Crypto donations are often described as private. For the money, that is roughly true. For the data, it is frequently the opposite of true, and the part nobody mentions is where that data ends up geographically.
This article is about the second thing. It applies to any charity's crypto checkout, including ours, and we will be specific about ours because vague advice is useless here.
Declare the conflict first: TraceGood accepts donations through a payment processor, so we are describing an arrangement we profit from. Everything below about that processor was read from its own published documents on 22 October 2026. We are not lawyers.
A donation creates two records, not one
The blockchain record. Public, permanent, and not erasable by anyone — not by the charity, not by you, not by a regulator. It shows an amount, a time, a sending address and a receiving address. It does not show your name. But an address is not anonymous, it is pseudonymous: if anything ever links that address to you — an exchange withdrawal, a reused address, a public tip jar — the link is retrospective and covers everything that address ever did.
The processor record. Private, and much more identifying than people expect. When you land on a hosted checkout you are on the payment company's website, and it receives what any website receives: your IP address, the country it resolves to, your browser and language, plus anything you type on the page.
Donors tend to worry about the first record and ignore the second. The second is the one with your location in it.
The question almost nobody asks: which country holds it?
Here is the exercise we ran on our own processor, and the result surprised us.
Our checkout is branded NOWPayments. The terms of service behind it are titled FD Transfers LLC Terms of Service, naming a company registered in St Vincent and the Grenadines. That is the entity receiving donor data.
The European Commission maintains a list of countries it has decided give personal data essentially equivalent protection to the EU's — an adequacy decision. We checked the Commission's own list. It currently names seventeen, including the United Kingdom, Switzerland, Japan, Argentina, Brazil, New Zealand, South Korea and the United States under its data framework.
St Vincent and the Grenadines is not on it.
That does not make the transfer unlawful; EU law allows transfers to non-adequate countries by other routes. It does mean the automatic presumption of equivalent protection is absent, and that if you want recourse you are looking at a company outside the EU rather than inside it.
The same processor's terms state that its services are not rendered to residents or citizens of the European Union, the United Kingdom, the United States, the United Arab Emirates or Russia — and that it does not become subject to those places' data-protection or consumer rules simply because somebody there uses it anyway. That sentence is a shield against being regulated. It is the clearest possible statement of where you would stand.
We wrote up the whole reading in what jurisdiction is your crypto processor in.
What we actually send, and what we do not
Specifics, because this is checkable.
When you start a donation with us, our server creates a payment request containing the amount, a random order reference, and the name of the programme you chose. That is all. No name, no email address, nothing that identifies you, even if you gave us those for a receipt.
What the processor learns about you, it learns from your own browser when the checkout opens — not from us.
A name and email are optional on our form and used only to send a receipt. If you would rather we held nothing, leave them blank; the donation works identically. Our public ledger never shows donor names or emails.
We changed our privacy page on the day we worked all this out, because it previously named a brand rather than the company that receives the data. The processor's own privacy policy, as it happens, obliges merchants to tell their customers exactly this — an obligation we had been carrying unmet.
The erasure problem nobody can solve
European data protection gives people a right to have personal data erased in various circumstances. A public blockchain cannot do that. Nothing can be deleted from it, by design, and that design is the entire reason it is useful for verifying that a charity received what it claims.
So there is a genuine, unresolved tension, and any charity telling you otherwise is either confused or selling something:
- The ledger entry that lets you verify our honesty is the same entry that cannot be unwritten.
- We can erase what is in our own database — your name, your email. We cannot erase the chain.
Our honest position is that this is a trade-off we have chosen, that donors should know about it before giving rather than after, and that the way to limit exposure is to limit what gets linked in the first place.
What you can actually control
In rough order of effectiveness:
- Give no name or email unless you need a receipt. Optional means optional.
- Decide whether you need the address to be linkable to you. Donating straight from an exchange account links your verified identity to the transaction on the exchange's side. Sending from a wallet you control does not, though the chain still records the address.
- Don't reuse one address for everything. A donation address that is also your public salary address tells a longer story than you intended.
- Read the checkout's own privacy policy, not only the charity's. They are different companies with different obligations.
- Decline optional cookies on the charity's site. On ours that leaves analytics unset entirely.
- Ask the charity who receives your data. If they cannot name the legal entity, that is itself an answer.
If privacy is your primary concern rather than verifiability, we wrote about the trade-offs in can you donate crypto anonymously and about privacy coins in which charities accept Monero. Be aware the two goals genuinely conflict: a gift a stranger can verify is a gift a stranger can see.
What charities should do
- Name the legal entity that receives donor data, and the country. Not the brand.
- Send the processor as little as possible. If your invoice payload does not need a donor's name, do not put it there.
- Make identifying fields optional and mean it.
- Keep dated copies of the processor's policies. They are versioned PDFs that change without notice.
- Say out loud that the chain is permanent. It is the one thing you cannot promise to undo.
Where we stand
Every confirmed donation to TraceGood appears on our public ledger with a link to the transaction on an independent block explorer. Donor names and emails never appear there.
We are a newly founded organisation whose registration as a non-profit association in Estonia is not yet complete, and donations to us are not tax-deductible anywhere. Our About page carries the full position.
If you want to know what we hold about you, or want it deleted, ask us and we will do it.