Privacy Policy

Who we are

make-a.meme is operated by Make-a.meme, based in the United Kingdom. We are the controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us about this policy or your personal data at [email protected].

What we collect

Account data: your username, email address, display name, password stored only as a secure hash, optional bio and avatar, and account creation date. If you choose to sign in with Google, we receive your Google account email, name and profile picture as shared by Google.

Content and activity: memes, uploads, collections, likes, bookmarks, comments and follows. Published memes are visible to anyone. Profiles are private by default, but your profile is visible to anyone if you make it public. Leaderboards show your username and display name.

Contact form data: your name, email address, subject and message, together with your IP address, browser user agent and referring page for spam and abuse prevention.

Security and technical data: IP addresses associated with failed login attempts to block brute-force attacks, server logs containing IP addresses, requests, timestamps and user agents, and error reports.

Cookies and similar technologies

We use strictly necessary cookies only: a session or authentication cookie that expires after 24 hours, a CSRF security cookie to protect against forged requests, and a language preference cookie.

We do not use advertising or cross-site tracking cookies, and we do not currently use analytics cookies. If this changes, we will ask for your consent before setting cookies that require it.

How we use your data and our lawful bases

We use account data and content to provide your account and the meme tools. Our lawful basis is performance of our contract with you.

We use your email address to verify your email and send service emails. Account verification is part of providing our service under our contract with you. Replies to contact requests are based on our legitimate interest in helping people who contact us.

We use security and technical data to keep the site secure, prevent spam and abuse, and fix errors. Our lawful basis is our legitimate interest in operating a safe, reliable service.

We display public content you choose to publish as part of providing the service under our contract with you. You control whether to publish your memes or make your profile public.

Where we must process or retain data to comply with the law, our lawful basis is compliance with a legal obligation.

We do not sell personal data or use it for advertising profiling.

Automated processing and AI

We use AI services to analyse meme templates and publicly crawled memes, for example to suggest text box positions, tags and translations. Your personal account data is not sent to these services. We do not use your private content to train AI models.

Who we share data with

We use a small number of service providers to operate make-a.meme. Providers processing personal data on our behalf act on our instructions. They receive the data needed for the services described below.

Cloudflare provides website delivery and security and sees IP addresses and requests.

Our hosting provider, netcup, runs the servers that store and process our service data in Germany (EU).

Brevo sends service emails, such as verification emails and replies to contact requests.

Google provides authentication only if you choose “Sign in with Google”. Google also processes data under its own privacy policy when you use its services.

Sentry provides error monitoring and may receive technical data, such as your IP address and browser details, when an error occurs.

Anthropic, Z.AI, OpenRouter and Together AI provide AI services for template analysis and translation. They receive template and public meme images and text only, not personal account data.

We may also share data with authorities where required by law.

International transfers

Our servers are in the European Union, which the UK recognises as providing adequate protection. Some providers process data elsewhere, for example in the United States. Where this happens, we rely on applicable UK adequacy regulations or appropriate safeguards, such as Standard Contractual Clauses together with the UK International Data Transfer Addendum.

You can email [email protected] to ask about the safeguards that apply to your data and how to obtain a copy.

How long we keep your data

Account data and your content: we keep these while your account is active and delete them within 30 days of an account deletion request, except where we must keep limited records for purposes such as abuse prevention or legal claims.

Contact form messages: up to 24 months.

Security logs and failed-login records: up to 90 days.

Server and error logs: up to 30 days.

Your rights

Under UK data protection law, you have rights to access and correct your personal data, request deletion, restrict processing, object to processing, and receive or transfer your data through data portability. These rights apply in the circumstances set out by law.

Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before you withdrew consent.

To exercise your rights, email [email protected] from the address on your account. We respond within one month. You can delete individual memes yourself. To delete your whole account, email us; self-service account deletion is coming.

You have the right to complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to help resolve your concern first, but you do not have to contact us before making a complaint.

Children

make-a.meme is not intended for children under 13. We do not knowingly collect their personal data. If you believe a child under 13 has provided personal data, contact [email protected] so we can remove it.

Content from other sites

Some meme templates and example memes come from public sources. If you are the rights holder or appear in content and want it removed, contact [email protected].

Security

We use HTTPS, securely hashed passwords, rate limiting and brute-force protection to help protect your data. Access is limited to staff who need it to do their work. No method of storage or transmission is 100% secure.

Changes to this policy

We will update this page and the “Last updated” date when this policy changes. For significant changes, we will notify account holders by email.