EKO QUESTLegal
Privacy Policy
The short version.
You can play Eko Quest as a guest without giving us any personal data. If you create an account, we keep only what we need to run the game, keep it fair and — when cash hunts open — pay prizes. We don't sell your data, we don't run cross-site advertising tracking, and we never upload the photos you take in the game. Ads in the game are counted anonymously.
You have rights under the Nigeria Data Protection Act 2023, including the right to see, correct and delete your data. Write to contact@ekoquest.io.
- Who we are
- What we collect
- Why we use it and our legal bases
- What other players can see
- Who we share it with
- International transfers
- How long we keep it
- Cookies and storage on your device
- How we protect it
- Your rights
- Children
- Automated checks
- Changes to this policy
- Contact us
1. Who we are
Eko Quest (the game at play.ekoquest.io, this website and our API at api.ekoquest.io) is operated by Trigonal Technologies, a company registered in Nigeria with RC number 1808824, whose registered office is at Suite 112-114 Adamawa Plaza, Central Business District, Abuja ("we", "us"). We are the data controller for the personal data described in this policy.
For anything about your data, contact us at contact@ekoquest.io (subject "Privacy request"). Our Data Protection Officer can be reached at the same address.
2. What we collect
If you play as a guest
We don't ask for your name, e-mail or phone number. Your progress (your explorer, items, Ekodex and settings) is saved in your own browser. To run the game we still process some technical data, described under "Every player" below.
If you create an account
- Sign-in details. You sign in with Google or with your e-mail address (password or a one-time code). Our sign-in provider, WorkOS, handles this. We receive your account ID, the name on your account and your e-mail address. We store your account ID and name; we use your e-mail address only to sign you in and, for staff accounts, to check admin access — we don't keep it in our game database.
- Nickname and look. An optional nickname (2–24 characters) and a small description of your explorer's appearance. Without a nickname you appear as "Explorer" plus a short code.
- Age and terms. Your confirmation that you are 18 or older, the version of these terms you accepted and when, together with a one-way scrambled ("hashed") form of your IP address at that moment.
- Game records. Your level and achievements, leaderboard entries, cash hunt sessions and results, and any coupon codes you claim from in-game deals.
- Street Justice (optional). If you choose to take part in the player court, your record, cases, votes and the short messages you write there (up to 80 characters).
If you take part in cash hunts and withdraw prizes (when cash hunts are open)
- Your phone number, which we verify with a one-time code sent by text message through our SMS provider, Termii. We don't store the number itself — only a keyed fingerprint that stops one person from holding several accounts, and the fact that it was verified.
- Your bank details for withdrawals: bank, account number (stored encrypted), the last four digits, and the account holder's name as reported by the bank. We compare that name with the name on your Eko Quest account to stop payments going to someone else.
- Your prize and payment records: amounts, fees, transfer references and their status.
- Your in-game position during a hunt, sent every few seconds while you take part, so we can check that winners played fairly (no teleporting or impossible speed).
Every player
- Technical data: your IP address (used briefly to protect the service from abuse and stored only in hashed form), your browser and device type, and the country your connection comes from (cash hunts and withdrawals are only available from Nigeria; we don't store the country).
- Anonymous measurement: counts of when an in-game advertisement or deal was actually on screen (at least half of it, for at least one second), when a place in the city was visited and when a photo was taken. These are counted without your name and combined into daily totals. Advertisers only ever see totals.
- Crash and error reports: when the game breaks, a short technical report — the error, the game version, the graphics setting and coarse device details such as browser version, memory class and network type. It contains no name, e-mail or location. We collect these from a sample of sessions, unless you've turned off usage statistics.
- Usage statistics (only with your permission): how long sessions last and which features are used. You can say yes or no in the game, and change your mind any time in Settings → "Share anonymous usage stats".
- Your position in the game world while you play with other players online, so they can see your explorer near them (see section 4).
GPS mode (optional, off by default)
If you switch on GPS mode, the game moves your explorer to your real location using your device's location service. Your raw GPS readings stay on your device, but because your explorer then stands where you are, your in-game position becomes your real position — and that position is used in the same ways as any in-game position: for cash hunt checks, for showing your explorer to nearby players online, and for finding nearby in-game deals. Only switch on GPS mode if you're comfortable with that. You can switch it off any time in Settings, and you can hide yourself from other players (section 4).
What we don't collect
- Photos you take with the in-game camera stay on your device. We never upload them. If you share one, you choose where it goes.
- We don't collect identity documents, BVN or selfies.
- We don't record voice or video, and we don't read your contacts.
3. Why we use it and our legal bases
The Nigeria Data Protection Act 2023 ("NDPA") requires a lawful basis for each use of personal data. These are ours:
| What we do | Data used | Legal basis |
|---|---|---|
| Run your account and save your progress across devices | Sign-in details, nickname, game records | Contract (providing the game you asked for) |
| Run cash hunts, check winners played fairly, pay prizes | Hunt position, phone fingerprint, bank details, payment records | Contract; legitimate interests (preventing fraud) |
| Verify age and eligibility for cash features | Age confirmation, country of connection, phone verification | Legal obligation; contract |
| Keep the game safe from bots, cheating and attacks | Hashed IP, device type, Turnstile bot check, fraud signals | Legitimate interests (security and fair play) |
| Count ad and deal views for advertisers, as totals only | Anonymous measurement events | Legitimate interests (funding a free game) |
| Fix crashes and bugs | Crash and error reports | Legitimate interests (keeping the game working) |
| Understand how the game is used | Usage statistics | Consent — you can withdraw it any time |
| Show you to other players, leaderboards and live hunt pages | Nickname, look, level, in-game position (live only) | Contract; legitimate interests — with controls to opt out (section 4) |
| Meet our legal duties: tax, accounting, consumer-promotion and anti-fraud rules, regulator requests | Payment records, prize winner records | Legal obligation |
| Reply to you when you contact us | What you send us | Legitimate interests; contract |
Where we rely on legitimate interests, we've balanced them against your rights and kept the data to the minimum, mostly in hashed or anonymous form. You can object (section 10).
We don't sell your personal data, and we don't use it for advertising outside Eko Quest.
4. What other players can see
- Online, in the city: other players near you see your explorer, nickname (or "Explorer" plus a code; guests show as "guest"), look and level, live while you play. Your position isn't stored. You can turn this off in Settings → "Show me to other players", and you can hide any player from your own screen.
- Leaderboards: your nickname and score appear on leaderboards. Turn this off in your account settings and you'll be left off weekly and all-time boards and shown as "Hidden explorer" on hunt boards.
- Live hunt pages and share cards: when a cash hunt is broadcast, viewers see players' nicknames and rough "warm/hot" status, delayed by 30 seconds — never positions or distances. Winners are shown with their prize. If you've opted out of leaderboards you appear as "A player" or "An explorer".
- Street Justice: if you join, your record and the messages you post in a case are visible to the players involved.
5. Who we share it with
We share personal data only with service providers who process it for us under contract, and only what each one needs:
| Provider | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosts the game, website and servers; bot protection (Turnstile); stores our database | All data we hold, as our host; your IP address for security |
| WorkOS | Sign-in and account security | Your sign-in details, IP address and browser type when you sign in |
| "Sign in with Google" (only if you choose it) | What Google shares at sign-in: your name and e-mail | |
| Termii | Sends verification codes by text message | Your phone number and the code |
| Paystack (and, if we add it, Monnify) | Bank account checks and prize transfers | Your bank, account number, account name and the amount |
| Our payout server host | A fixed-address server that passes payout requests to the payment provider | The same payout details, in transit |
| Open-Meteo | Real Lagos weather in the game | Nothing about you — our server asks for Lagos weather; if that fails your browser asks directly, which shows them your IP address |
| Google Fonts | Some of the lettering in the game | Your IP address and browser type when the game loads its fonts |
Services you turn on yourself. Some optional features connect your browser directly to another service, under that service's own privacy policy:
- Google Maps features (3D city tiles, Street View, place search, live traffic) work only if you paste your own Google key into Settings. Google then receives the map areas you view or search for and your IP address.
- Place search asks OpenStreetMap's Nominatim service for the words you type, plus "Lagos".
- Live radio, where available, streams from the radio stations' own servers and the radio-browser.info directory.
- Sharing to WhatsApp, X, Facebook or Telegram opens that app with a link you chose to share.
We also disclose data when the law requires it — for example to the Nigeria Data Protection Commission, the Federal Competition and Consumer Protection Commission (winner lists for registered promotions), tax authorities, or the police with a valid request — or to protect players and the game from fraud. If our business is sold or reorganised, your data may pass to the new owner under this policy.
6. International transfers
Some of our providers (including Cloudflare, WorkOS and Google) process data outside Nigeria, mainly in the United States and the European Union. When data leaves Nigeria we rely on the safeguards the NDPA allows, such as contractual protections in our agreements with those providers and their security commitments. You can ask us for details.
7. How long we keep it
| Data | How long |
|---|---|
| Account, nickname, game records | While your account exists. When you delete it, we delete or anonymise it (below). |
| Cash hunt position tracks — flagged or blocked sessions | 30 days |
| Cash hunt position tracks — winners | 180 days (for disputes and audits) |
| Live hunt position data | 2 days after the hunt ends |
| Rejected prize claims | 90 days |
| Crash and error reports | 90 days after the error was last seen |
| Anonymous measurement counts | Kept as daily totals; the short-lived data used to avoid double-counting is deleted within 26 hours |
| Who's online right now | About 2½ minutes |
| Prize, wallet and payment records | As long as the law requires for financial records (generally 6 years), in anonymised form after you delete your account |
| Database backups | Rolling 30-day restore points, plus weekly backups kept for about 12 weeks |
8. Cookies and storage on your device
We don't use advertising or cross-site tracking cookies. The full list, and how to change your choice, is in our Cookie Policy. In short, we use:
- Sign-in cookies (strictly necessary, only if you sign in):
eq_rtkeeps you signed in for up to 30 days;eq_asprotects a sign-in in progress for 10 minutes;eq_authsimply notes that you're signed in on this browser. - Browser storage for your saved game and settings, your choice about usage statistics, offline queues, deal codes, multiplayer settings and your block list, and caches that make the game load faster. Photos you take are stored in your browser too. If you paste your own Google key, it's stored here and sent only to Google.
- Third parties: the sign-in page (WorkOS), the bot check (Cloudflare Turnstile) and, if you use them, Google sign-in and Google Maps may set their own cookies.
You can clear this storage in your browser settings. Doing so as a guest erases your saved progress on that device.
9. How we protect it
- All connections use HTTPS.
- Bank account numbers are encrypted (AES-256-GCM); phone numbers are stored only as keyed fingerprints; IP addresses are stored only in hashed form.
- Staff access is limited to named administrators, protected by two-factor authentication, and every admin action is recorded in an audit log.
- Payment provider keys live only on a separate payout server with a fixed address that our payment provider recognises.
No system is perfectly secure. If a breach puts your rights at high risk, we'll tell you and the Nigeria Data Protection Commission as the law requires (within 72 hours of becoming aware of it, for the Commission).
10. Your rights
Under the NDPA you can:
- ask what personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of it, including where we rely on legitimate interests;
- receive your data in a common, machine-readable format;
- withdraw your consent at any time (for example, to usage statistics) — this doesn't affect what we did before;
- not be subject to a decision based solely on automated processing that significantly affects you (section 12);
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Deleting your account. You can delete your account yourself in the game (Account → Delete account). We then delete your bank details and hunt position tracks, remove your name, nickname and phone fingerprint, and anonymise the records we must keep (such as payment records). We also ask our sign-in provider to delete your sign-in account. A positive wallet balance must be withdrawn first, or you can choose to give it up.
For any other request, e-mail contact@ekoquest.io. We'll reply within 30 days and may ask you to confirm your identity first.
11. Children
Accounts, cash hunts and withdrawals are only for people aged 18 or over. If you're under 18, you may play only as a guest, with your parent's or guardian's permission. We don't knowingly collect personal data from children; if you believe a child has created an account, tell us and we'll delete it.
12. Automated checks
To keep cash hunts fair, our systems automatically check claims and withdrawals — for example for impossible movement speed, the same bank account on several accounts, or a bank name that doesn't match. These checks can hold a claim or send a withdrawal for review. A member of our team reviews held withdrawals before a final decision, and you can ask us to look again by contacting us.
13. Changes to this policy
We'll update this policy when the game or the law changes. If a change matters, we'll tell you in the game before it takes effect. The version and date at the top show which policy applies.
14. Contact us
Trigonal Technologies, Suite 112-114 Adamawa Plaza, Central Business District, Abuja, Nigeria · contact@ekoquest.io