Privacy Policy

1. Introduction

Welcome to Funtoosh. We are a premium international anonymous messaging platform built on the principle that privacy is a human right. This Privacy Policy describes how Funtoosh Private Technologies Private Limited ("Funtoosh," "we," "us," or "our") handles information when you use our website, progressive web app, and related services (collectively, the "Platform").

We have designed Funtoosh to minimise data collection by default. Our architecture prioritises pseudonymity between users, encryption in transit and at rest, and user control. Funtoosh is not end-to-end encrypted. This policy is structured to be transparent and compliant with the Digital Personal Data Protection Act, 2023 (India), Information Technology Act, 2000, and general international privacy practices including principles from GDPR and CCPA, without claiming certification where none exists.

2. Definitions

• Personal Data: Information that relates to an identified or identifiable individual, even if we do not collect it by design.
• Anonymous Data: Data that cannot be used to identify an individual, including aggregated usage metrics.
• Encryption in transit / at rest: Content is protected by HTTPS/TLS while it travels and is encrypted on disk by our database provider. Funtoosh holds the keys, so Funtoosh can read content where a report, an investigation or the law requires it.
• Wallet Data: Transaction metadata necessary for fraud prevention and regulatory compliance, stored in hashed form.
• Essential Cookies: Small storage items required for theme, language, and secure session functionality.

3. Privacy Principles

1. Data Minimization: We collect only what is essential to provide anonymous messaging, Email OTP login, wallet recharge, paid messaging, and advertisements.
2. Purpose Limitation: Any data we process is used solely for providing, securing, and improving the Platform.
3. Storage Limitation: We retain data only as long as necessary for stated purposes.
4. Security by Design: Encryption, secure headers, and privacy-preserving architecture are default.
5. User Control: You control your profile visibility, blocking, reporting, and account deletion.

4. Data We Collect (Minimal)

4.1 Account Information

• Email address for Email OTP login
• Full name provided during sign-up (optional display name)
• Public key generated locally for encryption

4.2 Usage & Technical

• Coarse region for edge routing (if discovery enabled, opt-in)
• Aggregated, anonymized performance metrics (e.g., message delivery latency) without identifiers
• Wallet transaction hashes for fraud prevention and regulatory records

5. What We Do Not Collect

• Phone number or SIM verification (not required)
• Exact location, contacts upload, or address book access
• Message, question, answer and Result content (encrypted in transit and at rest; readable by us where required)
• Behavioral profiling, advertising trackers, or third-party analytics cookies
• Government ID for messaging (KYC only for wallet payouts above regulatory thresholds where required)

6. Encryption & Security

6.1 Anonymous Messaging

All traffic is protected with HTTPS/TLS in transit. Stored data is encrypted at rest by our database provider (Supabase/Postgres). Keys are held by Funtoosh and its infrastructure providers, not derived on your device — we are not a blind relay.

• Forward secrecy via rotating session keys
• Screenshot detection alerts where operating system allows
• Disappearing messages configurable from 10 seconds to 30 days

6.2 Account Protection

• Email OTP login with 5-minute expiry and rate limiting
• Secure cookies: HttpOnly, SameSite=Lax, Secure on HTTPS
• Security monitoring for abuse detection and spam detection
• Blocking users and reporting users features to enhance privacy protection

7. Cookies & Local Storage

Essential Cookies Only

• funtoosh_theme: Light/Dark/System preference, 30 days
• funtoosh_lang: Language choice EN/HI/ES/FR/DE/AR/JA/PT, 1 year
• funtoosh_server_session: Secure session token for Email OTP login (HttpOnly), 1 year

No tracking cookies. No Google Analytics or advertising pixels. Local storage is used for public key cache, message drafts (local only), and service worker cache for offline support.

8. Data Retention & Deletion

• Account: Username and public key retained until you delete account via Settings → Danger Zone
• Messages: Held in memory relay queue max 24 hours until delivered, then wiped; not stored server-side
• Wallet: Hashed ledger retained up to 7 years where required for fraud prevention and regulatory compliance
• Deletion: Upon account deletion, public key queued for deletion within 7 days, local keys wiped immediately

9. Your Rights

Under applicable laws, you have the right to:

• Access your account data (profile and wallet history JSON export)
• Correction of inaccurate name or email
• Deletion of account and associated data
• Opt-out of optional discovery, read receipts, typing indicators
• Object to processing where applicable and withdraw consent

To exercise rights, contact [email protected]. We respond within 30 days per standard practices.

10. Children's Privacy

Funtoosh is for adults only — users aged 18 and over. Under the DPDP Act 2023 a person under 18 is a Child; we do not knowingly create, operate or process accounts for children, and we do not rely on parental consent for processing children's data. If you believe someone under 18 has created an account, contact [email protected] and we will remove it promptly.

11. International Data Transfers

We use a global edge network for performance, and our database and hosting providers may process data outside India. Content is encrypted in transit and at rest, and access is limited to staff who need it, but it is readable by us. Where required, we implement safeguards consistent with Information Technology Act and international transfer principles. User profiles and discovery preferences are opt-in and region-configurable.

12. User Responsibilities

• Keep your email secure; OTP is single-use and time-limited
• Do not share identifiable information if you wish to remain anonymous
• Respect others' privacy; do not attempt to de-anonymize, dox, or collect personal data of others
• Use blocking and reporting features for unwanted interactions
• Keep device OS and app updated

13. Platform Responsibilities

• Provide a privacy-preserving architecture with encryption in transit and at rest, data minimisation, and limited internal access
• Implement content moderation for reported content, spam detection, and abuse prevention
• Maintain security monitoring, fraud prevention, and rate limiting
• Provide transparent policies and timely security updates
• Honor deletion and data rights requests within stated timelines

14. Changes to This Policy

We may update this policy to reflect Platform improvements, regulatory changes, or security enhancements. Material changes will be notified via in-app banner and posted at /privacy with 30-day notice period where required. Version history will be maintained. Continued use after effective date implies acceptance of updated policy.

15. Contact Information

For privacy inquiries, data rights requests, or grievances:

• Privacy Team: [email protected]
• Security Team: [email protected] (PGP key available at /security)
• Support: [email protected] — Response time 24-48 hours
• Grievance Officer: [email protected] — Per IT Act and DPDP Act requirements, details at /grievance-redressal
• Postal: Funtoosh, Attn: Privacy, D 24/8, Himalay Bhawan, Shatabdi Nagar, Panki, Kanpur, Uttar Pradesh 208020, India — Contact via email preferred

This policy is future-ready and will be supplemented with jurisdiction-specific addenda as Funtoosh expands wallet, premium features, and advertisements globally.