Privacy policy
This policy explains what Yadgaar collects, why, how long it is kept, and how you can have it deleted. It applies to every memorial, fundraiser, donation, and account on this site.
What we collect and why
An account holder's email address and display name, memorial and fundraiser content the owner writes, images the owner uploads, and any note or dua a donor adds when they pledge a donation. A guest donor may optionally leave a name and an email address; both are optional and are never required to donate.
We also keep a technical audit trail of moderation and account actions, and a short-lived client IP address used only for abuse prevention and rate limiting.
How long we keep it, and how to delete it
A guest donor's email address is kept in plain form only while an owner or moderator might still need to confirm a pledge, and is irreversibly hashed thirty days after the pledge leaves its initial "pledged" state. Every guest-facing confirmation email carries a secure, single-use link to delete or anonymize that one donation, shaped like /en/contribute/guest/TOKEN/ with a unique token in place of the example.
A note or dua that has not been approved by the memorial's owner is removed after ninety days rather than held indefinitely. An authenticated donor's own name is anonymized, not deleted outright, if their account is later removed, so a memorial's running total and timeline stay accurate. A moderator's or verifier's identity on past actions is likewise kept as a snapshot label rather than a live link, so removing a staff account never breaks another memorial's history.
Backups of the database and uploaded media are encrypted, taken nightly, and restored on a schedule we test ourselves so a backup is never the first time we discover it does not work. Server access logs are kept for seven days and container logs are capped and rotated automatically; neither is kept longer than operational troubleshooting needs.
A copy of deleted or hashed data may remain in our encrypted nightly backups for up to thirty-five days, after which the backup itself is purged; backups are never restored to serve the site.
An account holder can request deletion or export of their own account at any time from account settings; deletion removes personal identifiers while keeping the memorial content itself intact for the family and community who rely on it, unless the account holder chooses full removal instead.
Sub-processors
Yadgaar uses a small number of third-party sub-processors, and no other outside service ever receives memorial content, donor identity, or note and dua text.
- Cloudflare proxies every request and terminates TLS in front of our servers. Cloudflare sees network-level traffic metadata; it never sees memorial content, donor identity, or note and dua text.
- Our hosted error tracker (GlitchTip or Sentry Developer) receives scrubbed application error reports only: no request bodies, cookies, or headers, no session replay, and no memorial content, donor identity, or note and dua text.
- Resend (transactional email) delivers our sign-in codes and account confirmation emails. Resend receives the recipient's email address and the message body of that one transactional email, never memorial content, donor identity, or note and dua text.
- Twilio (SMS, once enabled) will deliver SMS sign-in codes once SMS sign-in is enabled. Twilio receives only the recipient's phone number and the message text of that one code, never memorial content, donor identity, or note and dua text.
None of these sub-processors is used for advertising, and none receives a copy of any donation, memorial, or moderation record.
No advertising, no behavioral tracking
Yadgaar carries no advertising, performs no behavioral tracking, and shares your data with no third party for marketing purposes. The only information ever shared outward is the note or dua a donor chooses to attach to their own pledge, which is passed only to the charity the memorial or fundraiser already names as its cause.
Analytics
Page-view analytics are aggregate-only, provided by GoatCounter, and carry no per-visitor identifier: no cookie, no fingerprint, and no session replay of any kind. GoatCounter never records a memorial's real slug, only a rotating analytics token that changes whenever the memorial's own visibility or slug changes.
Why there is no cookie banner
GoatCounter sets no cookie, and Yadgaar sets no non-essential cookie; the only cookies are the session and CSRF cookies strictly necessary to sign in and submit forms. That is the condition a banner exists to disclose, and it currently does not apply. If Yadgaar ever ships a feature that sets a non-essential cookie, such as a different analytics provider or a stored preference, a consent banner will be added before that feature launches.
Payments
Yadgaar is referral-only: we never process a payment ourselves and never touch, hold, or route donation money. Submitting a pledge here only hands you off to the charity's own, independently operated payment page; Yadgaar has no payment service provider and no bank or wallet integration of its own at this stage.
Where this data is processed
Yadgaar operates from Pakistan, which as of 2026 has no enacted, comprehensive data-protection law. We nonetheless follow best-practice data minimization, encrypt data in transit and at rest, and honor the deletion and anonymization rights described on this page regardless of where you or your data are located.
Contact
Questions about your data, or a request this page does not already cover, can be sent to [email protected].