whom to invite to a game, they can also see whether its time is outside your usual availability, whether you are already playing then, and whether you are travelling that day (section 4.2). If you have connected your World Padel Rating, they also see your two World Padel Ratings (WPR and WPR-s) and how confident World Padel Rating is in each. Some screens show only your WPR-s, the rating the app matches you on.
Kudos. When at least three different players have given you a positive rating with the same reason — Good sport, Great partner, Fun to play with or On time — every signed-in player can see that reason on your player card, with how many players gave it. Kudos are counted once a day, never say who gave them, and never include a negative rating or the reason given with it.
"Plays better". When at least three different players have said you play better than your level, and no other read of your level is as common, every signed-in player sees "Plays better" on your player card, with how many players said so. Like kudos, it is worked out once a day and never says who gave it. A read that you play below your level, or that it is about right, is never shown to anybody but its giver.
"Travelling". If you turn on travel mode, a player choosing whom to invite to a game on a date inside your trip sees "Travelling" beside your name, in place of your skill level (section 4.2). It never says where you are. Nobody but you sees the dates of your trip, with one exception: the owner of a favourite group you belong to sees, once your trip has started, its last day — "Until" that date — under your name in that group. They never see the first day. Other members of the group do not see it, and neither does a player either of you has blocked.
Other players can never see: your email address, your postal code, the exact square you picked, your travel limits, your gender preference, your notification settings, where you travel, or your answers to a question from Cuatro. They are never shown your weekly availability as a timetable, but it is not hidden from them either: the list in section 4.2 tells them, for the time they choose, whether you are usually free then. Your travel limit and your gender preference also shape the match percentage that list shows.
Ratings, apart from kudos and "Plays better", are shown to nobody but their giver. A rating you give is shown to you alone, on that player's card: never to the player you rated, and never to anyone else. The ratings you receive are never shown to you or to anyone else, one by one or as a count; the only trace of them anyone sees is your kudos and, for level reads, the "Plays better" mark.
Nobody can see, including you:
Your neighbourhood is deliberately coarse. If you picked your area on the map, it is the name our routing provider gives that ~1 km square. If you gave a postal code, it is derived from the code's first three characters — the Forward Sortation Area, which covers thousands of households — never from the full code, which narrows to roughly fifteen. Either way, other players see something like "Oakville", never a street.
When you take a seat in a game that is still filling up, your name and your avatar are shown to the people the app offers that game to — the players invited to it, and the players browsing suggested games who are shown it. They see the venue and the time as well, so the effect is that they can see you plan to be at that place at that hour.
We show this by default because who is playing is the main thing that decides whether someone joins, and games fill faster when people can see it.
Anyone who has joined can invite. Every player confirmed in a game that is still filling can invite others to it, by name or by letting the app choose, and can take back the invitations they sent. So the people who see you in that game are the ones the app suggests it to and the ones the players in it choose.
How being asked to play, and joining, are shown:
What this does not change. Nothing in this section widens what is public about you — your name is already visible on your player card (section 4 above). What it adds is the link between you, a place, and a future time, shown to the players that game is offered to. That link is why it has a setting of its own rather than riding on the consent you gave when you signed up.
Writing to the group names you. If you decline an invitation with a note, or suggest a new time, your note or your suggestion appears in the game's chat under your name, whether or not "Hide my name in forming games" is on, because you chose to write to the group. The organiser and the players invited to or in that game can see it.
When a player creates a game, or a player confirmed in a game still filling chooses whom to invite to it, the app lists players to choose from. Any signed-in player can see this list, for a court and a time they choose. It shows up to 200 players whose area is within a distance of that court the player chooses, or in its country, and for each of them:
Your weekly availability is never shown as such, and neither is your area or your trip. But a player who checks the list for different times can work out when you are usually free, when you are already playing, and when you are away, and whether you are listed depends on how far your area is from the court they picked.
"Travelling" is also shown to the organiser and the confirmed players of a game still filling, for the people already on its invitation list, and to a player picking from their favourites and the people they have played with, for a game from yesterday up to 180 days ahead.
We rely on your consent, which you gave when you created your account and can withdraw at any time by deleting it.
We use a small number of service providers. Each gets the minimum it needs to do its job. We name the company currently filling each role rather than describing it generically, because a claim you can check is worth more than one you cannot — and the role is the commitment, so if we change provider we update this policy and the limits below still apply to whoever replaces them.
Our hosting provider, currently Supabase, runs our database, authentication, file storage, and server functions. This means its infrastructure physically holds essentially all of the information described in this policy. Our project runs in Supabase's Canadian region (ca-central-1), so your information is stored in Canada.
Our push notification service, currently Expo, delivers notifications to your device. When we send you one, it receives your device's push token and the content of that notification — which may include a sender's first name and a message preview, because that is what the notification says — and passes it to Apple's or Google's push service to reach your phone. Those two are not a choice we make: no notification can reach an iPhone or an Android device without them. A message from Cuatro can also be written for you: its text may include your own first name, the club you play at most, your neighbourhood and your skill level, filled in from your profile before it is sent. When it arrives as a notification, those details reach Expo, Apple, and Google as part of its text.
Expo also delivers our app updates, which is a second role and a separate flow of information. Each time you open Cuatro, the app asks Expo whether a newer version is available, so that a fix can reach you without waiting on an app store review. That request carries your device's IP address and basic device and runtime details — the operating system version and the version of Cuatro you are running. It carries no name, no email address, and no account identifier, and it happens on every launch whether or not you use notifications.
World Padel Rating, if you choose to connect it. Connecting is optional, and you can do it during sign-up or later from your profile. It works like signing in with another service:
World Padel Rating is an independent company. The profile you hold with it is governed by its own privacy policy, not this one. You can disconnect at any time from your profile (section 7).
Our routing provider, currently OpenRouteService, calculates driving times between areas and venues, and gives each area its name. It receives the centre of a ~1 km area, or the first three characters of a postal code, and a venue's coordinates. It receives no name, no email address, no account identifier, and no full postal code. It has no way to know which person, or how many people, a given area lookup was for.
Our map and place-search provider, currently Google, has two separate roles:
Our network provider, currently Cloudflare, tells the map where to open before you have picked anything. It works out an approximate position from your device's IP address, rounded to about 10 km — a city, not a street — and returns it to the app. It stores and logs nothing, and it receives no name, email address, or account identifier.
Your stored information stays in Canada, as described above. Five things do not, and we would rather name each than let the first stand for all of them.
Push notifications. Expo, Apple, and Google operate their push infrastructure in the United States, so a notification we send you — your device token and that notification's text — is processed there. You can stop this by turning notifications off. The app works without them; you will simply have to open it to see what has happened.
The update check. Expo's app-update service also runs in the United States, so the IP address and device details described above are processed there too, once on every launch. There is no setting that turns this off, short of not opening the app. It is how a fix reaches an installed copy of Cuatro, and we would rather say so plainly than offer you a switch that does not exist.
The map and search. Google processes the map requests and searches described in section 6 in the United States and elsewhere. A search carries what you typed, a rounded map area, and your language, and no account identifier; a map request carries your IP address and device details. You can avoid search entirely by typing a Canadian postal code, or by using the location button; the map itself cannot be turned off while you are choosing an area.
Where the map opens. Cloudflare answers that question at whichever of its servers is nearest to you, which may be outside Canada. It sees your IP address for the length of one request and keeps nothing.
Your World Padel Rating connection, if you make one. World Padel Rating's systems are outside Canada. Connecting sends it the random Cuatro account identifier described in section 6, and each rating check sends it your World Padel Rating identifier. Your ratings come back and are stored with the rest of your information, in Canada. If you do not connect, nothing about you goes to World Padel Rating.
While any of this is outside Canada it is subject to the laws of that country, including lawful access by its courts and authorities, and our contracts cannot change that.
We have assessed these transfers, as Law 25 requires before personal information is communicated outside Quebec. What leaves is a device token and the text of one notification — at most a sender's first name and a message preview or, in a message from Cuatro, your own first name, the club you play at most, your neighbourhood and your skill level — and, on launch, an IP address with an operating system and app version beside it. Neither carries a full profile, a position on a map, a history, or an email address; the most a notification can say about where you play is the name of your neighbourhood and your club; both are transient rather than stored; they go to three providers operating under published security programmes; and there is no way to deliver a push notification to an iPhone or an Android phone, or to ship a correction to an app already installed, without them. The map and search transfers carry an IP address, device details, a rounded map area and the words of a search — no account identifier, and nothing tying a search to you; they happen while you choose an area, usually once; and showing a map and finding a place by name is not possible without a mapping provider. The World Padel Rating connection sends only identifiers — no name, email address, location or history — happens only if you choose it, and is the only way to use your verified rating instead of an estimate. We consider all five transfers proportionate to their purposes.
We may also disclose personal information where the law requires it — a court order, a subpoena, or a lawful demand from a regulator.
Our hosting provider keeps its own operational logs — for example, records of requests reaching the service — under its retention policy, not ours.
You can delete your account yourself, from Account & security in the app. It is immediate and it is permanent. There is no recovery, no grace period, and no soft delete that quietly keeps your email address on file.
Destroyed: your login and email address, your profile, your area or postal code and availability, your preferences, your community relationships, your push tokens, your notifications, your World Padel Rating connection and ratings, the record of the versions of these documents you accepted, your trip if travel mode is on, the level reads you gave and the level reads about you, your answers to questions from Cuatro that were kept with your name, the record of which messages from Cuatro you received, answered or acted on, your kudos and "Plays better" mark, and the content of every chat message you sent. Your World Padel Rating profile itself is World Padel Rating's, and deleting your Cuatro account does not delete it.
Kept, with you removed from it: the games you played in, and the ratings you gave and received. Kept, because it is not linked to your account: an answer you gave to a question from Cuatro that kept answers without names.
We want to explain that second part rather than bury it. A padel game involved three other people. Erasing the game itself would delete their record of an evening they had no say in removing, and it would strand their replies in a conversation against a gap. So the game survives with your identity scrubbed out of it, and your messages leave behind a marker reading "message not available" — which keeps the shape of the conversation honest without keeping a word of what you wrote. Ratings persist without any link to you, because they are part of other players' skill history. A rating you gave no longer counts towards anyone's kudos from the next daily count after your account is deleted.
The legal position we are taking is that PIPEDA requires the erasure of your personal information, not the destruction of other people's records of a shared event.
Under PIPEDA you have the right to:
We will respond to a request within 30 days.
There is one limit worth stating up front: beyond your kudos and your "Plays better" mark, we cannot show you the ratings and level reads other players gave you or your reliability score, because showing them would disclose other players' assessments of you and would let you work out who said what. The ratings and level reads you gave are on each player's card. If you believe an assessment about you is wrong, write to us and we will look at it.
Law 25 gives you these in addition to everything above. They depend on where you live, not on which language you read this in.
And one that needs stating plainly, because it is the whole product. Cuatro decides which games to show you, and whether to suggest you to a group, by automated processing alone — no person reviews it. The engine reads your skill, availability, location, travel limit, gender preference, and who you have played with and favourited before. It does not currently read your reliability record or your ratings; if that changes, we will say so here before it does. Nobody at Cuatro approves any of this, and nobody is told it happened.
Some messages from Cuatro are also sent by automated processing alone. Our team writes the rule, and the rule decides that a message is due to you, from the date you signed up, your first game or the time since your last, and whether you have yet taken the step the message is about (section 5). No person decides that a given message reaches you.
If you live in Quebec, Law 25 entitles you to be told that this is how it works — which is what this section is — and to submit your observations and ask that a person review the outcome. Write to privacy@cuatro.ca and a human being will look at your case and reply. We will also tell you which categories of information were used, and how you can correct them.
Cuatro is for adults. You must be at least 18 to use it, as the Terms of service require. We do not knowingly collect information from anyone younger, and if we learn that we have, we will delete the account.
Access to your information is enforced at the database level, so a bug in the app cannot expose data the app was never entitled to read. Information is encrypted in transit and at rest. Sign-in uses a single-use link or code rather than a password, so there is no password of yours for anyone to steal or reuse.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as PIPEDA requires.
If we change this policy we will update the version and effective date above, and email you before the new version takes effect, with a summary of what changed and a link to it. You do not need to accept it again in the app.
If a change would mean using your information for a new purpose, or giving it to an organisation that would use it for its own purposes, we will ask for your consent in the app, where that use happens, before it starts. If you do not agree, we will not use your information that way.
If you disagree with a change, you can delete your account at any time (section 8).
Questions, requests, or complaints: privacy@cuatro.ca. We do not publish a postal address; email reaches us and is answered.