Privacy
What this site collects
Last updated: 3 November 2026
Short version: the amount you send, the name and note you type, and two things Stripe passes back after the payment, your email address and your country. Server logs that rotate and are deleted after 30 days. No analytics, no advertising, no cookies of its own. Nobody gets any of it for their own use.
The payment record
When you press the button, this site sends Stripe the amount and the name and note you typed, and Stripe opens its checkout on its own domain. You type your card and your email address there, not here. When the payment goes through, Stripe hands this site the result: the amount, the currency, Stripe's identifiers for the checkout and the payment, the email address you gave at the checkout and the country Stripe attached to the payment. The name and note come back with it. I keep that as one record, so that the note can be made out to you, so that a refund can be matched to a payment, and because payment records have to be kept for the accounts.
The basis is the contract you enter into when you pay (Article 6(1)(b) GDPR) and the accounting and tax rules that apply to a business registered in Poland (Article 6(1)(c) GDPR). Stripe's checkout asks for an email address with every payment, so there is no payment without one; it is how a refund or a receipt finds you.
How long: payment records stay for as long as the accounting and tax rules in Poland require me to keep them. After that they go. If you ask me to delete the name and note before then, I do that at once and keep only what the accounts need: the amount, the date and Stripe's identifiers.
The wall
The name and note you type can appear on the public wall on the home page, together with the amount and the date, exactly as typed. Nothing appears automatically: a human reads each entry first, and anything unkind, unlawful, or not yours to publish stays off. If you type "anonymous" as the name, nothing goes on the wall. The wall is public and can be read, copied and quoted by anyone. If you want your entry taken down, write to hello@onedollar.help from the address you paid with, and it comes down. The basis is the contract: putting the name on the wall is the one thing this site promises to do with it, and the terms say so.
Stripe
Stripe takes the card and the payment. On its checkout page Stripe collects your card details, your email address and whatever else it needs to run the payment and to meet its own legal duties, under its own privacy policy. For the card data and for its own duties, Stripe is a separate controller. For the amount, the name and the note it carries for this site, it acts for me. Stripe sets cookies on its own page, not here. The full card number and the security code never reach me; in Stripe's dashboard I see the card brand, the last four digits, the expiry and the card's country. Stripe's European entity is Stripe Payments Europe, Ltd. in Ireland, and Stripe, Inc. is in the United States. Stripe's privacy policy states that Stripe, Inc. complies with the EU-U.S. Data Privacy Framework for transfers from Europe to the United States, and that where that framework does not apply Stripe relies on the EU standard contractual clauses.
Server logs and error reports
The web server records each request: your IP address, the page asked for, the browser string and the other headers the browser sends. It writes them to files of up to 20 MB, keeps five closed files at most and deletes closed files older than 30 days. The checkout reference in the address of the thank-you page is cut out of that log. The application behind the checkout keeps its own log, set to delete entries older than 30 days, and that log never contains the note you typed. To stop the form being abused, a counter holds your IP address for up to ten minutes after the last attempt. The basis is my legitimate interest in keeping the site secure and working (Article 6(1)(f) GDPR).
When something breaks in the checkout code, an error report goes to Sentry: what failed, where in the code and on which page, without your IP address, without cookies and without what you typed. Sentry keeps reports in its EU region in Frankfurt and deletes them after 30 or 90 days, depending on the plan.
Fonts, theme, and what this site does not do
The three typefaces on this site are loaded from Google Fonts. When your browser fetches them, Google (Google LLC, United States) receives your IP address and browser string, under Google's privacy policy; Google states that the Fonts service sets no cookies, and that Google LLC complies with the EU-U.S. Data Privacy Framework for data transferred from the EU to the United States. That is the only third party your browser talks to on this site, apart from Stripe when you choose to pay.
If you change the theme with the button in the top bar, the choice is stored in your browser's local storage, on your device only. It is not a cookie and it is never sent anywhere.
This site runs no analytics, sets no cookies of its own, shows no advertising and does not follow you to other sites.
Who else handles it
The server is rented from OVH (OVH SAS, a French company) and stands in Frankfurt, Germany. The payment records and the logs are kept there. Backups of the database, made every six hours, are stored with Backblaze (Backblaze, Inc., a US company) in its EU Central region in Amsterdam, the Netherlands; copies older than 14 days are deleted, on the server and at Backblaze. Backblaze's data processing addendum for customers in the EEA applies the EU standard contractual clauses to these transfers. Error reports go to Sentry (Functional Software, Inc., a US company), stored in its EU region in Frankfurt. Sentry states that it complies with the EU-U.S. Data Privacy Framework for transfers from Europe to the United States, and its data processing agreement falls back on the EU standard contractual clauses if that framework is invalidated or does not apply. Payments go through Stripe, and fonts come from Google, both described above, each with the same two mechanisms. The list of organisations certified under the framework is public at dataprivacyframework.gov. The pages of this site do not go through any content delivery network.
Your rights
You can ask what I hold about you and for a copy of it, and ask for it to be corrected, deleted or restricted. You can ask for the data you gave me in a format you can take elsewhere. You can object to any use that rests on my legitimate interest, which here means the logs and the error reports; write and I stop, unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend a legal claim. One email to hello@onedollar.help is enough. Payment records that the accounting rules require me to keep stay until that period ends, even if you ask for deletion; everything else goes.
You also have the right to complain to a data protection authority. In Poland, where I am registered, that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). If you live in another EU or EEA country, you can complain to the authority there instead; the European Data Protection Board lists them.
Nothing here makes a decision about you by automated means that has legal or similarly significant effects. Whether a name goes on the wall is decided by a person.
Contact for anything on this page: hello@onedollar.help. Controller: Skrutiny Sebastian Koczyk, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland.