Privacy

What we keep about givers: what the blockchain shows (the amount, the time, the transaction). When you use "Check my gift": your name, phone number (with country code) and email, what your gift should become (and the quantity or words you add), your thank-you choices, and, only if you type one, a first name to show. Your sending address is read once to screen it against the public OFAC SDN list and is not stored. If you email us: your email address, your message and anything you choose to tell us. For gifts over US$1,000: the identity details we ask for.
How we protect it: your name, phone, email and notes are encrypted (AES-256-GCM) before they are stored, with a key kept apart as a server secret. Only the volunteers who manage gifts can open them, on a locked admin page. They never appear on a public page, in the ledger, in the monthly CSV files or in our logs.
The emails we send you: a receipt when your gift is verified; a note when it is given to a family, with what was given (and a photo only if the family agreed you may see one); and a family's contact, or word that we passed on yours, only when both you and the family said yes. Nothing else, unless you ask.
The thank-you connection: contacts pass between a giver and a family only when both say yes, and only by a message from us. The family is asked gently at the hand-over and never pressed; either side can say no at any time. We never share an address or a place. Because a transaction link is public, anyone could type it in first, so before a family's contact or photo reaches a giver, or a giver's contact reaches a family, a volunteer asks the giver to show that the gift is theirs.
What we collect from volunteers: the details on the form. Your country is never shown.
Why: to record each gift by its giver, send your receipt, honour what you want your gift to become, tell you when it reaches a family, connect you with the family if you both wish, answer you, meet anti-money-laundering and sanctions duties, and run the volunteer team.
What we publish: the transaction link and amount (already public on the blockchain), your choice of what the gift should become, and, only if you ask and a volunteer approves it, your first name. Nothing else.
Families: we keep their names and details privately and never publish them. In public they are a code and a state. Photos only with consent, never children's faces, location data removed, published 14+ days later. If a family wishes to thank a giver, we keep only the contact they choose (a first name and a phone number), encrypted, and give it only to the giver of that gift who asked for it.
How long: a giver's name, phone, email and notes until 24 months after we email you that your gift was delivered (or 36 months after you gave them, if no delivery email was sent), then they are deleted automatically (sooner if you ask). A family's thank-you contact and the private hand-over photo for the giver: up to 24 months after the hand-over, or sooner if the family asks. Gift and payment records without contact details (amount, date, transaction, family code) for at least 6 years, for proof and the law. Identity details for gifts over US$1,000: as long as the law requires. Volunteer and email records until you ask us to delete them, unless the law requires us to keep them.
Who sees it: only the volunteers who need it. The site, its database and its emails run on Cloudflare. We never sell data, we share a contact only through the thank-you connection when both sides agree, and we use no advertising trackers or cookies.
Your rights, and deletion: write to info@giftstosudan.org from the email you gave us (or reply to any email from us) to see, correct or delete your details. On a deletion request we erase your name, phone, email and notes within 30 days, usually at once, and remove your first name from the public ledger. What stays is the ledger row of the gift (amount, date, transaction link), which holds no contact details. Data written to a blockchain cannot be deleted by anyone.