Security

1. Overview

Funtoosh is built with security by design for anonymous messaging, secure login (email + password or Google, with optional 2FA), the wallet, paid chat and calls, Golden Card, Funtoosh Plus, ads, shop, user profiles, blocking and reporting. This page details our security practices, without claiming certifications that do not exist, and guides you on account protection and abuse detection.

2. Encryption

Anonymous Messaging

• Chat text is end-to-end encrypted. Each device holds its own key; the thread key is derived on the device and the server stores only ciphertext. Funtoosh cannot read your chat text, and holds no key that would let it. This is rolling out — messages sent before the rollout on your account, and chats with someone who has not updated, stay on the older server-readable path.
• Encryption in transit: HTTPS/TLS on every connection, with HSTS. Encryption at rest: AES-256 on our database provider, on top of the end-to-end layer.
• What is not end-to-end encrypted yet: chat photos and videos, voice and video calls, Golden Card and Cross-Finger cards (generated by our servers), questions, answers, and Results. Those are encrypted in transit and at rest, and our systems can read them where a report, an investigation or the law requires it.
• No forward secrecy, no disappearing-message timer, no screenshot detection. If one device is compromised, messages that device holds can be read — end-to-end encryption protects a message in transit and on our servers, not a device in someone else's hands.
• Keys live in your browser or app storage on that device. Signing out and clearing site data, or reinstalling the app, removes them: messages encrypted for a device that no longer holds its key cannot be recovered. There is no recovery code yet, so we cannot restore them for you.
• Chat images live in private storage buckets that are not publicly listable.
• Per-chat lock: you can put a PIN on a chat; the server refuses to return that chat's messages until the PIN has been verified.

Data at Rest

• Wallet ledger is append-only, access-controlled and encrypted at rest; balances are changed only inside database transactions. Retained per the Data Retention & Deletion Policy.
• Session cookie is server-signed, HttpOnly, Secure on HTTPS, SameSite Lax, per the Cookie Policy.

3. Privacy Protection

• No phone number required; username is identity; sign in with email + password or Google, with rate limiting on sign-in attempts.
• Logging: we keep operational, security and moderation logs (hosting logs, database logs, moderation events, admin audit log). We do not run behavioural profiling or advertising trackers. Retention periods are listed in the Data Retention Policy.
• Blocking prevents questions, chat, calls, Golden Cards, Cross Finger and discovery; reporting triggers review per the Safety Policy and Content Policy.
• Ads are member-bought placements marked Sponsored, reviewed by the team, with no third-party trackers.

4. Data Security

• Secure headers: HSTS max-age 1 year includeSubDomains preload, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, X-XSS-Protection, Referrer-Policy strict-origin-when-cross-origin per next.config.ts.
• Transport Layer Security: TLS 1.2+ for all connections.
• Wallet: every spend and withdrawal requires your wallet PIN (or biometric unlock on Android); withdrawals are admin-reviewed and capped per day; KYC is mandatory before the first payout, per the Wallet Policy.
• Regular dependency updates and vulnerability scanning for high severity issues.

5. Account Protection

• Sign in with email + password (passwords are stored only as salted hashes) or one-click Google. Rate limiting per IP and email on sign-in attempts.
• Session cookie: server-signed, HttpOnly, Secure on HTTPS, SameSite Lax, valid up to 90 days; changing your password invalidates other sessions.
• Optional 2FA via TOTP authenticator app (no SMS to preserve anonymity) as a second step at login, with one-time backup codes.
• Forgot password: a 6-digit code is emailed to you and expires in 10 minutes; accounts with 2FA also confirm with the authenticator code. Password change from Settings needs your current password (or 2FA for Google-only accounts).
• Rate limits and admin audit logs on sign-in, wallet and withdrawal actions.
• Log Out clears the session cookie and local data on that device.

6. Abuse Detection & Prevention

• Abuse detection: automated filters run over content and metadata (word lists, frequency limits). Matches are logged for human review; no automated filter is presented as accurate or final.
• Spam detection: per-account rate limits on new conversations, questions and confessions (adjustable by the team), plus community reports.
• Fraud prevention: review of unusual recharge, earning and withdrawal patterns, chargeback abuse and self-dealing between accounts, per the Wallet Policy and Payment Terms.
• Content moderation for reported content per Content Policy, Acceptable Use Policy, User Conduct Policy.

7. Spam & Fraud Prevention

• Wallet abuse: earnings farming between linked accounts, recharge with stolen cards, money laundering.
• Discovery spam: Multiple profiles with identical bios to dominate discovery prohibited per Anti-Spam Policy.
• Advertisement spam: unsolicited promotion via questions or chat is prohibited; the only ads are reviewed Sponsored placements.

8. Security Monitoring

We operate 24/7 security monitoring for:

• Unusual login, wallet, and messaging patterns
• Server health, latency, and error rates (anonymized)
• Dependency vulnerabilities and patching high severity issues
• Abuse reports via [email protected] per the Grievance Redressal Policy

Monitoring is privacy-preserving, no message content inspection, only metadata and aggregated metrics.

9. User Safety Education

• Safety tools: Block and report in one tap, message requests, chat lock PIN, Cross Finger off-switch, wallet PIN and limits per the Safety Policy and Trust & Safety.
• Funtoosh is 18+; we do not knowingly operate accounts for anyone under 18 (DPDP Act 2023) — reported under-18 accounts are removed.
• Resources: Mental health helplines at /safety, digital safety guide at /trust-safety, and Privacy Policy guidance.

10. Responsible Disclosure

If you discover a security vulnerability, please report responsibly:

• Email: [email protected] with subject "Responsible Disclosure - [Brief Description]"
• Include steps to reproduce, impact, and suggested fix if known
• Do not access other users data, do not disrupt service, do not publicly disclose before we have had 90 days to fix per industry practices
• We will acknowledge within 48 hours, provide updates, and credit you in our hall of fame with permission (no bounty program currently, but recognition and future reward consideration)

We do not claim ISO 27001 or SOC 2 certification at this time; we follow industry best practices and publish transparency via Transparency Page.

11. User Responsibilities

• Keep your account password and 2FA backup codes secure, do not share your session, enable 2FA where available, keep your device OS updated.
• Use a strong, unique password, and keep the email behind your account secure — it anchors your sign-in and password reset.
• Use blocking users and reporting users for unwanted interactions, not retaliation.
• Do not attempt to bypass security, reverse engineer, or scrape at scale per Acceptable Use Policy.

12. Platform Responsibilities

• Provide encryption, privacy protection, secure cookies, security monitoring, fraud prevention, abuse detection, spam detection, and timely patching.
• Maintain clear Security Page, Safety Policy, Trust & Safety, Transparency Page, and responsible disclosure process.
• Educate users about account protection and safe anonymous communication.
• Respond to security reports within 48 hours and provide fixes within 90 days where feasible.

13. Contact Information

• Security Team: [email protected] — 48h acknowledgment (Mon–Sat, 10 AM – 6 PM IST)
• General Support: [email protected]
• Safety: [email protected] — 24h for safety
• Grievance Officer: [email protected] — 15 days per IT Act, details at /grievance-redressal

Effective Date: September 23, 2026 • Last Updated: September 23, 2026