Beta notice
This site is a test-mode beta owned by an individual. No real money is processed: payments use Stripe test mode and nothing is charged. Nothing here is tax advice, and no organization named here has received any donation. The lists below are the open questions before ownership moves to a 501(c)(3) and before real money is taken.
Ownership transfer checklist
Questions to settle before ownership moves from the individual who runs this beta to the 501(c)(3).
| Item | Owner | Status |
|---|---|---|
| Domain registrar account, registrar lock and DNSSEC (registrar separate from the host) | Owner (individual) | Open |
| Hosting account (VM / provider) and who holds admin access | Owner (individual) | Open |
| Email provider account (transactional SMTP) and a second provider configured | Owner (individual) | Open |
| GitHub organization for the code, plus a mirror on a second Git host | Owner (individual) | Open |
| Stripe account owner and legal representative (to confirm which entity) | Owner (individual) | Open |
| Bank accounts: primary and a second bank at a different institution | Owner (individual) | Open |
| Postgres data, backups to two providers, and escrow of the backup password with two officers | Owner (individual) | Open |
| Secrets rotation: Django SECRET_KEY, player-cookie key, Stripe keys and webhook secret, database passwords | Owner (individual) | Open |
| Legal party named in the privacy policy (who the 'we' is) | Counsel / board (TBD) | Open |
| Trademark and rebrand of the games (no third-party names, numbering, palette or share text) | Counsel / board (TBD) | Open |
| Who holds the admin MFA recovery codes (printed, sealed, held by two officers) | Owner (individual) | Open |
Real-money onboarding checklist
Questions to settle before this site accepts real gifts. Until then, Stripe stays in test mode.
| Item | Owner | Status |
|---|---|---|
| 501(c)(3) determination letter and EIN (or a fiscal sponsor agreement in the meantime) | Counsel / board (TBD) | Open |
| List of state charitable-solicitation registrations required before launch (to confirm with counsel) | Counsel / board (TBD) | Open |
| Stripe account activation and the nonprofit discount application (actual rate to confirm) | Owner (individual) | Open |
| Bank account and a second bank account opened; which banks carry humanitarian wires to the region | Owner (individual) | Open |
| Receipt text and issuer name/EIN approved (replace the placeholders in settings) | Counsel / board (TBD) | Open |
| Counsel sign-off on the pooled-funds notice and the wording of program preferences | Counsel / board (TBD) | Open |
| OFAC screening procedure: list snapshots, manual search with evidence, re-screen within 24 hours of each disbursement | Counsel / board (TBD) | Open |
| Partner entity documents for the Sameer and Zaynab projects (legal form, IRS status, invoices); nothing is wired until on file | Counsel / board (TBD) | Open |
| PCI SAQ A attestation (annual) | Owner (individual) | Open |
| Live webhook endpoint and live-mode key rotation plan | Owner (individual) | Open |
| Backups to two providers and a restore drill from the escrowed password | Owner (individual) | Open |
| Legal-request policy approved by counsel | Counsel / board (TBD) | Open |
| Data retention period set by counsel (design assumes 7 years, to confirm) | Counsel / board (TBD) | Open |
| Braintree standby application and warm-standby processor | Owner (individual) | Open |
| Arabic / RTL translation plan | Owner (individual) | Open |
| Games rebrand and review of the framing (including any BDS-related framing) by counsel | Counsel / board (TBD) | Open |
See also privacy (draft) and terms (draft).