Waka Quest — privacy

Updated 13 November 2026

← Back to Waka QuestTerms of use

Who we are

Waka Quest is a product of Legacy Technology N.V., Soekwastraat 45, Paramaribo, Suriname, registered with the Chamber of Commerce and Industry under number 176330. The team of Legacy Technology N.V. makes and runs the app. Legacy Technology N.V. is responsible for the data described in this statement. Questions: info@waka-quest.com.

Without an account (free play)

Your progress, answers, notes and photos stay in your browser on your own device, as do choices such as your language, whether you've read the rules of play and whether alerts are on. None of this is sent to our servers; only anonymous counts, and what you read below under push notifications, collector cards, Golden Tickets and competitions (such as a team photo). The app uses your location only on your phone: to see whether you have discovered a monument and are standing in front of it, how far you still have to walk, and to suggest your evening. Your location stays on your phone, with two exceptions: when you take part in a competition, a rounded location goes along with each answer, and your place when you tap “Hulp nodig” (help) yourself (see Competitions); and for a Golden Ticket the app sends your place at a monument, a firefly and the business to be checked, without us keeping that place (see Golden Tickets).

When the app opens, your browser loads fonts from Google Fonts, exchange rates from ExchangeRate-API and some monument photos from their original websites (such as Wikimedia Commons). Like any website, those services see your IP address.

Outside the city centre, the app shows a map of all of Suriname. The pieces of that map come from our own storage at Cloudflare (Cloudflare, Inc.). Like any website, Cloudflare sees your IP address and which piece of the map your browser loads. Your location is not sent for this, and we keep none of it.

Anonymous usage statistics

To improve the app and its questions, the app counts per day how often things happen, without your name, account, location or any number of you or your phone: how often the app is opened and in which language, whether it is installed on the home screen, how many walks start and finish, how a walk starts (from your location, chosen yourself or at random) and how long it is, which parts are used (such as the route, the passport, sharing, pausing and sun mode), how often the app runs into an error, how often a monument is visited (by GPS or by hand) and for how long, whether its story is read or listened to, and per question how often it is answered right or wrong, which answer is chosen and whether the hint was used, and how often a partner's offer is seen or tapped. If you put an offer on your map as a Waka token, we also count that, whether you chose "take me there" and whether you arrived (within about 50 metres). Your location itself stays on your phone. In Waka Quest by night, the night mode, we also count how often it is opened and, per business, how often someone chose “walk there” and arrived, how often an evening (“My evening”) is planned, started and completed, how often the evening suggestion and the best order are used and which time is chosen, and per event how often it is seen and tapped and how many guest-list tickets were made and cancelled. By day we count in the same way how often Shopping & food and Your day are opened, how often a business is added to Your day, how often a day is started and completed, how often the day suggestion and the best order are used and how often someone carries on from Your day into Your evening; for an offer in Shopping & food we also count whether someone chose “walk there” and arrived. If you search at night, we count the search word anonymously: only the word and whether it found anything, with no link to you (per phone a word counts at most once every 10 minutes); a word nobody has searched for a year disappears. Around free play (the "x/5 free" counter and the "Your free game" overview) we also count only anonymous numbers per day. In competitions we count per day how many competition routes start, how often a team is chosen, how many friends competitions are made and how often the result or the competition certificate is opened. Which businesses are in Your day or Your evening stays on your phone, unless you share your day or evening with Go out together (see below); Your day disappears at midnight, and whether you carried on from Your day into Your evening today is remembered by your phone for that day only. Whether you confirmed that you are 18 or older is only remembered by your own phone; we do not see it. If you type a wrong answer in a look or count task, we keep that answer without any other data, so we can add missing correct answers. The practice walk only counts as a start. To see whether people come back, your phone remembers the week you first opened the app (and, if you request a reservation, the week you first did so); each week we then count anonymously how many phones from that starting week opened the app again and which parts they used that week (such as a walk, night mode, cards, Samen op stap, a competition, a style or a reservation), each part at most once per week per phone. That starting week stays on your phone and cannot be linked to you. Only the administrator sees these counts.

On the link page waka-quest.com/links we also count per day, anonymously, how often the page is opened and how often each button is used (the app, WhatsApp, Instagram, Facebook, email, language, style, night mode), and whether a visit came through a QR code, Instagram, Facebook or the app. Nothing about you or your phone is kept: no name, number, internet address or time.

When a business applies as a partner (waka-quest.com/doe-mee, only with a Google account), we keep the email address of that account and what is in the form: by day, at night or both, the name and kind of business, the address or neighbourhood, the name of the contact person, the phone number and, if filled in, the email address, the opening hours and a remark, with the language and where the visit came from. We use this only to call the business or send a WhatsApp about Waka Dag or Waka Nacht and to make the partner page together. Only the administrator of Waka Quest sees it, and after 6 months the application is deleted automatically; if the business becomes a partner, the details are then kept in the partner administration, and the account gets access to the partner portal of that business.

Alerts and reminders

If you turn on monument alerts, the app compares your location with the monuments on your phone. That isn't sent anywhere either. A reminder for later is a calendar file that you add to your calendar yourself. If you choose "Google Calendar", Google Calendar opens with the name of your next monument and the time; Google's privacy policy applies to that.

Protection against abuse

When the app loads the list of partner businesses, and when you sign in or report a problem, the app uses Google reCAPTCHA (Fraud Defense) to check that the request really comes from Waka Quest. To do so, reCAPTCHA collects information about your device and browser; Google's Privacy Policy and Terms of Service apply. You don't have to click anything.

For Golden Tickets too, the server uses reCAPTCHA to check that the request comes from the real app. To slow down abuse, the server briefly counts how many requests come from one internet address; it keeps that address in memory for at most an hour, only as an unreadable code, and never writes it down. The same applies to competitions and guest-list tickets.

Partner businesses

Some businesses along the way are Waka Quest partners; they pay to appear as a stop and are marked "Partner". During a real walk the app counts, per partner and per day, how often it appears in a route, how often someone navigates to it, visits it or does the task, and the total of the amounts players enter themselves. This is anonymous: no account, no location and no other information about you. Only the administrator sees these counts.

The app keeps the same anonymous counts for the other businesses along the way, so we can show them what Waka Quest brings them. Until 1 December 2026, a few of those businesses get some extra attention in the route planning each week.

Passes and vouchers

If you activate a code from your hotel, cruise or tour operator, our server activates the pass. With that code we store the time of activation, a random number for your device (so the code works on one phone), your name and account if you are signed in, whether you scanned the code (QR) or typed it, and your language. This is kept in a shielded part that only the administrator reads. Anyone who knows the code only sees whether it has been used and a fingerprint: an unreadable code made from the code and your device number. This lets the administrator see how many codes have been used. Your copy of your data and the deletion of your account include this part (see Deleting your data). Your pass itself is kept on your phone.

If you buy a pass at a partner business, we keep with the code which business sold it, when, the type of pass and the price at that moment, plus a key for the staff member (not their email address). We keep nothing about you as the buyer: no name and no payment details, because you pay the business directly. Only when you activate the pass does the information above apply.

Staff of partner businesses

If you work at a partner business and sign in to the partner portal, we use the email address of your Google account, or your business email address if you sign in with an email link, to give you access; the administrator sets that address (at most 5 per business). If you choose to sign in with email, we send the sign-in link from info@waka-quest.com to that address. If you use “Vertaal naar alle talen” (translate into all languages) in Berichten, our server sends the title and text of the message to Google Cloud Translation to translate them. If you request a cooperation on behalf of a business, we keep the trade name, KKF number and address of the business, your name, job title and email address, the time, the IP address and browser of the request, and which version of the agreement you accepted. We need this to conclude the agreement and to be able to prove it. We keep it for as long as the cooperation runs and five years after that. Only the administrator sees it, and you in your own copy. The data is stored in our database with Google Firebase in the United States.

Push notifications

Push notifications are off until you turn them on yourself under the bell. If you do, Google Firebase Cloud Messaging gives your browser a push code. We keep that code and your language in our database in the United States, without a name, account or location, so we can send you messages. The notification itself travels through your browser's push service (Apple's on an iPhone). We delete the code when you turn notifications off, when your phone or browser no longer knows it, or after 9 months without using the app. We only send a notification for a real Waka Quest message. This can also be an event of a partner business: everyone with notifications on then gets the same message in their own language; we do not use any data about you for it.

Collector cards

The cards you earn are kept on your phone. With an account we also keep them with your account, so you have them on every phone; they disappear when you delete your account. The app counts anonymously how many cards are earned, saved or shared, and how many visitors arrive through the QR code on a shared card or a shared practice walk certificate. A Waka Pioneer card from the beta test shows the seat number of your beta code. The neon animals and fireflies you earn in the evening are kept in the same way as your cards. In case of abuse (for example a copied or resold ticket) the administrator can withdraw a Golden Ticket and, for players with an account, withdraw a card or reset the whole collection. What happened, when and why is kept with your account; it is in your copy of your data and goes when you delete your account.

Golden Tickets

When you finish the task at a partner business that offers a Golden Ticket, our server creates the ticket. You need to be signed in for this (one ticket per person). The ticket opens after 4 monuments in a day, or in the evening after fireflies at 3 businesses. So the server keeps which monuments and fireflies you did that day or night, with the time, with your account and with a random number of your device; also when you got your last Golden Ticket (one by day and one in the evening per 3 days). We delete this after 7 days. At a monument, a firefly and the business the app sends your place (latitude, longitude and accuracy) and how long ago you arrived; the server checks that you were really there (at the business within 150 metres, at most 3 hours ago) and does not keep that place. The ticket keeps the ticket number, the business, a random number of your device (so you don't get a new ticket at the same business every time), your account, a secret code that makes the ticket's QR code keep changing (so a screenshot does not work), when the ticket was earned and until when it is valid, and when and by whom (the business or you) it was used. No name and no location. The business and the administrator only see numbers. A business that scans tickets itself uses a PIN that we keep only as an unreadable code; the staff can let their own phone remember it. After a right PIN the staff member’s phone gets its own key, valid for 30 days; of that too we keep only an unreadable code. Wrong PINs are counted for 15 minutes per ticket, per business and per key, without an internet address. For the daily maximum the server counts per business how many tickets were made that day, without any data about you; we delete those counts after 7 days. We delete a ticket at the latest 12 months after it stopped being valid; the anonymous numbers per business remain.

Guest-list tickets

When you put yourself on the guest list of an event, our server makes the ticket. For this you need to be signed in with Google (a guest account from Go out together does not count). It keeps the ticket number, the event, the business, how many people it is for, your account (the ticket is linked to your account: you get one ticket per account per event and can cancel it on any device with that account), a random number of your device, when you signed up, and when it was scanned at the door. If notifications are on, we also keep the link to your push code with your ticket, so we can tell you when the event moves or is called off. No name and no location. Per event we count how many places are taken and how many people came; anyone can see those numbers in the app (numbers only), and the administrator and the business use them. If you cancel, we delete your ticket at once. As with Golden Tickets, the server checks with reCAPTCHA that the request comes from the real app. With an account, your ticket travels to your other phones. We delete a ticket at the latest 12 months after the event; the anonymous numbers per event stay.

Go out together

If you reserve or book at a participating business (a table at a restaurant, a treatment at a spa or wellness centre, or a place on a tour), we keep your reservation in our database in the United States: the business, what you book, the date, the part of the day and the time, the number of people, an optional group name, for a table also the occasion and dietary needs (numbers only), and your name, phone number and optionally your e-mail and note. You need to be signed in with Google for this. Only the staff of that business (with a Google account or email address we set up for the business) and the administrator see your contact details; the business calls you to confirm the reservation. Your name, phone number, e-mail and note are deleted 30 days after the date (or 30 days after a decline or cancellation); after that only the numbers remain. If notifications are on, we also keep the link to your push code with your reservation, for messages about it (such as a confirmation, another time, an upfront payment or no answer from the business); it is deleted together with your contact details. Waka Quest handles no payments: any upfront payment is arranged directly with the business. Whether, and from how many people, a business may ask an upfront payment, you see before you reserve. If you delete your account, your contact details are erased at once and a reservation still to come is cancelled; if you had already paid an upfront payment, the business sees that the refund still has to be settled. If the business asks for an upfront payment, you can send a photo or screenshot of your proof of payment. Only that business and the administrator see it; it is deleted together with your contact details. For the staff of a business we keep the Google or email address they sign in with, as long as the business receives reservations through Waka Quest. If a staff member turns on notifications in the Zaakportaal, we keep the link to that phone's push code and the address that turned them on, until they are turned off. The history of a reservation shows which address confirmed or changed something; only the business and the administrator see it, and 30 days after the date it only says “staff”. The group name and any notes are deleted at that time too.

If you share your evening with “Go out together”, we keep that evening in our database in the United States: the businesses, the start time, the name you show the others, your language and, if notifications are on, the link to your push code for the reminders. For this you need to be signed in. People who walk along do not need to sign in; the app then makes an anonymous account. Of each person walking along we keep the name they give, their language, when they joined and, with notifications on, the link to their push code. Their phone also gets a random key, of which we keep only an unreadable code; with it they can still leave after signing in with Google. The maker and the people walking along see each other’s names; without the code nobody else can see the evening or the list. We use the push code only for messages about that evening: reminders 2 hours and 15 minutes before, a message when the maker changes, closes or cancels the evening, and for the maker a message when someone walks along or stops (with their name, and after which place, if they say so in the app). If the maker closes the evening or deletes their account, the evening can pass to someone who walks along; they become the maker. The app shares no location. At 06:00 the morning after the evening we delete everything, including an anonymous account that was made only for this evening. If you cancel the evening or stop walking along, we delete your data for that evening at once. We count anonymously per day how many evenings are shared and cancelled, how many people walk along and how many reminders we send.

By day you can share Your day in the same way. We then keep the same data as for a shared evening and the same rules apply, but we delete a shared day at midnight (Paramaribo time) at the end of that day. If the maker takes the group on from Your day into the evening, the day becomes a shared evening with the same code and the businesses of Your evening, and we delete everything at 06:00 the morning after. People walking along who have notifications on get a push message about it; in the app they choose themselves whether to come along.

Competitions

If you take part in a competition, for example a team outing, you use the organiser's team code to join a team and choose a nickname. You can do this without an account; the app then creates an anonymous number for you. In a competition our server checks your answers and keeps the scoreboard. For this we store, in our database in the United States:

Team tasks: when you arrive at a monument of the competition, we store your check-in (the time, the place rounded to about 10 metres, and whether you checked in by hand); in a team vote your vote, in a split which monument you take, and with a hidden treasure whether you found it and the time of your last try (one try per 30 seconds). A team photo (made smaller) is kept on our server and is seen only by your own team and the organiser; in a competition among friends that is the player who started it, who also approves the team photos. If the maker hides a treasure, that place (tapped on a small map or the maker's own place) is kept secret on the server. The places of answers and check-ins are kept apart: nobody can see them, not even the organiser; only the server uses them for fair play.

Who organises: the Waka Quest administrator, an organiser the administrator invites (for example a company's contact person, with the e-mail address they sign in with), or the player who started the competition in the app. An organiser sees nicknames, teams, answers with points and answers that stand out, the progress of the team tasks and the team photos; never your first name, and your place only if you ask for help yourself (see below). If you start a competition yourself, we store with your account when you did (for the free trial and the daily maximum), and the server checks whether your pass is valid.

Free monuments and competition pass: which monuments you did for free is counted only by your own phone; we do not see it. If you start a competition with a competition pass, we keep your account and the competition with that code, as proof that the pass was used.

After the result: you get a team card, badges and maybe a Golden Ticket as a prize. They are in your collection on your phone and, with an account, with your account.

Signing in during or after a competition: if you play as a guest and then sign in with Google, you stay in your team. If your account is new, your guest account simply becomes your account. If it exists already, the app sends a proof of your guest account (a temporary code valid for one hour only), and the server moves your participation to your account: your nickname, team, answers and points, check-ins, vote, team card and any prize ticket. We do not keep the proof.

Pause and “Hulp nodig” (help): the organiser can pause the competition or one team; with notifications on you are told. For this we keep the link to your push code with the competition, and that of an organiser who turns notifications on (for a team photo or a call for help). If you tap “Hulp nodig”, we send your nickname, your team, your note and, if your location is on, your place (accurate to a few metres) with a push notification to the organiser and the maker of the competition, so help can find you. Only they and the administrator see the call for help. In an accident or danger, always call the emergency number first.

The other participants and the big screen only see nicknames, teams and points, never your name or location. The organiser can view and export the results (nicknames, teams and points), and share them within their company or group. 30 days after the competition we delete the locations, first names, team photos, calls for help and push links; 12 months after the competition the whole competition. If you want us to delete your competition data sooner, email info@waka-quest.com.

Reporting a problem

If you report that a monument or shop is closed, damaged or in the wrong place, we store what you choose and write, which place it is about, your language and the time. No account and no location. Only the Waka Quest administrator can read reports.

Giving your feedback

After (or during) a walk you can fill in a short form. We keep your three answers, what you write, your name if you give it, your language, how many monuments you did and the time, and with a beta test code also that code. No location and no account. Only the administrator reads it, and we delete it two years later at the latest.

Reviews of businesses

You can review a partner business you really visited: with the “I’m here” button or after you did the task at the business. This needs a (free) account. With “I’m here”, the app sends your location once to check it (within 30 metres of the business). We do not keep that location: only which business and when, and we clear that after a week.

With your review we keep your stars, the labels you chose, your text, your first name (from your account), your country, whether you are 16 or older and the date. Other players see your stars, labels, text, first name and country, never your surname or e-mail address. We read a text first before it is shown. The business can reply once; we read that reply first too. You can report a review; we keep the report until we have handled it. Your review stays until you change it or delete your account; then it goes, also from the business’s average.

With an account (Google)

If you sign in, we use Google Firebase (Google LLC). We store:

We never store your photos online, except a team photo in a competition, and your location only in a competition (see Competitions). The place the app sends to check a Golden Ticket is not kept (see Golden Tickets); which monuments and fireflies you did is kept for 7 days.

Travel groups: in a travel group, the other members see your first name, how many monuments you discovered, your points, your next stop and whether you've paused. Anyone who has the group code and signs in can join.

Leaderboard: if you join the leaderboard, all players see the nickname you chose and your points for this week and this month. We keep your nickname, a player code, your points per week and per month and which monuments counted, and, to prevent cheating, the place and time of the last monument that counted. You can leave at any time in the app; we then delete this at once, also from the lists. Otherwise we keep it for 13 months, and we also delete it with your account. If you win a prize, we keep it with your account: the card (with your nickname), your place, your points and the pass code. We delete it with your account; a pass code you gave away stays valid.

We use your data only to save your progress and make travel groups work. No advertising, no tracking, no selling of data.

Staying signed in and signing out: you stay signed in on a device until you sign out; for this, Firebase renews a secure key on your phone every hour. With Account → Sign out on all devices we make every key of your account invalid, for example if you lost your phone. A deletion request does this by itself.

Deleting your data

In the app: Account → Delete account. Your account is switched off at once: you are signed out on all your devices and nothing more is stored. We keep your data for 30 more days, so you can restore your account if you change your mind: just sign in again. After 30 days we delete everything for good: your account, your online progress and cards, your place in your travel group (another member takes the group over), and your first name, locations, team photos, team card and badges in competitions. Your points in a competition stay under "Deleted player" (shown in Dutch), so the others' results do not change. A pass code, Gold Ticket or guest-list ticket stays, but without your name or account; the shielded part of a pass (see Passes and vouchers) is also in your copy of your data and loses your name and account when you delete your account. Copies in our backups disappear by themselves, after at most 14 weeks; if we ever restore a backup, we carry out your deletion again. Would you like everything deleted right away, or does it not work in the app? Email info@waka-quest.com and you get a confirmation. To clear what's on your own device, delete the site data for waka-quest.com (or waka-quest.web.app) in your browser.

Of your request we only keep when it came in, when we carried it out and which kinds of data it concerned, so we can show that we carried it out. We erase your first name and e-mail address in it 30 days after the confirmation.

Contact via WhatsApp

You can also send us a message on WhatsApp. The button in the app opens WhatsApp with a first line and, if you have a pass, the type of pass and its code, so we can help you faster; you can edit the message first and you decide whether to send it. Partner businesses can reach us the same way from the Partner portal; there the first line holds the name of the business and the email address. If you write to us on WhatsApp, we see your phone number, your name and profile photo as you set them in WhatsApp, and what you send us. WhatsApp is a service of Meta; WhatsApp's terms and privacy policy apply to sending messages. We use your details only to answer your question, do not share chats outside our team and delete old chats when we no longer need them. Payment never goes through WhatsApp: never ask for or give us passwords, PINs or card details there.

Your rights and contact

You can ask us which data we hold about you (you get it as a file, within a month), and have it corrected or deleted: info@waka-quest.com. You can also complain to the data protection authority of your country.