Short, because we hold very little.

The controller is Damjan Dimic s.p., trading as Worthly, Na griču 10, 1000 Ljubljana, Slovenia. Registration number 9102507000, tax number 55647871. Damjan Dimic is the person responsible, and hello@worthly.org reaches him directly.

You can complain to us, and you can complain over our head to the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, https://www.ip-rs.si. You do not have to ask us first.

The lawful basis for a booking, an account and a professional’s page is performing what you asked for. For the mailing list it is your consent, which you gave by typing your address into the follow box and can withdraw with the unsubscribe link in any email. For keeping the site up and stopping abuse it is our legitimate interest in the thing continuing to work.

This is the privacy notice for worthly.org. You can book a session and you get an account when you do. Nothing on this site can charge you, and we hold no card details anywhere. Giving happens on the charity’s own page.

If you email us (hello@worthly.org) or use a mailto form, we receive whatever you include in that message: name, craft, links, and your questions.

If you join Worthly or ask someone for a session, we keep what you typed into that form so we can actually arrange it: your name, email, phone number if you gave one, the options you are weighing, what makes the choice difficult, the outcome you want, and anything else you wrote.

After a session, we keep whether you said it happened as planned, had a problem, or did not happen, plus any private detail you chose to send for recovery. That answer is not a public rating. It decides whether the giving step opens and lets the operator fix a failed first session before asking anything else of you.

Our host and our database keep short-lived operational logs, which include IP addresses, for the same reason every server does: to stay up and to stop abuse. We do not read them for anything else.

Our own rate limiter needs to know that two requests came from the same place, so that nobody can sit and guess a password or post a thousand sign-in links to somebody else’s inbox. It never needs to know where that place is, so it does not store it: the address is put through a keyed hash and only the result is kept. It cannot be turned back into an address by us or by anybody who reads the table.

Registering a charity means giving us its legal name, registration number, country, a website, a contact name and email, and where money should arrive. We keep those to check the charity is what it says and to send money to the right place. Payment routing and the contact address are never shown on any public page. The public charity page reads only the name, the description and the link.

The follow box in the footer keeps your email address and nothing else. We write when something real happens. Every message has an unsubscribe link, it works immediately, and unsubscribing deletes the address rather than flagging it.

We keep an account and its bookings for as long as the account exists, and delete everything within thirty days of you asking. There is no automatic expiry running today and we are not going to claim one until it is written and tested.

Booking a session makes you an account here, matched on the email you booked with. There is no signup step and no password to make: the link in your confirmation email is the account, it works once, and asking for a new one at worthly.org/login takes fifteen minutes off the clock.

The account holds your email, the name you gave, the sessions you booked, their private preparation answers and check-ins, and any amount you recorded against one of them. We do not hold a card, a postal address, or anything you did not type into a form on this site.

You can see all of it at worthly.org/me, which is the same page that holds it. Nothing about you is kept anywhere you cannot open.

For as long as you have it. A record of what you gave is the point of having one, and deleting it on a schedule you did not choose would be a strange way to treat it.

There is no automatic expiry running today and we would rather say that than promise one. If we ever add a rule that deletes dormant accounts, this page will carry it before it runs and nobody will find out from an empty page.

Deleting is one button on worthly.org/me and it takes effect immediately. It removes your account, everything you recorded about what you gave, and your name, email, preparation answer, check-in detail and notes from every booking you made. The booking itself stays in the professional’s diary with nobody attached to it, because a session they gave genuinely happened and that record is theirs.

The public ledger on worthly.org/impact has only ever published totals and the charities they reached. It has never named who gave, so nothing there changes when you leave.

We count how many times each page is opened, and nothing else. The count lives in our own database. There is no third-party analytics on this site.

What is stored is one number per page per day, plus the name of the site that sent you here if there was one. The site’s name on its own, never the full address, because a full address can carry a search you typed. No IP address, no device fingerprint, no profile.

We set no analytics cookie, so we genuinely cannot tell whether ten opens are ten people or one person reading twice. We say 'opens' because that is all we know. There are cookies on this site, but they are the ones that keep you signed in and nothing else. The section below lists them by name.

If you block scripts, you are not counted at all. That is fine by us.

Nobody buys it, nobody is sent it for marketing, and there is no advertising or analytics company in this list. What is here is the four suppliers it takes to run a website that can send an email.

Vercel hosts the site and runs the code. Neon runs the database, in an EU region. Vercel Blob stores the photographs and recordings that professionals upload to their own pages. Resend sends every email this site sends, from sign-in links to booking confirmations to the follow list, and receives anything forwarded to receipts@in.worthly.org, so it sees the address at either end.

Google is the fifth, and only if you choose it. If you photograph a donation receipt so that it counts on the public ledger, that one image is sent to Google's Gemini to have the amount read off it, and nothing else on this site ever goes near them. Type the amount, forward the email, or skip the evidence entirely and Google is not involved at all.

Each of them acts on our instructions and may not use any of it for their own purposes. Vercel, Resend and Google are American, so where data reaches them it leaves the EU under the standard contractual clauses and their own transfer frameworks. If you would rather not have an email address handled that way, the honest answer is that you cannot use a site that emails you a sign-in link, and you are welcome to write to us instead.

You never have to. Deciding an amount, paying the charity and telling us it went through all work without sending us anything, and your own record shows it either way. The only thing a receipt buys is a place on the public total, which counts nothing on our word or on yours.

If you photograph one, the image is read and then dropped. It is not saved to our storage, there is no page it can be viewed on, and nothing here can retrieve it afterwards. What we keep is the amount, the currency, the date, the organisation named on it, any Worthly reference visible, and a fingerprint of the image so that the same one cannot be counted twice. The picture itself does not survive the upload.

If you forward the charity’s email to receipts@in.worthly.org instead, we keep the amount and the reference we find in it, and a fingerprint of the message. Both routes are deliberately narrow: the aim is to learn one number, not to hold your payment records.

A receipt often carries your name, sometimes an address and occasionally the last four digits of a card. That is precisely why none of it is stored, and why the fingerprint is a one-way hash rather than the document. Fingerprints are cleared after thirty days by the same nightly job that does the rest of the housekeeping.

There is no cookie banner here because there is nothing to consent to: every cookie on this site exists to keep you signed in, none of them tracks you, and none is shared with anybody.

There are three. worthly_session signs in a professional to their own page. worthly_account signs in someone who has booked a session, so /me can show what they gave. worthly_charity signs in a registered charity to confirm money arrived. Each is signed so it cannot be edited into somebody else’s account, and each disappears when you sign out.

That is the whole list. If you find another cookie on worthly.org, it is a mistake and we would like to be told about it.

You can ask what we hold about you and get a copy. You can have anything wrong corrected. You can have it deleted. You can ask us to stop using it while a disagreement is sorted out, you can object to us using it at all where we are relying on our own legitimate interest, and you can ask for what you gave us in a portable file. Where you consented, and the mailing list is the only place you did, you can withdraw that at any time without it affecting what happened before.

For most of it you do not have to ask anybody: everything about a giver is on worthly.org/me, everything about a professional is on their own dashboard, and both pages carry the button that deletes it. For anything else, hello@worthly.org reaches one person and we answer within a month, which is the legal limit and far longer than it will actually take.

We do not make any automated decision about you and there is no profiling on this site.

We do not sell your personal information.

We do not run third-party analytics, advertising or tracking scripts.

We do not keep any image or document you send us. Receipts are read for one number and dropped.

We do not build a profile of you across pages or across visits.

We do not run a payment processor, and this is now an architectural fact rather than a 'not yet'. Giving happens on the charity's own donate page, so a card number never reaches this site to be stored, leaked or subpoenaed. When we open that page for you it carries the amount you decided and a reference, and it carries your name or email only if you tick the box that says so.

Email inquiries are kept as long as needed to respond and operate the campaign, then deleted or archived when no longer useful.

If you have an account, everything we hold about you is on worthly.org/me, and the button that deletes it is on the same page. You do not have to ask anybody.

You can email hello@worthly.org to ask what we hold about you from correspondence, or to request deletion of that correspondence where practical.

Questions about privacy: hello@worthly.org

Worthly · Built in Slovenia