Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because we are not legally required to. Please send any privacy question to the address above.

2. The short version

• You can make memes without an account. Images you process but do not publish are not stored in the gallery.
• If you sign in with Google we receive your name, email address and profile picture.
• What you publish (images, titles, descriptions, comments, your username, avatar, rank and statistics) is public.
• Before anything is published, it is checked automatically for prohibited content by a classification service operated by OpenAI.
• Analytics only run if you agree in the cookie banner. We show no ads and sell no data.

3. Visiting the site: hosting and server logs

When you open the site, your browser sends technically necessary data to our hosting provider: IP address, date and time, the page requested, referrer, browser and operating system. This data is needed to deliver the site, keep it stable and secure, and defend against attacks. Logs are kept for a short period and then deleted or anonymized.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the site.

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Our database runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Uploaded images are stored with an S3-compatible object storage provider and are always delivered through our own domain. We have concluded data processing agreements with these providers (Art. 28 GDPR). For transfers to the USA see section 9.

Fonts are served from our own domain. No request is made to Google Fonts.

4. Using the meme maker without an account

Still images are combined with the speech bubble in your browser and are not uploaded to us unless you publish them. Animated GIFs are sent to our server, processed in memory to apply the bubble to each frame, and returned to you. We do not store them and do not add them to the gallery.

Your editor settings and your light or dark theme choice are saved in your browser's local storage so they are remembered on your next visit. This is strictly necessary functionality that you requested (Section 25(2) no. 2 TDDDG) and is not used to track you.

Legal basis: Art. 6(1)(b) GDPR (providing the function you request) and Art. 6(1)(f) GDPR.

5. Your account (Sign in with Google)

Accounts are created exclusively through "Sign in with Google", provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you sign in, Google tells us your name, email address, profile picture and a Google account identifier. We never see your Google password. Google processes your sign-in under its own privacy policy.

We store this data together with your username, the date you accepted the Terms of Service and their version, your avatar if you upload one, your XP, rank and statistics, and any restriction placed on your account. A session cookie keeps you signed in. It is strictly necessary and requires no consent (Section 25(2) no. 2 TDDDG).

Your email address is never shown publicly. Your name, username, avatar, rank and statistics are public.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract).

6. What you publish

When you publish to the gallery we store the image, its title and description, the time of publication and the link to your account. We also store your comments, votes and favorites. Favorites are visible on your profile. Votes are shown as totals only.

Published content is public, can be indexed by search engines, and can be viewed, downloaded and shared by anyone. Please do not publish images that show other people without their consent, and do not put personal data in titles, descriptions or comments.

You can delete your own posts at any time. Deleting a post also deletes its comments, votes and favorites.

Legal basis: Art. 6(1)(b) GDPR.

7. Automated content check and moderation

To keep illegal and harmful content out of the public gallery, every image with its title and description, every comment, every username and every avatar is checked automatically before it is published. For this we send the content (for images, a reduced-size copy; for GIFs, the first frame) to the moderation interface of OpenAI (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland, with processing by OpenAI, L.L.C., USA). We do not send your name, email address or account identifier with it. According to OpenAI, content sent through this interface is not used to train its models.

The check returns whether the content falls into categories such as sexual content, harassment, hate, violence or self-harm. Flagged content is not published and you are told why. This is an automated decision about whether a specific piece of content is published. It has no legal effect on you and no similarly significant effect. You can always ask for a review by a person by writing to [email protected].

Administrators can remove content and restrict accounts that break the Terms of Service. We store the fact and date of a restriction and, where given, the reason.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests are protecting users, in particular minors, preventing the distribution of illegal content, and meeting our obligations as a hosting provider under the Digital Services Act. Where we are legally obliged to act, the basis is Art. 6(1)(c) GDPR.

8. Analytics (only with your consent)

If, and only if, you agree in the cookie banner, we use Google Analytics 4, provided by Google Ireland Limited, to understand how the site is used in aggregate, for example which pages are visited and which features are used. Google Analytics sets cookies and processes usage data, an online identifier and your IP address, which is shortened before storage. Google may transfer data to Google LLC in the USA.

Without your consent no analytics script is loaded and no analytics cookies are set. You can withdraw or change your choice at any time with the "Cookie settings" link in the footer. Withdrawing does not affect processing that happened before.

Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Analytics data is retained for 14 months at most.

9. Recipients and transfers outside the EU

We share personal data only with the service providers named in this policy, who process it on our instructions, and with authorities where we are legally obliged to, for example when reporting content depicting child sexual abuse. We do not sell personal data.

Vercel, Google and OpenAI are based in, or transfer data to, the USA. These transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards.

10. How long we keep data

• Account data: until you ask us to delete your account. We delete or anonymize it within 30 days of your request.
• Published content, comments, votes, favorites: until you delete them, we remove them, or your account is deleted.
• Content blocked by the automated check: it is not stored by us.
• Records of restrictions and of reports about illegal content: for as long as needed to enforce our terms and to defend legal claims, usually up to three years after the matter is closed.
• Server logs: a short period, generally no longer than 30 days.
• Data we must keep by law: for the statutory retention period.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17), including deleting your account,
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object at any time to processing that is based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, write to [email protected] from the email address linked to your account so we can verify it is you. We respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example at your place of residence. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

12. Do you have to provide data?

No. You can browse the gallery and make memes without providing personal data beyond what is technically needed to deliver the site. An account, and therefore the Google sign-in data, is only required to publish, comment, vote, favorite and earn ranks.

13. Minors

Accounts are only for people aged 16 or older. We do not knowingly collect personal data from younger children. If you believe a child has created an account, contact us and we will delete it.

14. Links to other services

The site links to Discord and X. We do not embed their content, so no data is sent to them until you click the link. From then on their own privacy policies apply.

15. Changes to this policy

We update this policy when the Service or the law changes. The current version is always available on this page, with the date of the last update at the top. If a change materially affects how we use data you already gave us, we will tell registered users in advance.