Privacy

This page says what this host stores and what it does not. It covers people who publish a site with the CuatroSites app and people who visit one.

What we do not have

This host does not store your name, your email address or your phone number. Signing in is handled by Firebase Authentication, a Google service: it holds the email address, or the Google or Apple sign-in, that you use, under the privacy policy of Google, and gives this host only an account identifier. This host sets no cookies, runs no analytics and loads no trackers. Published sites carry no scripts at all.

What we store about your account

• the account identifier the sign-in service gives us (a random string, not your name or your email address)
• a short account code, shown in the app, that you can read to GoCuatro so that your account can be found
• whether your account has a plan, until when, and how it was switched on
• whether a site of the account was removed for breaking the rules
• the times the account was created and last used

What we store when you publish a site

• the site itself: the text, contact details and settings you entered in the app, which are public once the site is published
• the photos you added to the site
• which account the site belongs to
• the version of the terms you accepted
• the times the site was created, changed and published

Network addresses (IP addresses)

We do not store IP addresses. To limit how fast one connection can create sites, upload photos or send reports, we compute a salted hash of the address that changes every day. The hash cannot be turned back into the address, and it cannot be linked from one day to the next. It is kept in two places: in the daily counters, which are deleted after 2 days, and next to an abuse report, for as long as the report is kept.

Cloudflare, the company whose network this host runs on, carries every request and, like any network provider, handles IP addresses to do that. Its own privacy policy applies to that.

Reports

When someone reports a site we store which site, the reason they chose, anything they wrote, the time, and the daily hash described above. We do not ask who is reporting.

Visits

We count how many times the pages of each site are opened and how many times its contact buttons are tapped, per day. These are numbers only: nothing about the visitor is stored with them, no network address, no browser details and no cookie. The owner of the site sees the numbers in the app. A tap is counted by a small request the browser sends by itself; it does not change where the button leads.

Payment records

When GoCuatro switches a plan on for an account, a record is kept: the account identifier, the number of months, the amount and the way it was paid if they were noted, a note, and the date.

Buying the plan through Apple

When you buy the plan in the iPhone app, Apple takes the payment: we never see or store your card details. The app sends Apple’s signed proof of the purchase to this host, and we keep only what is needed to run the plan: Apple’s number for the purchase, which product it was, how many months it added, whether it was a real or a test purchase, and the time, all tied to your account. The purchase carries a code made from your account identifier, not from your email address, and we share nothing about it with anyone else. Like the payment records, this record is kept after you delete your account, so that an old purchase cannot be used again. Refunds for purchases made through Apple are handled by Apple.

How long we keep things

• A site and its photos: until you delete the site or your account in the app. Deleting removes them from this host straight away.
• After a delete only the name of the address is kept, for 90 days, so that nobody else can take it right away.
• An address that was reserved and never published: released after 30 days, or after 7 days if the account has never had a plan, with any photos uploaded for it.
• A site we removed for breaking the rules: its content is kept for 90 days so that the decision can be reviewed, then deleted. The account stays blocked.
• Your account record: until you delete your account in the app. An account with no sites that has never had a plan is deleted after 180 days without use. If the account was blocked for breaking the rules, its identifier and the block are kept after a delete, so that the block cannot be undone that way.
• Payment records: kept as the accounts of GoCuatro, also after the account is deleted.
• Visit counts: 400 days, or until the site is deleted.
• Reports: 180 days.
• Daily counters: 2 days.

After a site is deleted or unpublished, cached copies of its pages stop being served within about five minutes, and cached copies of its photos within about an hour. A browser that already loaded a photo may keep its own copy for longer.

Visitors

Opening a site on this host sets no cookies and loads nothing from other companies. The buttons on a site open WhatsApp, Instagram, the phone, email or a maps app. What happens there is up to those services.

Your choices

You can see, change, unpublish or delete your sites in the app at any time, and you can delete your account there. How to delete your account Contact GoCuatro