Privacy, cookies and terms

Privacy policy

This policy explains what personal data Cuadra processes, why, on what legal basis, who it is shared with, how long it is kept and how you can exercise your rights. It is based on Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applies to the cuadra.dolarflashve.eu website, the web app (including when installed as a PWA) and the Android app.

1. Data controller

The controller of your data is Jesus Rogliero, an individual resident in Venezuela (on this page, “Cuadra”, “we” or “us”).

For anything related to your data, write to [email protected]. Given the size and nature of the service, we are not required to appoint a data protection officer; we handle requests directly at that address.

2. What data we process

Account data

• Email address.
• Display name and profile photo. If you sign in with Google, we receive the name, email address and photo of your Google account.
• Your Firebase user ID (UID), which links your account to your data.
• Your language and currency preferences.

If you sign up with email and password, the password is handled by Firebase Authentication (Google). We never see or store it.

Content you create in Cuadra

• Groups: name, type (trip, meal, home or other), emoji and reference rate.
• Members: the names users type for each member, including people who don’t have an account.
• Expenses: description, amounts, currencies, exchange rates, date, who paid, how it is split, notes and bill items.
• Payments between members: amount, currency, date and the rate applied.
• Receipt photos. Before uploading them, the app re-encodes the image on your device, which removes its EXIF metadata such as GPS location or camera model.
• Group activity history: who created, edited, deleted or restored each item, and when.

Invitations and join requests

Each group’s invite links and codes, and join requests: who sends them, which name from the list they claim, their status and which admin approved or declined them.

Notifications

If you turn on notifications, we store the token your browser or device generates for Firebase Cloud Messaging and the platform you enabled them on (web, installed PWA or Android app), so we know where to send them. We also briefly keep the queue of notifications waiting to be sent.

Technical data

When the app talks to our server, technical logs are created: IP address, date and time of the request and minimal details of the request itself. We use them to keep the service secure and to detect errors and abuse. We also keep idempotency records, which stop a change that was sent twice (for example, when your connection comes back) from being applied twice.

Analytics, only with your consent

If you accept analytics, we use Google Analytics 4 to understand how Cuadra is used: pages and screens viewed, actions such as creating a group or signing in, device type, platform (web, PWA or Android app), language and approximate location. Cookies are limited to the cuadra.dolarflashve.eu subdomain and use the cuadra prefix. Ad storage and ad personalization are disabled.

Until you accept, the Google Analytics tag is not loaded: no analytics cookies are set and no data is sent to Google. If you accept, only analytics measurement is enabled; ad storage and ad personalisation stay off.

Data stored on your device

To work offline, the app stores in your browser (IndexedDB) a copy of your groups and the changes waiting to sync. It also stores your Firebase session and, in localStorage, your theme, language and consent preferences. This data only leaves your device to sync with your account. Details in Cookies and local storage.

3. Why we use your data and on what legal basis

You can withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal. Where we rely on legitimate interest, we have assessed that your interests and rights do not override it, because we use little data, keep it for a short time and use it for nothing else; you can still object (see Your rights). We do not use your data for advertising profiles.

4. Data about other people you add

When you add a member by name or record expenses involving someone else, you give us data about that person. Only add people who would reasonably expect to appear in that group because they share the expenses with you, use only the name or nickname needed to identify them, and don’t put sensitive information in notes or photos (for example, health details or full account numbers).

We process this data so the group can keep its accounts, based on our legitimate interest and that of the group’s members (Art. 6(1)(f) GDPR). Since we usually have no way of contacting these people, we inform them through this policy (Art. 14(5)(b) GDPR). If you appear in a Cuadra group and want to access, correct or erase your data, write to [email protected]; to resolve it we may ask the group’s admins to correct or remove the information.

5. Who sees your data within Cuadra

• Members of each group you belong to see your name, your photo and that group’s expenses, payments, items, notes, receipts and activity history.
• A group’s admins see requests to join it, with the requester’s name and photo and the name they claim.
• Someone using an invite link or code only sees what is needed to request to join, such as the group name and the names they can claim, and cannot access expenses until an admin approves the request.
• Whatever you export (CSV or PDF) or share outside Cuadra, such as a summary sent via WhatsApp, is under your control and subject to the terms of the service you use.

6. Providers and recipients

We don’t sell your personal data. We only share it with the providers we need to run the service, who act as processors under contract and on our instructions:

• Google (Google Ireland Limited and Google LLC): Firebase Authentication for sign-in, Firebase Cloud Messaging for notifications and, only with your consent, Google Analytics.
• Server provider: IONOS SE (Frankfurt, Germany), which hosts our server, database, backups and receipt photos.

DolarFlashVe (dolarflashve.eu), Cuadra’s sister project, only provides the exchange rates. Cuadra queries the rates from it but sends it no personal data.

We may also disclose data to public authorities or courts when the law requires us to.

7. International transfers

Google may process data in the United States and other countries outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the Standard Contractual Clauses approved by the European Commission that are part of Google’s data processing terms.

Data is stored in Germany (IONOS SE). The controller lives in Venezuela, outside the European Economic Area, and accesses it from there only to run and support the service. Venezuela has no European Commission adequacy decision; this access relies on it being necessary to provide the service you request (Art. 49(1)(b) GDPR) and is kept to the minimum, over encrypted connections with protected access.

If our server provider were located outside the European Economic Area, the transfer would rely on an adequacy decision of the European Commission or on Standard Contractual Clauses. You can ask us about these safeguards at [email protected].

8. How long we keep data

• Account and content: for as long as your account exists.
• When you delete your account: deletion from the app is immediate; if you ask us by email, we do it within 30 days. Backups rotate on a 30-day cycle, so your data also disappears from them within that period.
• Receipt photos: deleted when they are removed from the expense or when their group is deleted.
• Idempotency records and notification queue: deleted after 30 days.
• Notification tokens: replaced when your device renews them and deleted when they stop being valid or when you delete your account.
• Server technical logs: only as long as needed for security, as a rule no more than 30 days, unless needed to investigate a specific incident.
• Analytics: for the retention period configured in Google Analytics, at most 14 months. Analytics cookies expire after about 13 months.

We will only keep data for longer, restricted, if the law requires it or to establish, exercise or defend legal claims, and only for the corresponding period.

9. What happens when you delete your account

You can delete your account in the app (Account → Delete account) or by email; the steps are in Delete your account. When you do:

• Your login account, email address, profile name, photo, notification tokens and preferences are erased.
• In groups you share with other account holders, your member entry stays as a member “without an account” under the name the group gave it (or “Ex miembro”, Spanish for “former member”), together with its expenses and payments, so everyone else’s balances still add up. That entry is no longer linked to your account.
• Groups where you were the only account holder are deleted entirely, including their receipt photos.
• Data stored on your device (offline copy and preferences) is removed from your browser or system settings by clearing the site’s or app’s data.

10. Your rights

You can exercise these rights at any time:

• Access: find out what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data. The quickest way is to delete your account.
• Restriction: ask us to stop using your data while a complaint is being resolved.
• Portability: receive your data in a structured, commonly used format. You can export your groups to CSV from the app or ask us for a copy.
• Objection: object to processing based on our legitimate interest.
• Withdraw consent for analytics (with “Cookie preferences”) or notifications (by turning off the permission), without affecting earlier processing.

Write to [email protected] from the address linked to your account and tell us which right you want to exercise. We reply within one month, extendable by two further months for complex requests, in which case we will let you know. If we cannot verify your identity, we may ask for more information. It is free, except for manifestly unfounded or excessive requests.

If you believe we have not handled your data properly, you can lodge a complaint with the data protection authority of the country where you live, work or where the alleged infringement took place. If you are in the European Union, you can find yours at edpb.europa.eu.

11. Minimum age

Cuadra is intended for people aged 16 or over. If you are under 16, please don’t create an account. If we learn that an account belongs to someone under 16, we will delete it. If you are a parent or guardian and believe a child in your care has given us data, please contact us.

12. Security

• All communications are encrypted with TLS (HTTPS).
• Per-group access control: the server checks that you belong to a group before showing or changing its data.
• Receipt photos are served through signed links that expire, not through public addresses.
• Data minimization: we only ask for what is needed, strip photo metadata and don’t store passwords.
• Regular backups with 30-day rotation.

No system is infallible. If a security breach affects your data, we will notify the supervisory authority and, where the law requires it, you as well.

13. Automated decisions

We don’t make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we don’t profile you. Balances and the “who pays whom” calculation are arithmetic on the group’s data that any member can check.

14. Future advertising

Cuadra shows no advertising today. If we introduce it in the future, we will update this policy before switching it on and ask for your consent where the law requires it, for example to use your Android device’s advertising ID or advertising cookies. You will be able to refuse and keep using Cuadra.

15. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version on this page with its update date and, if the changes are significant, let you know in the app or by email before they take effect.

Cookies and local storage

Cuadra uses as few cookies and as little local storage as possible. What is strictly necessary for the service to work doesn’t require consent; analytics does. We don’t use advertising cookies.

How to change your choice

The first time you visit Cuadra we ask whether you accept analytics. To change your choice:

• Press Cookie preferences: we forget your choice, delete the analytics cookies and the notice appears again.
• Or clear the data for cuadra.dolarflashve.eu in your browser settings. This also signs you out and removes the offline copy.

Terms and conditions

These terms govern the use of Cuadra. By creating an account or using the service you accept them; if you don’t agree, please don’t use Cuadra.

1. Who provides the service

Cuadra is provided by Jesus Rogliero, an individual resident in Venezuela. Contact: [email protected]. Cuadra is a sister project of DolarFlashVe, which supplies its exchange rates.

2. What Cuadra is

Cuadra is a tool to record and split shared expenses (trips, meals, home or anything else) in dollars, euros, USDT and bolívares, calculate balances and simplify who pays whom. It works in the browser, as an installed app (PWA) and as an Android app. Specific features may change over time.

3. Your account

• You must be at least 16 years old.
• Each account is personal: one person per account. Don’t share it or create accounts on behalf of other people.
• Provide accurate information and keep it up to date.
• Keep your credentials safe. You are responsible for what is done from your account; if you suspect unauthorized access, change your password and contact us.

4. Acceptable use

When using Cuadra you agree not to:

• Post illegal, offensive or defamatory content, or content that infringes other people’s rights, whether in names, notes, items or photos.
• Use invitations, join requests or reminders to send spam, harass or bother other people.
• Access or try to access groups or accounts that aren’t yours.
• Scrape data, overload the service, probe for or exploit vulnerabilities, or interfere with how it works.
• Decompile or reverse engineer the service, except to the extent the law expressly allows it.
• Use Cuadra for unlawful activities such as fraud or money laundering.

If you find a vulnerability, please write to [email protected] and don’t disclose it until it has been fixed.

5. Your content

What you create in Cuadra (groups, expenses, notes, photos) remains yours. You grant us a limited, non-exclusive, royalty-free, worldwide licence to store it, process it, back it up, sync it across your devices and show it to the members of your groups, solely to provide the service. The licence ends when you delete that content or your account, except for what is kept in shared groups for the other members and during the backup cycle, as explained in the privacy policy.

You confirm that you have the right to upload what you upload, in particular receipt photos.

6. Data about other people

You are responsible for the information you enter about other people. Only add people who actually take part in the expenses and would expect to appear in the group, don’t include sensitive data, and act on their requests if they ask you to correct or remove something. More details in Data about other people you add.

7. Exchange rates

• The rates Cuadra shows (the official BCV rate for the dollar and euro, and the Binance P2P rate for USDT) are obtained from those sources through DolarFlashVe and are for information only. They may be delayed, interrupted or wrong.
• They are not financial, tax or investment advice, nor an offer to buy or sell currency.
• Custom rates, and the rates you type when recording a payment, are the responsibility of whoever enters them.
• Check the amounts before you pay. We are not liable for differences resulting from using one rate or another.

8. Cuadra doesn’t move money

Cuadra only keeps the accounts. It is not a payment service, a bank, an e-money institution or a currency exchange: it holds no funds, executes no transfers and doesn’t buy or sell currency. Payments between users happen outside the app, by whatever means they choose; “recording a payment” in Cuadra is just a note. We are not a party to debts between users and don’t mediate their disputes.

9. Users in Venezuela

Cuadra lets you express amounts in bolívares and uses the BCV rate as the official reference; Binance and custom rates are references chosen by the users themselves. Each user is responsible for complying with the exchange, tax (including IGTF where applicable) and any other rules that apply to them. Cuadra does not determine which rate legally applies to any transaction.

10. Offline use and conflicts

Changes you make offline are stored on your device and synced when you’re back online. If two people change the same thing, the last change synced wins; the activity history lets you review and restore edits and deletions. Changes that haven’t synced yet may be lost if you clear your browser data, uninstall the app or lose your device before syncing.

11. Availability of the service

We provide Cuadra “as is” and “as available”. We do what is reasonable to keep it working well, but we don’t guarantee it will be error-free or available without interruption, for example during maintenance or because of provider outages. We may change, add or remove features; if a change significantly affects you, we will give you reasonable notice so you can export your data.

12. Liability

To the extent permitted by applicable law, we are not liable for:

• indirect damages, loss of profits or loss of opportunities;
• decisions made on the basis of the rates or calculations Cuadra shows;
• payments, debts or disputes between users;
• data loss caused by events beyond our reasonable control, including changes that never synced.

Nothing in these terms limits or excludes liability that cannot be limited by law, such as liability for fraud, wilful misconduct or gross negligence, or for death or personal injury. If you are a consumer, you keep all the rights consumer protection law gives you.

13. Price, advertising and paid features

Cuadra is free. In the future we may show advertising or offer optional paid premium features. We will tell you in advance, advertising will be governed by the privacy policy, and we will never charge you anything without your explicit agreement.

14. Suspension and termination

You can stop using Cuadra and delete your account whenever you like. We may suspend or close an account for serious or repeated breach of these terms, when the law requires it, or if it poses a risk to the security of the service or other users. Unless the law or that risk prevents it, we will notify you with the reason and give you the chance to export your data. The effects on your data are those described in the privacy policy.

15. Changes to the terms

We may change these terms. We will publish the new version on this page and, if the changes are significant, notify you in the app or on the website with reasonable notice before they take effect. If you keep using Cuadra afterwards, you will be deemed to accept them to the extent the law allows; if you don’t agree, you can delete your account.

16. Governing law and jurisdiction

These terms are governed by the law of Venezuela. If you are a consumer living in another country, this does not deprive you of the protection of the mandatory rules of your country of residence, and you may bring proceedings before the courts where you live when the law allows it. Before going to court, we invite you to contact us so we can try to resolve the matter amicably.

If any clause is held invalid, the rest remain in force.

Delete your account

• In the app: go to Account → Delete account and confirm. Deletion is immediate.
• By email: if you can’t sign in, write to [email protected] from your account’s address with the subject “Eliminar cuenta Cuadra”. We process it within 30 days.

What is deleted and what is kept without a link to your account: What happens when you delete your account. Step-by-step instructions in Delete your Cuadra account.

Contact

For any question about this page, your data or the service, write to [email protected].