PRIVACY POLICY
Last updated: 28 October 2026
Foona World is operated by Timbuk2 · Timba2 (Pty) Ltd, South Africa. This page explains what the public signup asks for and how that information is used for city missions.
What we collect
- First name and last name. If you choose Facebook sign-in, Facebook supplies these names through a short-lived server-side login. We do not request your Facebook friends, posts or pages.
- WhatsApp number, country and language.
- If you complete your player profile: your date of birth, what you do (for example student, driver or trader) and the city or suburb where you live. We use your date of birth to check that you are 18 or older.
- Mission material you choose to submit, such as photos, video or location evidence.
- Consent records and limited referral or campaign labels.
- A one-way identifier derived from the request IP for signup rate limiting; the registration service does not store the raw IP.
- A random, cookie-free analytics identifier and coarse device information for the FOONA World signup funnel.
Why we use it
We use this information to create and secure an account, prefill a player profile when you choose a social sign-in, check that you are 18 or older, match you to work near you, send opted-in mission messages, review submissions, arrange approved payments, provide support, prevent abuse and understand whether the public signup works. We do not sell personal information.
Social sign-in
Facebook Login and Google sign-in are optional. Foona World requests only your first and last name (from Google, the basic profile scope; we do not request your email address, contacts or any other Google data), exchanges the login code on our server and does not expose the provider access token to the browser. The one-time profile handoff is cleared when read and expires after 10 minutes if unused. Names supplied by Facebook or Google are not saved in browser storage before registration. Your WhatsApp number remains the account ownership check.
WhatsApp messages
We send a single-use WhatsApp authentication code to confirm that the number belongs to you. Mission messages are sent only after you actively opt in, and you can stop them through the available account or messaging controls. The verification code is required for account security and is not a marketing subscription.
Sharing and retention
We share information only with service providers needed to operate signup, messaging, review, payment or security, and only for those purposes. Unverified signup attempts are automatically deleted after 24 hours. A verification code expires after 10 minutes and is deleted immediately after successful use. We keep verified account information while it is needed for the account, a mission or a legal/security obligation, then delete or de-identify it when practical. Self-service deletion removes the signup/account row and keeps only a one-way deletion receipt for up to 30 days for abuse prevention.
Your choices
You can ask to access or correct your information and can delete the signup/account record through the self-service account deletion page. Ownership is confirmed with a WhatsApp code before deletion.