← Give Me Money Anyway

THE DATA PART

PRIVACY.

Effective August 30, 2026. This notice explains how personal data is handled by Give Me Money Anyway (“GMMA” or the “experiment”).

Controller

The controller is the individual organizer operating GMMA from Tamaulipas, Mexico, under the public project name Give Me Money Anyway. For personal safety, the organizer’s civil name and street address are not published on the open website. A data subject who needs the controller’s legal identification to exercise a privacy right may request it privately through the contact form and may be asked to verify identity. This safety choice is not intended to reduce any mandatory privacy right.

Data the site handles

Payment and accounting records: internal contribution references, payment-provider identifiers, status, the USD amount selected, the amount and currency actually charged, any dated exchange-rate source, fees, refunds, chargebacks, timestamps, approximate checkout country and continent, and records needed for accounting, fraud prevention, tax, compliance and public aggregate statistics. GMMA does not receive or store full card numbers, card security codes or PayPal passwords.

Optional public participation: a reason, chosen display name, acknowledgment preferences, certificate settings and whether an amount or name may be shown. These details are public only when the contributor expressly chooses a public option and the submission passes moderation.

Contact: name, selected reply method, email address or telephone number, message, status and timestamps. Do not send passwords, full card details, wallet seed phrases, private keys, government identification or sensitive information that is not necessary.

Traffic: aggregate day, country, continent, visits and page views. Country and continent are approximate Cloudflare connection attributes and can be affected by VPNs. The traffic table does not store raw IP addresses, browser fingerprints, cities or persistent visitor identifiers.

Checkout funnel: daily aggregate counts for viewing the checkout, changing the amount, opening an available payment action, sharing the experiment and reaching the verified post-payment page. This table does not store the selected amount, payer identity, raw IP address, browser fingerprint or persistent visitor identifier.

Abuse prevention: the site temporarily transforms the connection address into a one-way, time-limited hash used to enforce rate limits. The raw address is not written to that table.

Browser storage

Session storage is used to avoid counting every page as a new visit and to avoid repeating selected one-time funnel events in the same tab. Local storage remembers the selected language. GMMA does not currently use advertising trackers or build cross-site advertising profiles.

Purposes

Data is used to create and verify payments, reconcile the public ledger, prevent fraud and abuse, understand aggregate checkout friction, answer messages, process genuine mistakes and refunds, provide optional acknowledgments, moderate public submissions, calculate achievements and geographic statistics, secure the service and comply with accounting, tax or legal obligations.

Service providers and disclosures

Cloudflare hosts the site, runs server-side functions and stores project records in D1. Cloudflare necessarily processes connection and security information under its own terms and privacy notice.

The payment provider displayed at checkout processes card or account payments and may collect identity, financial, device, fraud and compliance information under its own privacy notice. Its processing is separate from GMMA’s database.

Telegram receives contact-form submissions in the organizer’s private chat so the organizer can respond. Telegram may process or store those messages under its own policies.

Information may also be disclosed when reasonably necessary to comply with law, valid legal process, tax obligations, fraud prevention, payment disputes or protection of users and the service. GMMA does not sell personal data.

Cryptocurrency and public blockchains

Bitcoin and Ethereum transactions are public by design. Wallet addresses, amounts, timestamps and transaction history can be visible permanently and combined with information from other sources. GMMA cannot delete or reverse data recorded by a blockchain. A direct transfer may be manually associated with an internal accounting entry after confirmation, but contributors should not place personal information in a transaction message.

What becomes public

Aggregate totals, approximate country or continent statistics and achievement progress are public. Country-level amounts are suppressed where the minimum public contribution count is not met. Identities, contact details and private reasons are not public by default. A chosen display name, reason or amount is displayed only after an explicit public choice and moderation, or when disclosure is legally required.

Retention

Contact-form records stored in D1 are scheduled to expire after 90 days; the Telegram copy follows Telegram’s retention behavior and may be deleted manually when no longer needed. Time-limited rate-limit hashes expire shortly after their security window. Payment, accounting, refund, chargeback, fraud and tax records are retained for as long as reasonably necessary for the experiment, legal obligations and dispute defense. Aggregate traffic and checkout-funnel counts, plus the final experiment archive, may be retained indefinitely because they form part of the experiment’s historical record.

Your choices and privacy rights

You may request access, correction, cancellation or opposition regarding personal data controlled by GMMA, withdraw an optional public-display choice, or ask a privacy question. Use the contact form, choose email as the reply method and begin the message with “Privacy / ARCO.” Describe the data or payment involved and the right you wish to exercise. Reasonable information may be requested to confirm identity and protect another person’s records. A request may be limited where retention or processing is required by law, accounting, security, fraud prevention or dispute defense.

Security

GMMA uses HTTPS, server-side payment verification, signed webhook validation, secret bindings, access controls, input limits, rate limiting and aggregate reporting. No internet system is risk-free; please send only information necessary for the request.

Minors

The experiment is not directed to people under 18 and does not knowingly accept their contributions or contact data. A parent or guardian who believes a minor submitted data may use the contact form.

Changes and contact

This notice may be updated when payment methods, service providers, data uses or legal requirements change. The effective date above identifies the current version. Privacy requests and questions can be sent through Contact.