\begin{abstract}
This project describes the design of a privacy-preserving donation
system. The central entity in the design is the donation authority
(Donau) which was implemented in free software in the context of the
GNU Taler project. While implemented primarily for GNU Taler, the
system could in principle work with other payment systems.

Providing evidence of charitable donations for tax deductions often requires
sensitive personal information, raising privacy concerns.
Donors may wish to anonymize receipts while still being able to make
legitimate donations to recognized charities. On the other side tax authorities
may wish to better prevent donation fraud with verifiable signatures.
Deductions for unrecognized charities or failure to deduct valid foreign
donations also occur. A system allowing anonymous yet verifiable donation
receipts would address these issues. The Donau would be operated by a tax
authority. The Donau backend
implements a REST API used primarily by charities and donors. It
maintains a list of recognized charities, enabling tax authorities to
audit the total amount of donation receipts each charity is
issuing. Upon making a donation to one of the charities the donor
receives a \textit{donation receipt} which will be stored locally on
the donor’s device. Throughout this process neither the charity nor
the Donau obtains any identifiable information about the donor,
thus enabling anonymous donations. To simplify the verification for
the tax authority, the donor needs to submit their donation receipts
to the Donau at the end of the year. At that time, the Donau can
combine the individual donation receipts in one final annual
\textit{donation statement}. Upon request of the tax authority, the
donor can provide this donation statement to the tax authority which
can check its validity and can then approve the tax deduction.

\end{abstract}
