Privacy Policy

1. Who we are

This Privacy Policy explains how Surprise Donations LLC, a New Jersey limited liability company, collects, uses, shares, and protects personal information when you use surprisedonations.com. By using the site you agree to this policy.

Surprise Donations is an informational website and software platform that hosts member profiles, listings, and links for peer-to-peer direct giving, together with social media features. We provide advertising space and a free online marketplace and directory that connects members; we do not hold, pool, or distribute member funds.

2. Information you give us

Account details: email address, password (stored only as a secure hash), username, and display name.

Profile information: display name, bio, profile photo and cover photo, city, state, ZIP code, country, interests, preferred language, the relief categories you select, your stated need and goal amount, and your giving and receiving preferences.

Content: feed posts, reels and videos with their titles and categories, comments, reactions, group posts, classifieds listings and their photos, thank-you notes, success stories, reports you file, and Ad Feature Pool consent and story text.

Communications: direct messages, attachments, and anything you send through the Customer Service & Suggestion Box.

3. Information collected automatically

We record basic technical and usage information: IP address, browser and device type, pages viewed, referring links, timestamps, error reports, and rate-limit counters used to detect abuse. We keep logs of email delivery, administrative actions, donation events, and security-relevant activity.

4. Payment information

All card payments run through Stripe's hosted checkout. We never see, receive, or store your full card number, CVC, or bank credentials.

If you connect a bank account to receive donations, Stripe Connect Express collects your identity and banking details directly and holds them under Stripe's own privacy policy. We store only the resulting Stripe account reference and status flags (whether charges and payouts are enabled, and whether onboarding is complete), plus the amount, currency, status, and timestamps of donations and tips.

For every donation and tip we keep a record of who sent it and who received it, the amount, currency, and status, and timestamps for each step of the request-first flow — when the request was sent, when the recipient chose how to receive it, any reminders we sent, and whether it was completed, declined, cancelled, or expired. We also record the method the recipient chose. If they choose to receive a gift by mail or in person, the handoff happens directly between the members involved and we hold no confirmation of what was actually given.

These donation records are visible to the donor, the recipient, and site administrators; surprise donations may be shown publicly without naming the donor. We keep them for legal, tax, accounting, and fraud-prevention purposes as described in the retention section below.

5. Messages, calls, and support

Direct messages and their attachments are stored so conversations persist between sessions and are visible to the participants. Administrators can access message content only when investigating a report, a support request, or suspected abuse.

For audio and video calls we store call metadata — participants, type, start and end times, and outcome. We do not record call audio or video.

Messages you send to the Customer Service & Suggestion Box are delivered to the site administrators by in-app message, notification, and email.

6. Email, notifications, and push

We send transactional and community emails: donation requests and confirmations, new message and comment alerts, bank-connection reminders, giveaway announcements, and site announcements. Every non-essential email includes an unsubscribe link, and you can manage categories in Notification settings.

We keep an email delivery log and a suppression list of addresses that bounced or unsubscribed so we stop sending to them.

If you enable browser push notifications, we store the subscription endpoint and keys your browser provides, along with a device label.

7. Cookies and local storage

We use cookies and browser local storage for essential purposes: keeping you signed in, remembering your language choice, storing whether you dismissed a welcome or announcement banner, and protecting against abuse. We do not use third-party advertising trackers or sell tracking data. Blocking essential cookies will prevent sign-in from working.

Because we run no advertising trackers, there is no sale or sharing of personal information to opt out of. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out request.

8. Photos, videos, and files

Uploaded avatars, cover photos, listing photos, feed media, reels, and About-page videos are stored in our cloud storage. Media attached to public content is served from public URLs, which means anyone with the link can view the file. Do not upload anything you would not want to be public. Removing a post removes it from the site; cached copies at third parties may persist for a time.

9. What other people can see

Public: your username, display name, profile photo and cover, bio, city and state, relief categories, badges, thank-you count, and everything you post publicly — including posts, reels, comments, listings, and group activity in public groups.

Private: your email address, password, ZIP code, age confirmation, notification preferences, bank and payment details, private messages, and support conversations. Donation amounts are visible to the donor and recipient, and to administrators; surprise donations may be shown anonymously.

10. How we use information

To operate your account and the platform; to deliver and confirm donations, tips, and payouts; to run the Monthly Surprise Winner Giveaway; to send notifications and emails you have not opted out of; to moderate content and enforce our terms; to detect fraud, chargebacks, spam, and abuse; to provide support; to translate content when you request it; to measure and improve the site; and to meet legal, tax, and accounting obligations.

11. How we share information

We do not sell your personal information.

We share only what is necessary with service providers who work on our behalf: Stripe (payments and payouts), our hosting and database provider, cloud file storage, email delivery, push notification services, real-time calling infrastructure, and translation services.

We may also disclose information when required by law, subpoena, or valid legal process; to protect the rights, property, or safety of members, the public, or us; to investigate fraud; or in connection with a merger, acquisition, or transfer of the business.

12. How we protect information

Traffic is encrypted in transit with HTTPS. Passwords are hashed, never stored in plain text, and checked against known breached-password lists. Database access is restricted by row-level security so members can reach only their own private records. Administrative actions are logged, sensitive operations are rate-limited, and payment credentials never touch our servers.

No online service can promise perfect security. Please use a strong, unique password and tell us immediately if you suspect your account was accessed by someone else.

13. How long we keep information

We keep account and profile information while your account is active. Content stays until you delete it or we remove it. Payment, payout, donation, tip, moderation, and administrative audit records are retained as long as required for legal, tax, accounting, and fraud-prevention purposes, typically at least seven years, even after account deletion. Email logs and suppression entries are kept so we honor unsubscribe requests.

14. Your choices and rights

You can edit or delete your profile information and content at any time, change your password from Profile → Edit, manage email categories in Notification settings, unsubscribe from any email using its link, turn push notifications off in your browser, withdraw from the Ad Feature Pool from its settings page, ask us to remove a published success story, and request a copy or deletion of your personal data.

To make a request, email customerservice@surprisedonations.com or use the Customer Service & Suggestion Box. We will respond within a reasonable time and may need to verify your identity first. Some records must be retained as described above.

15. Your U.S. state privacy rights

Depending on where you live, state privacy laws — including those of California, Virginia, Colorado, Connecticut, Texas, Oregon, and New Jersey, and other states as their laws take effect — give you the right to know and access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, and to opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects.

We do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use third-party advertising trackers, and we do not profile members in a way that produces legal or similarly significant effects. Those opt-outs therefore have nothing to act on, but we will honor any request you send.

The categories of personal information we collect are described in the sections above: identifiers (name, username, email address, IP address), account credentials, profile and demographic details you choose to publish, commercial information (donation, tip, and payout records), internet and device activity, photos and videos you upload, call metadata, and the contents of your messages and support requests. We disclose these only to the service providers listed in the sharing section, for the purposes listed in the section on how we use information. We do not request or use sensitive categories such as precise geolocation, health, biometric, or government-ID data beyond whatever a member voluntarily writes in their own profile or posts; identity and banking data needed for payouts is collected by Stripe, not by us.

We will never discriminate against you — deny service, change your experience, or reduce your standing in the community — for exercising a privacy right.

To make a request, email customerservice@surprisedonations.com or use the Customer Service & Suggestion Box on the Contact page. We may need to verify your identity, and we may decline requests we cannot verify. We respond within 45 days, and may extend once by another 45 days where the law allows, telling you why. An authorized agent may submit a request on your behalf with written permission we can verify.

Right to appeal: if we deny your request, you may appeal by replying to our decision or emailing customerservice@surprisedonations.com with "Privacy appeal" in the subject line. We will review the appeal and respond in writing within 60 days. If your appeal is denied, residents of states that provide it may file a complaint with their state Attorney General.

16. Children

Surprise Donations is for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that a minor has created an account, we will remove it. Parents or guardians who believe a minor has used the site should contact us.

17. Where information is handled

We operate in the United States and our service providers may process and store data in the United States and other countries. If you use the site from outside the U.S., you understand your information will be transferred to and handled in the United States under U.S. law.

18. Changes to this policy

We may update this Privacy Policy as the platform changes. The "Last updated" date at the top of this page reflects the current version, and we will announce material changes on the site or by email.

19. Contact us

Surprise Donations LLC, New Jersey, United States. Privacy questions: customerservice@surprisedonations.com, or use the Customer Service & Suggestion Box on the Contact page.