Location

A Wherigo cartridge is a location-based game, so Waypost asks for your location in order to work at all. Your position moves your marker on the map and tells the cartridge when you have entered a zone.

Your live location is used entirely on your device and is never transmitted as you move. It is handed to the cartridge's own code, which also runs on your device, and to the map view. Waypost has no server that receives a position feed.

There is one thing that carries location off the device, and only if you ask for it: a saved game records the trail you walked, so if you sign in and turn on syncing, that trail is uploaded inside the save, encrypted on your device first. Signed out, which is the default, no saved game and no trail is ever uploaded. See Optional account and syncing below.

• While using the app. Standard location access, used to draw your marker and trigger zones while the player is open.
• Background location (iOS "Always", Android foreground-service location). This is optional and exists for one reason: so a cartridge can tell you that you have reached a place while the phone is in your pocket and the screen is off. Without it you would have to walk with the screen on and the app in front. If you decline it, Waypost still works whenever the player is on screen.
• Declining location leaves the player usable for reading a cartridge's text, inventory, and tasks, but zone triggers that depend on where you are will not fire.

You can change or revoke either permission at any time in your device's system settings, and Waypost will keep running with whatever you have granted.

Cartridges and saved games

You supply cartridges yourself, by picking a .gwc file off your own device, sharing one into the app, or opening one the Wherigo Solver handed over. Signed out, which is the default, cartridges are never uploaded. They are parsed and run on your device, and only the optional account described below and the share feature described at the end of this section ever send one anywhere.

Your progress, saved games, and completion codes are stored locally in the app's own storage. Unless you choose to sign in and turn on syncing, they stay there and nowhere else: uninstalling the app, or clearing site data in the web player, removes them. What signing in changes is described under Optional account and syncing below.

If you use the player's share feature to hand a cartridge to another device, that one cartridge is uploaded to a short-lived slot on wherigo-share.cachesleuth.com, a CacheSleuth-operated Worker, so the other device can collect it. This only happens when you explicitly share, and the slot is short-lived by design.

Maps

Waypost does not use a conventional tile server, which matters for privacy: with ordinary map tiles, the provider sees a stream of requests describing everywhere you pan and zoom. Instead the player downloads a map pack (a Protomaps PMTiles archive) for a region you choose, and renders it on your device from that file.

Map packs are fetched from protomaps-proxy.cachesleuth.com, a CacheSleuth-operated proxy that exists only to make the Protomaps build service reachable from a browser. It sees the region you asked for at download time, not where you subsequently go. Once a pack is on your device, panning the map during a cartridge generates no network requests at all. Map data is © OpenStreetMap contributors, via Protomaps.

"Open in Maps" style links (Apple Maps, Google Maps) are plain links. Nothing is sent to those providers unless you tap one, at which point their own privacy policies apply.

Notifications and haptics

Waypost uses local notifications only: messages the app schedules on your own device so a cartridge can get your attention while the screen is off. There is no push service, no notification server, and no device token. Nothing about a notification leaves your phone. Haptic feedback (the buzz on a zone entry or a dialog) is likewise purely on-device.

Network connections the apps make

Waypost is built to work with no signal, since that is usually where cartridges are played. Everything it needs to run is inside the app. The complete list of connections it can make:

• Update check. The app periodically fetches a small signed manifest from i.cachesleuth.com to see whether a newer version of the player is available. The request carries nothing about you or your cartridges beyond the ordinary details any web request includes (your IP address and browser identification).
• Map packs from protomaps-proxy.cachesleuth.com, when you download one, as described above.
• Cartridge sharing via wherigo-share.cachesleuth.com, only when you use the share feature.
• Account sign-in and syncing, via sync.cachesleuth.com and waypost-sync.cachesleuth.com, and only if you sign in. Signed out, neither is contacted at all. What travels there, and in what form, is described under Optional account and syncing.
• Links out to the website. Tapping a link that belongs to the wider CacheSleuth site (the header, footer, or a related tool) opens www.cachesleuth.com in your system browser, where the main site privacy policy applies.

On Android, the app also requests permission to install packages. This is used solely to install its own signed update when you accept one; it is never used to install anything else.

No analytics, no tracking

The apps contain no analytics SDK, no advertising, no third-party trackers, and no crash-reporting service. Waypost's iOS privacy manifest declares no tracking and no tracking domains. The data types it declares are the three the optional account uploads when you are signed in and syncing: precise location (the trail inside a saved game), a user ID (your account username), and other user content (cartridge files, saved games, and the cartridge-name index). All three are declared for app functionality only, and none of them for tracking.

Waypost has an optional account, described in the next section. Signed out, which is the default, nothing on this page changes: no account exists, nothing is uploaded, and the player never contacts the sync service. The CacheSleuth notes drawer and its cloud sync, described on the Notes page, are part of the shared site layout and are still not reachable inside the apps, and signing in to Waypost does not fetch or store your notes.

One difference for the web player: because it is served as part of the CacheSleuth website, the cookieless Cloudflare Web Analytics described on the main privacy page applies to visits to /tools/wherigoplayer/. It is injected by Cloudflare when the page is served, so it is not present in the iOS or Android app packages at all.

Optional account and syncing

You can sign in to a CacheSleuth account, the same one used by My Puzzle Texts and the Cache Builder, so the cartridges you play and the games you save can move between your devices. It is entirely optional. Waypost plays cartridges with no account at all, and that is what it does until you choose otherwise.

Creating an account happens on the website, not in the app. Waypost only signs in.

What is uploaded, and what it looks like to us

When you are signed in and syncing, three things are stored on CacheSleuth's servers, and all three are encrypted on your device before they are sent:

• The cartridge files you have played.
• Your saved games, which include the trail of where you walked while playing.
• A small index: the cartridge names and when you last played them, plus the player name you type at the start of a cartridge, if you set one.

The key is derived from your account passphrase and never leaves your device, so the sync service holds ciphertext it cannot read. It is a one-way derivation of your account key, which means it also cannot read your notes.

Cartridges are stored under an identifier that is derived from the cartridge, keyed to your account, and meaningless to anyone else. We deliberately do not store the cartridge's own ID: which cartridges you are carrying is a list of the places you are about to walk to, and it is not something the server has any business knowing. A consequence worth stating plainly: we cannot tell that two people have the same cartridge, and we do not want to be able to.

What the server does unavoidably see is the ordinary shape of a request: your IP address, roughly how large each item is, and when you synced.

How much is kept, and for how long

An account holds up to 20 cartridges or 50 MB of cartridge files, whichever comes first. Past that, the least recently played cartridge's file is removed to make room. A cartridge larger than 10 MB is kept only on your device and never uploaded; you can still play it, and you will be told that loading it again on another device means loading the file yourself.

Saved games are never removed to make room and do not count toward that limit. That is deliberate: losing a cartridge file means loading it again, while losing a walk means losing the walk. A save can outlive the cartridge file it belongs to, and reattaches by itself when you load that cartridge again.

An account not used for 18 months is deleted automatically, along with everything in it, on the same clock as the rest of your CacheSleuth account. You can delete your synced cartridges and saves at any time with Delete synced data in the account panel in the player. It leaves the copies on your device alone, and it also signs that device out, so nothing is uploaded again until you sign in. Deleting your CacheSleuth account removes them too.

Two devices, one walk

If the same cartridge is played on two devices, the two walks cannot be merged, so Waypost does not try. It tells you the other walk exists, when it was last played, and asks which one you want to keep. Nothing is discarded without you choosing it.

Signing out of Waypost removes the account link from that device. Your cartridges, saves and player name stay on the device, and the copies in your account are left alone.

Children

Waypost is not directed at children. Signed out, which is the default, it collects nothing at all from anyone, including children. The only thing that changes that is the optional account, which collects exactly what the account section above describes and nothing more, and an account can only be created on the website, not in the app.

Contact

Questions about Waypost and your data? Use the contact page.