Privacy policy

Derash (ደራሽ) is a crowdfunding platform for Ethiopia. Donations are sent directly from donors to beneficiaries' own Telebirr or bank accounts — Derash never holds funds. We verify submitted transaction references against payment providers so that campaign totals reflect real, arrived money.

If you only browse or donate anonymously — which is the primary way to use Derash — you do not need an account, and we collect almost nothing:

• The transaction reference you submit, the amount you say you sent, and an optional message. References are checked against the payment provider and stored permanently so a donation can never be counted twice.
• Your IP address, briefly and in memory only, to limit abusive submission rates. It is not written to our database.
• Two cookies: your session (if logged in) and your language preference.

If you create an account (needed to start a campaign): your email address, a cryptographic hash of your password — never the password itself — and an optional display name.

If you create a campaign: the campaign story, the beneficiary's name, and the payout account details (provider, account number or Telebirr number, and the account holder's name). Identity documents are reviewed by our team but are not uploaded to or stored on the platform in this version.

If you report a campaign: your report, and a phone number only if you choose to leave one.

When a transaction reference is verified, the payment provider's response — which can include the payer's name, the receiving account, the amount, and the payment time — is stored in full. We keep these records long-term because they are the evidence behind every campaign total: they are what lets us answer disputes, investigate fraud, and prove that counted donations were real, months or years later.

Donations are anonymous on campaign pages by default. The payer name from a verified receipt is shown publicly only when the donor chose not to be anonymous.

• To verify donations and display truthful campaign totals.
• To review campaigns before they go live, and to investigate reports of abuse.
• To operate accounts, sessions, and language preferences.
• To prevent duplicate counting and rate-limit abusive traffic.

We do not sell personal data, we do not use it for advertising, and we do not use it for any purpose unrelated to running the platform.

• Verification providers — we send the transaction reference (and nothing about you) to the payment-receipt verification service in order to confirm a payment.
• Infrastructure providers — our database and hosting providers store data on our behalf under their own security commitments.
• Authorities — if required by Ethiopian law, or where necessary to investigate fraud against beneficiaries or donors.

Passwords are stored only as salted scrypt hashes. Sessions use signed, HTTP-only cookies. Access to reviewer tools is restricted to designated reviewer accounts.

• Donate without any account — anonymity is the default, not a setting.
• Ask us what data we hold about you, or ask for your account to be deleted.
• Verification records tied to counted donations are retained even after account deletion, because removing them would falsify campaign histories.

If this policy changes, the date at the top changes with it, and material changes will be noted on this page. Questions or requests: privacy@derash.example

This document is a draft and has not yet been reviewed by legal counsel.