Complete Anonymous Donation Workflow with GDPR-Compliant Identity Controls and Optional Disclosure

[grantfox-oss]

Description

The current system supports anonymous donations at the schema level, but the end-to-end workflow is incomplete and inconsistent across checkout, campaign display, data retention, and post-donation identity management.

This issue focuses on fully implementing a robust anonymous donation system that respects user privacy while still allowing optional identity disclosure for use cases such as tax reporting or donor verification.

Problem Statement

While anonymous donations can be recorded, the application currently lacks:

• A clear checkout option to choose between anonymous and identified donations.
• Consistent handling of anonymous donors in campaign displays and leaderboards.
• Support for bulk or grouped anonymity (e.g., organizational or pooled donations).
• A defined GDPR-compliant strategy for storing or minimizing personal data in anonymous donations.
• A mechanism for donors to optionally reveal their identity after donating.

As a result, anonymity is inconsistently applied and not legally or operationally robust.

Scope

1. Checkout Flow: Anonymous vs Identified Donations

• Add a clear option during checkout:

  • “Donate anonymously”
  • “Donate with identity”

• Ensure the selection is persisted in the donation record (e.g., isAnonymous: boolean).

• Prevent accidental leakage of identity data in metadata when anonymous is selected.

2. Campaign Display Logic

• Anonymous donations must not expose:

  • User names
  • Profile images
  • Email or identifiers

• Replace donor identity with a consistent placeholder such as:

  • “Anonymous”
  • “Anonymous Donor”

• Ensure leaderboards and donation feeds respect anonymity flags.

3. Bulk Anonymity for Groups

• Support group or batch donations marked as anonymous at the group level.
• Ensure all child donations inherit anonymity unless explicitly overridden.
• Maintain audit consistency while preserving privacy.

4. GDPR-Compliant Data Retention

• Define clear data retention rules for anonymous donations:

  • Minimize stored personal data where anonymity is selected.
  • Avoid storing unnecessary identifiers (email, user ID linkage beyond required audit scope).

• Ensure compliance with GDPR principles such as data minimization and purpose limitation.

• Document retention policy for anonymous vs identified donations.

5. Post-Donation Identity Disclosure

• Allow donors to optionally reveal their identity after donation:

  • Useful for tax receipts or verification purposes.

• Implement a secure flow to:

  • Link anonymous donation → user account (if requested)
  • Regenerate receipts with identity if applicable

• Ensure this action is explicitly opt-in and logged for audit purposes.

6. API and Backend Updates

• Extend donation schema and services to support:

  • isAnonymous
  • Optional revealedAt or identity-linking timestamp

• Ensure APIs correctly filter sensitive data for anonymous donations.

• Maintain backward compatibility with existing donation records.

7. Security & Privacy Considerations

• Prevent inference attacks where multiple metadata fields could re-identify anonymous donors.
• Ensure logs, analytics, and third-party integrations respect anonymity flags.
• Sanitize event tracking and analytics pipelines.

Acceptance Criteria

• Users can select anonymous or identified donation at checkout.
• Anonymous donations never expose donor identity in UI or APIs.
• Campaign pages consistently display “Anonymous” for anonymous donations.
• Bulk/group donations correctly propagate anonymity settings.
• GDPR-compliant data minimization is implemented for anonymous donations.
• Donors can optionally reveal identity after donating in a secure flow.
• Analytics and logs respect anonymity constraints.
• Existing donation flows remain unaffected for identified donations.
• System passes privacy and regression checks for mixed donation types.

[Silver36-ship-it]

I would love to work on this professionally, please assign it to me

[ekwe7]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery

[Babigdk]

I’d like to work on this issue.

I have experience implementing privacy-sensitive flows and backend-consistent UI logic in TypeScript systems, especially around user identity masking, conditional data exposure, and audit-safe state transitions.

For this task, I will:

• Extend the donation flow to support "isAnonymous" selection during checkout and persist it in the donation record
• Ensure all UI components (campaign pages, feeds, leaderboards) strictly respect anonymity flags and never expose identity data when anonymized
• Implement consistent placeholder handling (“Anonymous”) across the system
• Add support for group/bulk donations where anonymity propagates correctly while preserving audit integrity
• Update API and schema layers with backward-compatible fields ("isAnonymous", optional identity linking timestamp)
• Ensure GDPR-aligned data minimization by preventing storage or propagation of unnecessary identifiers in anonymous flows
• Add a secure opt-in identity reveal flow with explicit consent and audit logging
• Verify logs, analytics, and event tracking do not leak identity for anonymous donations

I will also include regression checks to ensure existing identified donation flows remain unaffected.

[GBOYEE]

I'm interested in tackling this! I have strong experience with devops and can deliver a clean solution.

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!

[jaynomyaro]

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

[teethaking]

Hey maintainer,

I'll take on #116 and build out this anonymous donation pipeline. Balancing strict user privacy and GDPR data minimization principles with the operational need for optional downstream disclosure requires highly deliberate backend data handling, and I'm ready to lock it down for aid-linkk/aidlink-backend.

Here is my direct plan to implement this architecture:

• Privacy-First Schema & API Filtering: I will extend the donation models to introduce isAnonymous: boolean and an optional audit-safe identityRevealedAt: Date | null. Crucially, I will wrap the public query serializers and API layers so that when isAnonymous is true, names, emails, and profile links are completely stripped at the query level before reaching the transport layer, feeding clean placeholders like "Anonymous Donor" to campaign boards and feeds.
• GDPR-Compliant Storage & Isolation: For anonymous entries, I will apply immediate data minimization—ensuring optional metadata or analytics tracking records are completely sanitized of tracking cookies or PII (Personally Identifiable Information). For bulk or pooled organizational entries, I'll enforce cascading anonymity down to nested entries unless explicitly overridden.
• Secure Opt-In Identity Disclosure: I will implement a highly secure, transactional endpoint that allows a donor to optionally link their anonymous record to a validated account post-facto (e.g., for generation of tax receipts). This process will require explicit token/session verification, update the database within an isolated write lock, and write an immutable log entry to the audit track without leaking the historical anonymity state to public views.

I will ensure backward compatibility with existing non-anonymous data records and write comprehensive regression and privacy tests to guarantee zero identity leaks across your endpoints.

Go ahead and assign this issue to me, and I'll deliver a clean, robust PR!

[GBOYEE]

I'm interested in tackling this! Strong frontend background, clean PR coming shortly.

[GBOYEE]

I'm interested in tackling this! Strong frontend background, clean PR coming shortly.

[GBOYEE]

I'm interested in tackling this! Strong frontend background, clean PR coming shortly.

[GBOYEE]

I'm interested in tackling this! Strong frontend background, clean PR coming shortly.