Privacy

Our status

Donum Foundation's registration in Uganda is under way. Until it is complete, Donum Foundation is not yet registered as a company or an organisation, and nothing on this site says it is. When registration is complete, and whenever this page changes, we will email every member, and ask them to agree again before they continue.

Who is responsible

Donum Foundation, in Uganda, runs this site and decides what happens to the information described on this page.

To ask anything about your information, write to support@donumfoundation.org. Our data protection officer answers these messages.

What we publish, and what we keep

About any person, we publish only what they chose to show. Everyone who receives a chance is also counted in the totals on Results.

We keep a full and true record of our work: every chance, what it cost, who delivered it, how it went, and what each person chose. We learn from it, and our work is audited against it. It is seen only by people whose work needs it: our team, each seeing what their role allows; an outreach partner, for the people it referred; and people who check our work, such as auditors. Every deletion from it is recorded.

Your email address, your Pledges, your Ancestor Record and your thank-yous are kept out of it, as below.

When you visit this site

Every visit reaches us through Cloudflare, the company whose network carries this site. Like any website, it receives the internet address of your connection and the page you ask for. Cloudflare keeps a record of visits for us, for no more than seven days, so that we can find faults. We use the country Cloudflare reports only to guess which currency to show amounts in first, and we do not keep it.

When you send the Need help, Report a concern, Notify me, Follow this writer, Tell me when you're hiring or Prepare the email form, or ask for a sign-in email, we count how many come from your internet connection in one hour. This stops anyone sending so many that the forms stop working for everyone. When you ask for a sign-in email, we also count how many we send to your email address in one day, and we send no more than five. We count with a scrambled copy of your connection's address and of your email address, never the addresses themselves. A count by connection is deleted after its hour, and a count by email address by 1 a.m. Kampala time the next day. Before any of these forms is sent, Cloudflare checks that a person, not a program, is sending it.

If you have an account

We ask for an email address, so we can sign you in and send you the emails listed below. You choose a handle. It can be your real name or any name you like. Everyone can see it, so choose one you're comfortable with. Don't put contact details in it; we block those. On a story, you can choose to be shown by your first name instead. We keep that first name on that story only, never show it beside your handle, and delete it when the story or your account is deleted.

You can change your handle once every 30 days. Your old handle is kept for you for 90 days. Our moderators can see the handles you used in the last year, so a change of name cannot hide what was written before.

If you turn on a page of what you've shared, it lists only what you published under your handle, never a story shown by your first name, and you can turn it off at any time.

When you delete a comment, it disappears from the site at once. We keep it hidden for 30 days, in case it needs checking for someone's safety, and then delete it for good. In those 30 days our moderators and admins can read it.

Your account has no place for your surname, where you live, your date of birth, your employer or your school. You confirm you are 18 or over.

Beside what you write we show a letter: the first letter of your handle, or of your first name on a story shown by it. There is no avatar picture, and you cannot upload a photo.

A story you publish may be read aloud by someone else and shared on our podcast channels, unless you tick "Do not record my story as audio". You can have the recording taken down at any time.

A few people on our team, the admin, the Executive Director and the board chair, can look up your handle, when you joined, your roles and whether you are verified, so they can check you in person or give you a role. They never see your email address there.

What a computer reads, and what a person decides

A computer program run by a company called Groq reads some of what members write, to help our team find anything that may break the story guidelines or put somebody at risk. It reads a story when it is sent to us, a comment just after it is posted, and a thank-you when it is shared. It is given only the words, never your handle, your account number or your email address.

It cannot publish, reject or remove anything, and nothing about you is decided by it alone. If it points to a comment, the comment is hidden until a person reads it. The person then puts it back, or removes it and writes down why. You can read that decision, and the reason, in My account. If you think it was a mistake, write to support@donumfoundation.org.

The same program drafts translations of published stories. A person checks every translation before it is published.

Your email address

It is kept in the sign-in system, and in a copy of any introduction you agreed to, as below. The rest of the site knows you by a number. We use it only to sign you in and to send you: your sign-in link and code; receipts for money you give, and messages about a monthly gift or a refund; a message to your old address when you change it, and a confirmation when your account is deleted; an introduction you agreed to; a short note, with no details, when something in your account needs you; a reminder on the day you chose to look back at a Pledge; emails about the Student Laptop Draw, if you apply or ask to be told when it opens; if you work for Donum Foundation, emails about work waiting for you and your weekly report; emails about a writer you follow on the Journal, or about a role you asked to hear about; and, if you switch them on in My account, emails about new stories, new recordings, new challenges, new chances to give and the Journal. An email about new stories carries only their titles and links, never what a story says. The companies that send our emails are named below, under "Companies that work for us".

It is not shown to other members, or on any screen our team uses, with one exception: an introduction to a mentor or a volunteer that you agreed to. That email goes to you both, so the person you are introduced to sees your address. We keep a copy of it, with both addresses and both handles, for five years, even if either account is deleted. If somebody is cheated or harmed after an introduction, the copy tells us where to start. Only an admin or the Executive director can open it, and every opening is recorded.

You can change your address in My account. We send a link to the new address and one to the address you use now, and the change happens only when both are opened. Your account, your stories and everything else stay yours: the site knows you by an account number that never changes, not by your address or your handle. We then tell your old address that it changed. We keep the old address only until that message is sent, and never longer than seven days.

Only you can see these

Your Pledges, your Ancestor Record and your thank-yous are seen only by you, and no screen our team uses can show them. If you make a Pledge without an account, we keep nothing of it: it is made on the page, for you to print or save, and gone when you leave. If you choose to share a Pledge or a thank-you, it is reviewed like a story, and only your handle or your first name is shown with it.

You can type your full name into a Pledge. The box for it is never sent to us. Your browser sends us only its first word, and that first name is all we keep. Your browser holds the full name in that tab only, puts it on the copy of your Pledge that you see once, straight after you make it, and then forgets it. If the page is closed before then, the tab forgets it too. If your browser is not running the site's scripts, the form asks for your first name instead, and if you type more than one word we keep only the first.

If you take the Donum Next Step Challenge

Your steps, their plans, actions, check-ins and notes are private to you, as your Pledges are.

When you set an action, we keep the time zone your phone reports, to show it and remind you at the right time.

We publish only totals for the whole site: how many steps were set and done, and how many actions were set and done. We never publish one member's numbers.

A step you share is read by our team first. Only the step, what done looks like, whether it is done, the months it was set and finished, and your handle are shown.

Your patterns are worked out from your own steps and actions, and only you see them.

If you start typing a step before you sign in, it is kept only in your browser until you save it.

What you answer in "Find a way to finish this step" is private to you, with one exception: what got in the way, either the item you choose or the few words you write under "Other", is sent to our team with the day, never with your name, your account or your step. An AI may suggest which item of the list it matches, and it receives only those words. If you send what is still missing to Donum Foundation, our team reads what you send.

We also publish how many steps named each thing that got in the way, and its typical cost, only when at least ten steps named it.

If you send a request, you can tell us your district or town, so we can tell you about ways near you.

If you volunteer in a role

Before any role beyond stories and comments, and before an application to the Student Laptop Draw, a company called Didit checks your identity on its own page. Didit handles the check mainly in Europe. We keep only the result, the date and Didit's reference for the check, never your document or your photo. We ask Didit to delete the check as soon as we have the result, and ask again each day until it confirms. If you pass, a tick is shown beside your handle, to say your identity was checked. Nothing else about the check is ever shown. Our team can also show the tick for somebody it has verified in person, and records how it did so.

You can verify in person instead: a member of our team looks at your national ID or your passport and hands it straight back. We keep only that you were verified, the date and who checked, never a copy and never the document's number.

If you work for Donum Foundation

If you hold a paid role, we keep your weekly reports while you work for us and for one year after, then delete them. Only you, the head of your department and the Executive director can read them, and nobody else reads the Executive director's. If you hold a volunteer role, the head of its department can see the work you did in it, and your answers to our quarterly question.

If you follow a writer, or ask about a role

If you follow a writer on the Journal, we keep that, and your email address if you are not a member, to tell you when they publish. You can stop at any time. A member's choice is deleted with their account, and a visitor's address when they stop.

If you turn on your page of what you've shared, other members can follow it. We keep who follows it, to tell them when you publish something new on it. Nobody is shown how many follow you, and turning your page off ends every follow.

If you ask us to tell you when we are hiring, we keep which roles you chose, and your email address if you are not a member, until you stop the emails, or for two years.

If you give money

Donum Foundation does not take money yet. When you pledge a gift, we keep its details and its reference, as below. The rest of this section applies once Donum can receive gifts.

We keep a record of each gift: the amount, the date, how it was paid, and any name it was given in. If you give without an account, we also keep the email address you gave for your receipt, and use it only for messages about your gift: the receipt, a refund, a monthly gift, and later, how the chance you gave to went. The law requires us to keep financial records, and our auditors check them, so if you delete your account, your gifts stay in them without it. Card details go only to the card payment company; we never see them. For mobile money or a bank transfer, our statement shows what your network or bank sends us, such as your name or number, and we use it only to match your gift.

When you prepare an email to give, we keep the details of the gift and its reference, but not who you are, so we can match your email when it arrives. If you are signed in and prepare a list of gifts, we also keep that the list is yours, so that if more or less than its total arrives, we can ask you in My account how to share it. If no gift comes of it, we delete any name it was given in, and its line, 90 days later.

If you join the Student Laptop Draw

If you ask to be told when applications open and you have no account, we keep your email address to send you that one email, and delete it 30 days after it is sent. The link in that email deletes your address within a day.

If you apply, your application is kept in our gifts database, never on a public page. Our team reads it, and checks your details with your university's office to confirm you are a current student. The photo of your university ID card is deleted 30 days after we decide on your application. Your name and registration number are deleted 30 days after your ticket ends, or after we refuse your application or you withdraw it. The draw's own page says what is published if you win.

If you ask for help

What you write through the help form goes to a separate private database that no other part of this site can reach. It is stored in Germany and is never published. Only our team reads it, unless you ticked the box to share it with an outreach partner, and then the partner sees only what they need. If a chance could help, our team or an outreach partner meets you first, and the chance is recorded separately, from what you tell them. When a message arrives, our team gets an email saying so, which does not contain your message. We keep a request until we have handled it. Then we delete it 180 days later, or five years later if you ticked the box to keep yours. To ask about a request you sent, write to support@donumfoundation.org and give the reference you were shown.

If you receive a chance

The outreach partner, or our team, explains two separate choices and records your answers.

Checking. At six months, at a year, and when the change you planned for should show, the organisation asks how things are going. Somebody from Donum who had no part in choosing you may also contact you, privately, to check that the gift reached you. Nothing about this checking is published. Agreeing to it is part of receiving the gift.

What the website shows about you. While people give towards your chance, its page shows you by a made-up name or, after a safety check, by your first name. After the gift, you choose one of three: Counted (only in the totals), Shared anonymously, or Shared by name (adults only, after a safety check). While Donum has given only a few gifts, someone who knows you received one may be able to work out from the totals how it went. You can change your choice at any time; choosing less takes detail off the site at once.

Our record of your chance is kept in full, whatever you choose to show.

Photos and delivery documents

Every photo of a person on this site is added by our team or an outreach partner, with that person's separate agreement, or a parent's or guardian's for a child. The documents that show a gift was delivered are never published: location data is removed, and only the people who check deliveries can open them.

If you work for an outreach partner

We keep your work email, for signing in and for emails about referrals and follow-ups, and the name and role your lead gave when inviting you.

If you report a concern

It goes to the same separate private database as help requests, stored in Germany. It is kept whole, and deleted five years after it is resolved. It goes to two people at once: our Executive director and the chair of our board. If it is about one of them, the other and one of our two board members read it instead. If you say on the form that it is about one of them, that person cannot open it in the tools our team uses. Any files you add are kept with it, the same way. Before we keep a photo, we remove any record the file carries of where it was taken. We cannot always do this for a PDF.

Children

You must be 18 or over to have an account, to apply to the Student Laptop Draw, or to be shown by name after a chance. A child appears in a photo on this site only if a parent or guardian agreed, and is never named.

If you are under 18, the Need help form asks that a parent or guardian agrees before you send it. If you cannot ask them, or the problem is with them, contact the police.

Screenshots cannot be recalled

If your story is published, anyone who can see it can photograph it. Unpublishing removes it from this site. It cannot remove a copy that somebody has already made, or a recording that somebody has already downloaded from a podcast app. Please decide what to publish with that in mind.

Deleting your account

You can delete it yourself, from your account area. It removes your account, stories, comments, reactions, volunteer offers, Pledges, Ancestor Record and thank-yous: hidden at once, then deleted within 30 days. Your email address stays in the sign-in system until a person removes it: write to support@donumfoundation.org and we will. We also keep the copy of an introduction you agreed to, for its five years, and the record of any money you gave, without your account, as above.

Companies that work for us

We never sell or rent anyone's information, and we share nothing with any other project the founder works on. These companies do work for us, or will once we have set them up. Each does that work under a written agreement that says how it must protect personal information:

• Cloudflare carries this site, and every visit and every form, to us. It also keeps our record of visits, the one-hour counts described above, and the sign-in to our team's admin pages. Emails you send to info@donumfoundation.org or support@donumfoundation.org are forwarded by Cloudflare to the mailbox our team reads. Its network is worldwide, so a visit can pass through, and its records can be kept in, any country.
• Supabase stores our databases, including the sign-in system that holds your email address. They are in Frankfurt, Germany. It keeps backup copies for up to 14 days, so something we delete is gone from those copies within 14 days.
• Resend sends our emails, including sign-in links and codes, from Ireland. It keeps a record of each one, with the address it went to, in the United States, for 30 days.
• Groq runs the computer program described above. It does not use what it reads to train its models, and keeps none of it. It may process the text in the United States, Europe or other countries.
• Didit checks identities, as described above.
• When online giving opens, the payment companies that take card and PayPal gifts will see what that work needs. This page will name them then.

Outreach partners see what this page describes, and nothing more. Our auditors and lawyers may read our records to check our work. If the law requires us to give information to the police, a court or a regulator, we do.

Where your information is kept

Our work is in Uganda, but the information this page describes is kept outside Uganda. Our databases are in Germany. Records of our emails are kept in the United States. Identity checks are handled mainly in Europe. The text a computer program reads may be processed in the United States, Europe or other countries. Cloudflare's network is worldwide.

Cookies and what this site stores on your device

This site stores only what it needs to work and what you choose. Nothing it stores follows you to other sites or is used for advertising.

When you sign in, we set four cookies: small files your browser sends back to us with each page, so we know it is you. Scripts on the page cannot read them, and they travel only over a secure connection.

• donum_at shows that you are signed in. It stays while you are signed in.
• donum_rt renews your sign-in without a new code. It stays while you are signed in, 30 days at most.
• donum_until holds the time your sign-in ends: 7 days after you sign in, or 30 if you ticked "Keep me signed in on this device".
• donum_signin remembers that choice, and the page to return to, for the hour your sign-in link works.

Your browser also keeps these notes for this site. They are not sent to us.

• donum.theme keeps light or dark, if you chose one that differs from your device, until you clear it.
• dn-currency keeps the currency you last chose for showing amounts, until you clear it.
• donum.give keeps your choices on the Donate form, so that Back does not lose them, until you close the tab.
• donum.pledge.name keeps the full name you typed on a Pledge, for your own copy, until your copy is shown or you close the tab.
• donum.back and donum.spot keep whether a page shows Back, and where you were on a page, so that Back returns you to the same place, until you close the tab.

If you clear them, the site still works: you are signed out, and it forgets your choices.

Cloudflare may set a cookie of its own, to tell people apart from programs that attack websites. If you work for Donum, Cloudflare also sets one when you sign in to the admin pages.

What we do not do

• No advertising trackers, no pixels, no third-party analytics.
• No direct messages between users, so there is nothing for us to read.

Your rights

You can ask us whether we hold information about you, and for a copy of it. You can ask us to correct what is wrong, to delete what we have no need or duty to keep, and to stop using your information in a way that causes you harm or distress.

With an account, you can do much of this yourself, in your account area: download your handle, stories, comments, offers, Pledges, Ancestor Record and thank-yous as a file; change your email address; switch emails off; and delete your account. If you received a chance, you can ask to see or correct our record of it, through the organisation that knows you or by writing to support@donumfoundation.org.

For anything else, including a help request you sent, write to support@donumfoundation.org. Give the reference you were shown, if you have one, so we can find it without asking you for more about yourself. Before we send you anything, we may ask you to show that it is yours, so that it goes to nobody else. About a concern you reported, send another through the Report a concern form and give its reference, so that it is read the same private way as the first.

We answer a request to see your information within 30 days, and a request to stop using it within 14 days.

If you are not happy with our answer, you can complain to Uganda's Personal Data Protection Office. If you live in the European Union or the United Kingdom, and its data protection law protects you, you can also complain to the data protection authority where you live.

If something goes wrong

If someone who should not have it sees or takes personal information we hold, we tell Uganda's Personal Data Protection Office at once, as the law requires. We tell the people it belongs to when the Office decides they should be told. Cloudflare, Supabase, Resend, Didit and Groq have each agreed to tell us without delay if this happens to what they hold.

The law

This page follows Uganda's Data Protection and Privacy Act, 2019, and its Regulations of 2021. If you live in the European Union or the United Kingdom, its data protection law may protect you too.

Changes to this page

When we change this page, we change the date below, email every member, and ask them to agree again before they continue.

Last changed: 26 October 2026