2Klip Privacy Policy

1. Who we are

Timba2 (Pty) Ltd (registration 2023/542365/07), trading as Timbuk2, is the responsible party for personal information processed for the 2Klip programme, unless a separate notice states otherwise.

Registered address: 155 West Street, Sandown, Sandton 2031, South Africa

Information Officer: Matimba Nkuna (mjnkuna@timbuk2.ai)

2. Scope of this policy

This policy applies to personal information processed in connection with 2Klip recruitment, screening, onboarding, messaging, missions, submissions, payments, support, analytics, reporting, and compliance.

It covers information received directly from participants, through recruitment partners, from forms and communication channels, and from mission outputs submitted to the Company.

3. Information we may collect

Identity and contact details, including name, phone number, email address, age bracket, area/subplace, and ID or other verification details where needed for lawful identification or payment.

Recruitment and onboarding information, including area suitability, availability, smartphone capability, GPS/camera capability, bank or wallet details, and screening responses.

Submission and mission information, including worker ID, mission ID, timestamps, GPS coordinates, photos, short videos (with sound), notes, category labels, quality/duplicate flags, payout records, and audit artefacts.

Optional third-party business information supplied in the field, such as business names, visible contact numbers, owner names, operating notes, and proof of location where this is relevant to the task.

Technical and usage information from the channels we use, such as WhatsApp messages, exported chat records, form data, device metadata embedded in submissions, meeting attendance, and support interactions.

4. How we collect information

Directly from data subjects during applications, onboarding, Google Meet sessions, forms, messaging, or field submissions.

From recruitment or ecosystem partners where candidates have been sourced or referred through a lawful process.

From operators and service providers that help us host, store, transmit, analyse, or secure programme data.

From public-facing business observations captured lawfully in the field and from quality-assurance checks against existing datasets or maps.

5. Why we process personal information

To recruit, assess, onboard, allocate, manage, and support participants.

To verify submissions, calculate points or rewards, prevent fraud, manage duplicates, and administer payouts.

To create, improve, and commercialise 2Klip datasets, reports, truth packs, analytics, models, and client deliverables. Information we receive from Google or Facebook sign-in is never used for this (see section 17).

To maintain audit trails, quality assurance, operational reporting, funding or impact reporting, and legal/compliance records.

To protect the security, integrity, and lawful operation of the programme.

6. Lawful grounds for processing

The Company may process personal information where:

• the data subject has consented;
• processing is necessary to take steps at the request of the data subject or to perform a contract;
• processing complies with a legal obligation;
• processing protects a legitimate interest of the data subject;
• processing is necessary for pursuing the Company’s legitimate interests or those of a third party, where appropriate and lawful.

Where consent is relied on, the data subject may withdraw it prospectively, subject to any processing that remains lawful on another basis or that is required for recordkeeping, dispute management, or legal compliance.

7. Important notice for field-collected third-party information

Participants must minimise collection of third-party personal information and should avoid capturing unnecessary faces or other personal details.

Where owner or contact information is requested as part of a mission, participants must only provide information lawfully obtained, relevant to the mission, and not excessive. The Company may delete or redact unnecessary personal information.

8. Sharing and disclosure

We may share personal information with operators or service providers that host or support communications, cloud storage, analytics, identity checks, security, or payment processes.

We may share limited information with clients, partners, auditors, funders, or regulators where required for the agreed service, lawful reporting, or impact verification, but we aim to limit personal information and favour aggregate or pseudonymised outputs where feasible.

We may disclose information where required by law, court order, regulator request, or to protect lawful rights and safety.

9. Cross-border transfers

Some operators or cloud environments may process or store information outside South Africa. Where that happens, the Company will take steps reasonably required by applicable law to ensure adequate protection and appropriate contractual safeguards.

The specific processors used by the app and this website, and which of them process data outside South Africa, are named in the App Addendum (A6).

10. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law, contract, audit needs, dispute resolution, research safeguards, or legitimate operational recordkeeping.

Audit, payout, and proof records may need to be retained after a campaign ends to support verification, complaints, client deliverables, and funding or compliance reporting. How long each kind of account record is kept is set out on the deletion page.

11. Security

The Company uses reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, access, or unlawful processing.

Because 2Klip uses messaging tools and field devices, absolute security cannot be guaranteed. Participants should also use secure devices, passcodes, and appropriate caution when sharing information.

12. Data-subject rights

Subject to applicable law, data subjects may request confirmation of whether we hold their personal information, request access, request correction or deletion, object to certain processing, withdraw consent where consent is the basis, and complain to the Information Regulator.

Access requests and some other requests may be handled through the Company’s PAIA Manual and associated request processes. Anyone with a 2Klip account can also request its deletion, with or without the app, at www.2klip.com/account/delete.

13. Information Officer and PAIA Manual

The Company must maintain Information Officer details and a PAIA Manual appropriate to its legal obligations. Requests for access to records or personal information should be directed to the Information Officer or other contact listed in the PAIA Manual.

14. Direct marketing

Operational onboarding, mission, safety, and payout communications are not the same as marketing communications.

If the Company wishes to send direct marketing by electronic means, this will be managed in accordance with applicable law and channel-specific opt-in requirements.

15. Children and special personal information

2Klip is for people aged 18 and over. The Company does not knowingly recruit minors into paid field missions, and if we learn that we hold a child’s personal information we delete it.

Some games are about alcohol. Before one starts, we ask for your date of birth and keep only the fact that you confirmed you are 18 or older, and when — never the date itself. We may ask again after a year.

The Company does not intend to collect special personal information unless a lawful exception applies and appropriate authorisation or safeguards are in place.

16. Complaints and updates

Questions or complaints should first be sent to support@timbuk2.ai or the Information Officer. Data subjects may also complain to the Information Regulator of South Africa.

This policy may be updated from time to time. The latest version should be made available in the onboarding pack, website, or other official 2Klip channel.

17. Signing in with Google or Facebook

You can create a 2Klip account, and sign in to it, with your Google or Facebook account instead of typing an email address. It is your choice: you can always use your email address instead, and nothing in 2Klip depends on which you pick.

Phone and WhatsApp contact

You may add a phone number after an official Pin shot. It is optional for play. Phone verification is required when you redeem a reward. We use SMS to verify a number you add so we can contact you about prizes and redemptions. You can also tell us which number you use on WhatsApp, or tell us you do not use WhatsApp. This contact preference is not WhatsApp account verification or consent to marketing messages.

What we receive

Google or Facebook first asks you to agree, then sends us only:

• your name;
• your email address (and, from Google, whether Google has verified it);
• a link to your profile picture;
• an identifier for your account, which is specific to 2Klip.

Your browser’s sign-in session also holds a short-lived Google or Facebook access token for a while after you sign in. We do not use it.

From Facebook we ask for two permissions only: public_profile and email. From Google we ask only for your basic profile and email address. We never see your Google or Facebook password, and we get no access to your posts, photos, friends, messages, contacts, pages or groups. We never post to Google or Facebook, or act for you there.

What we use it for

• to create your 2Klip account and sign you in;
• to put your name and email address on your account, and to recognise you when you come back;
• to keep accounts secure — for example, so one email address cannot open two accounts.

Before official Pin play or reward redemption, we ask for your mobile number and confirm it with a one-time SMS code. That number comes from you, not from Google or Facebook.

What we never do with it

We do not sell, rent, license or trade what Google or Facebook sends us. We do not use it for advertising or to build advertising profiles, and we do not put it in the datasets, reports or client deliverables described in section 5. We share it only with the operators that run 2Klip for us, named in the App Addendum A6 — for example, your email address goes to Paystack when you pay by card — or where the law requires.

On the website, our analytics provider (PostHog) receives your 2Klip account number and which way you signed in — for example “google” — so we can see where sign-in fails, but not your name or email address. The 2Klip mobile app does send PostHog your name and email address (App Addendum A2).

2Klip’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is kept, and for how long

With our authentication and database provider, Supabase, in Ireland (EU) — outside South Africa, on the terms in section 9. We keep it while your account is open and delete it with your account.

Disconnecting Google or Facebook

You can remove 2Klip’s access at any time:

• Facebook: Settings & privacy → Settings → Apps and websites, then remove 2Klip (open it on Facebook).
• Google: your Google Account → Security → Your connections to third-party apps & services, then choose 2Klip and delete the connection (open it on Google).

Removing access is not deleting your account. It stops Google or Facebook sharing anything new with us, but it does not delete what we already hold. To delete that, follow these steps.

What Google and Meta do with your information is governed by their own privacy policies.

18. The 2Klip website and web app

Remembering this browser

Before anyone signs up, we need to tell a returning browser from a new one. So when you visit www.2klip.com, 2Klip keeps random numbers in your browser: a cookie called 2k_did, a play ID in your browser’s local storage, and PostHog’s own ID (see below). None of them is worked out from your device’s characteristics (none is a fingerprint), and none is set by an advertiser. The cookie expires 180 days after it is set; the play ID stays until you clear your browser’s data or switch counting off. We keep these numbers with the play and analytics records of that browser. If you sign in, those records are linked to your account.

We rely on our legitimate interest (POPIA section 11(1)(f)) in knowing whether the game brings people back. We consider that this does not override your rights because the numbers are random, are used only by 2Klip and the operators that run it, and are never used to advertise to you, profile you or score you. The cookie’s 180 days is chosen to cover the returns we measure — after a day, a week and a month.

You can object at any time. On the home page, tap How to play, open Help, support and more, and under This device choose Stop counting this device. That deletes the cookie and the play ID from your browser at once, switches off analytics and session replay in this browser, and sets a marker (2k_did_off, kept for 400 days) so new ones are not made. Games you play while counting is off do not count towards the welcome reward.

Creating an account and staying signed in

When you create an account we record the IP address it came from, to detect fraud. When you sign in, your browser stores a sign-in session so you stay signed in; signing out removes it.

Analytics and session replay

The website and web app use PostHog to record page views, taps and errors, and to make session replays — a reconstruction of how a page was used — so we can find and fix problems. Anything you type into a form field is masked in your browser before it is sent; so are your name, email address and phone number on your account pages, and error messages shown on the screen. Other things on the screen, such as the games you play and the pages you open, can appear in a replay. PostHog also receives your IP address and reports of errors in the page. Session replay is not used in the mobile app.

2Klip business billboards

Businesses that ask to advertise give 2Klip their contact details, one chosen in-game area and billboard slot, a short description, audience guidance and two billboard images. We keep submissions private while our team reviews them. Paystack processes the price shown for the booking; 2Klip stores the payment reference and status needed to match, refund and audit it. Payment does not approve an advert. The campaign period shown for that booking starts only after approval and activation; a rejected or unallocatable paid booking is kept in the refund queue until confirmed.

These map billboards are 2Klip’s own first-party advertising spaces. The business submission, images and payment details are not sent to Google Ads or AdSense. Google advertisements between games, described separately below, are a different product.

If a signed-in player chooses Save contact, 2Klip saves the approved business contact card in that player’s private Inbox. We do not send the player’s name, phone number, email address, location or message to the business, and saving a card is not consent to direct marketing. Device location is used only after an explicit tap to rank nearby named areas; the coordinates are not submitted with the form.

Ads between games

2Klip may show an advertisement from Google (AdSense) at a natural break in free play: when a clue you chose on the map is done, at the end of the Feed, or when you have finished every place in an area. An ad never appears during a round, never after a game that pays BUK2, never when you tap a button to go somewhere, never in your first day of play, never more than about once every three minutes, and never in the 2Klip Android app. If your phone has Data Saver on, or your connection is very slow, we do not load ads at all.

We ask Google for ads that are not personalised. We do not give Google your name, phone number, email address, 2Klip account ID, location or what you play. Google’s ad script is loaded only when an ad may be shown, and when it is, your browser contacts Google directly, so Google receives your IP address and browser details and may set or read its own cookies to limit how often an ad is shown and to detect fraud. Watching an ad never earns BUK2, and no reward depends on one. If you switch counting off (above), no ad is loaded either. Google’s use of this information is described at policies.google.com/technologies/ads.

Maps, fonts and pictures

Some pages load map tiles from CARTO, OpenFreeMap and OpenStreetMap, fonts from Google Fonts, and pictures from Wikimedia Commons. Your browser fetches these directly, so each of those services receives your IP address and browser details when a page uses them. They do not receive your account details.

Support chat

Support chat is provided by Crisp and is loaded only when you open it. Crisp receives what you write, the topic you chose, your 2Klip account ID if you are signed in, a reward reference if your question is about a reward, and the technical details any website receives, such as your browser type.

19. Camera, microphone, photos and videos

Added 12 October 2026

The 2Klip mobile app asks for camera and microphone access only when you choose to record something yourself: a place photo or a short selfie or place video when you contribute a place, or a shop photo or walk-in video when you register a business. Nothing is recorded in the background, and you can keep playing without granting either permission. 2Klip does not open your photo library, contacts or files.

What we collect

The photo or video you capture, including the sound recorded with a video; the GPS location, accuracy and time of capture; and, for place contributions, the place details and any short story you add. Videos are limited to 16 MB.

What we use it for

To check that a place or business is real and where you say it is, to review your contribution, to prevent fraud and duplicate claims, and to keep the audit record behind any reward or payout.

Who can see it

Recordings are uploaded to private storage. Only our review team and the service providers that host it for us can access them. We do not post your recordings publicly, sell them, or use them for advertising. Your name appears next to a published place only if you choose to be credited.

How long we keep it

• Unfinished drafts: deleted after 1 day.
• Submitted but not yet reviewed: deleted after 90 days.
• After we approve, reject, publish or ask for changes: the photo and video are deleted 30 days after that decision.
• Business-registration photos and walk-in videos: kept with the verification and payout record described in section 10.

After a file is deleted, we may keep a record that it existed, such as its size, a fingerprint and the review outcome, as part of the audit trail.

Turning access off

You can withdraw camera or microphone permission at any time in your phone settings. To ask us to delete a recording sooner, contact our Information Officer or delete your account.