Privacy Policy

What Does This Privacy Policy Cover?

This Privacy Policy covers our treatment of your personally identifiable information ("Personal Data") gathered when you are using or accessing our Services. This Privacy Policy also covers our treatment of any Personal Data that our business partners share with us.

This Privacy Policy does not apply to the practices of third parties that we do not own or control, including third-party websites, services, and applications that you may access through our Services. We encourage you to carefully review the privacy policies of any third-party services you access.

What Personal Data Do We Collect About You?

We collect Personal Data about you when you provide it directly to us, when third parties such as our service providers provide us with Personal Data about you, or when Personal Data is automatically collected in connection with your use of our Services.

Personal Data You Provide to Us

Account Information: If you create an Account using Google OAuth, we receive Personal Data that you have made available through your Google account, such as your email address, display name, and profile picture. You acknowledge that by creating an Account you allow us to identify you. We use your Account information to provide you with our Services and to send you communications about our Services.

User Content: Some features of our Services allow you to provide content, including AI-generated meme images and the text prompts you enter to create them (together, "User Content"). After you terminate your Account or your access to our Services is terminated, we may retain and continue to use certain User Content (e.g., a meme image that was publicly shared) in a manner that does not reveal Personal Data.

Portrait Rights & Uploaded Images: If you upload images containing identifiable individuals (including public figures), you are solely responsible for obtaining all necessary consents and permissions. MemeScribble transforms uploaded images into caricature-style illustrations but does not verify consent from depicted persons. All legal liability arising from portrait rights (right of publicity / right of likeness) violations rests exclusively with the uploading user. MemeScribble assumes no responsibility for any claims, damages, or legal actions resulting from the use of such images.

Personal Data Collected Automatically

We automatically receive and record data from your web browser or device when you interact with our Services. Information that we collect automatically includes your IP address (stored only as a SHA-256 hash of the first 16 characters — the original IP is never stored), device information, and cookie data. This information is used to enforce daily generation credit limits, prevent abuse and spam, and improve our Services.

Generally, our Services automatically collect usage information such as the number and frequency of visitors to the Site. We may use this data in aggregate or anonymized form to analyze and improve our Services, but not in a manner that would identify you personally.

Information Collected Using Cookies

• Cookies are pieces of text provided to your browser when you access a website. We use cookies to maintain your login session and to recognize your browser across visits.
• Our cookies do not, by themselves, contain Personal Data. However, we may match cookies with your Personal Data to identify you and associate that information with your Account.
• We use Supabase authentication cookies to maintain your login session, and Cloudflare Turnstile cookies for bot prevention purposes.
• Most browsers offer an option to disable cookies. Disabling cookies may limit your ability to use certain features of the Services, including logging in.

Aggregate Information

We collect statistical information about how both unregistered and registered users collectively use our Services ("Aggregate Information"). While some of this information is derived from Personal Data, the Aggregate Information itself is not Personal Data and cannot be tied back to you, your Account, or your web browser.

Personal Data of Children

We do not knowingly collect or solicit Personal Data from anyone under the age of 13. If you are under 13, please do not attempt to register for our Services or send any Personal Data about yourself to us. If we learn that we have collected Personal Data from a child under age 13, we will delete that information as quickly as possible. If you believe that a child under 13 may have provided us Personal Data, please contact us at privacy@memescribble.com.

How, and With Whom, Is My Personal Data Disclosed?

We do not sell your Personal Data.

Publicly Displayed Data

AI-generated meme images you create may be displayed publicly in our gallery by default, along with an estimated country flag derived from your IP address. We will not directly reveal your email address to other users.

Personal Data Disclosed to Our Service Providers

We employ and contract with third parties that perform certain tasks on our behalf (our "service providers"). We may need to share Personal Data with our service providers in order to provide our Services to you. Our service providers do not have any right to use Personal Data beyond what is necessary to assist us.

※ All of the above services are hosted in the United States, which means your Personal Data is transferred internationally. By using our Services, you consent to this transfer.

Personal Data Disclosed Pursuant to a Change in Control

In some cases, we may choose to buy or sell assets. In these types of transactions, Personal Data is typically one of the transferred business assets. If we, or substantially all of our assets, were acquired, or if we go out of business or enter bankruptcy, Personal Data would be one of the assets transferred or acquired by a third party.

Personal Data Disclosed for Our Protection and the Protection of Others

We reserve the right to access, read, preserve, and disclose any Personal Data as we reasonably believe is necessary to: (i) satisfy any applicable law, regulation, legal process or governmental request; (ii) enforce this Privacy Policy and our Terms of Service; (iii) detect, prevent, or otherwise address fraud, security or technical issues; (iv) respond to user support requests; or (v) protect our rights, property or safety, our users, and the public.

What Choices Do I Have Regarding My Personal Data?

Access and Control Your Personal Data

• If you are a registered user, you can access Personal Data associated with your Account by logging into our Services.
• You can use many features of our Services without registering, thereby limiting the type of Personal Data we collect.
• You can always opt not to provide certain Personal Data to us, but please note that such information may be needed to take advantage of some of our features.
• You can opt out of certain cookies through your browser settings as described in the cookies section above.

Delete Your Account

Should you ever decide to delete your Account, please contact us at privacy@memescribble.com. If you terminate your Account, any association between your Account and Personal Data we store will no longer be accessible through your Account. However, any public meme images you created prior to deletion may remain stored on our servers and accessible to the public unless you have requested their removal.

How Long Do We Retain Your Personal Data?

• Account information (email, profile): Retained until account deletion. Deleted immediately upon account closure.
• Generation logs (IP hash, timestamp): Automatically deleted after a maximum of 25 hours (used solely for daily credit limit enforcement).
• Generated meme images: Retained until the user deletes them or closes their account. Images from unregistered users are publicly displayed and removed upon explicit request.
• Payment information: Retained for up to 5 years as required by applicable e-commerce law and financial regulations.

We retain Personal Data about you for as long as you have an open Account with us or as otherwise necessary to provide you Services. In some cases, we retain Personal Data for longer if doing so is necessary to comply with our legal obligations, resolve disputes, or collect fees owed. Afterwards, we retain some information in a depersonalized or aggregated form, but not in a way that would identify you personally.

Is the Information About Me Secure?

We seek to protect your Personal Data using industry-standard security measures:

• All data transmissions are encrypted via HTTPS (TLS)
• IP addresses are processed only as SHA-256 hashes; the original IP is never stored
• Supabase Row Level Security (RLS) controls access to all user data
• API keys and sensitive credentials are managed exclusively via server-side environment variables and are never exposed to the client
• Cloudflare Turnstile blocks automated bot access
• Generation prompts are private and not disclosed to other users. This privacy protection applies to Coffee tier subscribers and above. Free tier users' generation prompts may be visible to the public in the gallery.

While we implement these safeguards, we cannot guarantee the absolute security of your Account information. Unauthorized entry, hardware or software failure, and other factors may compromise the security of Personal Data at any time.

What Happens When There Are Changes to This Privacy Policy?

We may amend this Privacy Policy from time to time. If we make changes in the way we collect or use information, we will notify you by posting an announcement on our Services or by sending you an email. A user is bound by any changes to the Privacy Policy when they use our Services after such changes have been first posted.

What If I Have Questions or Concerns?

If you have any questions or concerns regarding privacy when using our Services, please send us a detailed message and we will make every effort to resolve your concerns.

EU or UK Users

If you are located in the European Union ("EU"), United Kingdom, Liechtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the "GDPR") with respect to your Personal Data, as outlined below.

We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity, and our legitimate interests.

• Contractual Necessity: We process IP address (hashed), profile data, and cookie data as necessary to perform under our Terms of Service and provide you with our Services.
• Legitimate Interest: We process usage data to operate and improve our Services, provide user support, and protect from fraud or security threats.
• Consent: Where we process Personal Data based on your consent, it will be expressly indicated to you at the time of collection.

Your GDPR Rights

• Access: Request a copy of the Personal Data we hold about you.
• Rectification: Request correction of inaccurate or incomplete Personal Data.
• Erasure: Request deletion of some or all of your Personal Data from our systems.
• Withdrawal of Consent: Withdraw consent for processing at any time where processing is based on consent.
• Portability: Request your Personal Data in a machine-readable format or ask us to transmit it to another controller.
• Objection: Object to the further use or disclosure of your Personal Data for certain purposes.
• Restriction of Processing: Ask us to restrict further processing of your Personal Data.
• Right to File Complaint: Lodge a complaint about our practices with the supervisory authority of your country or EU Member State.

Transfers of Personal Data: Our Services are hosted and operated in the United States through MemeScribble and our service providers. If you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using our Services, you authorize us to transfer, store, and process your Personal Data in the U.S. and possibly other countries.

To exercise any of these rights, please contact us at privacy@memescribble.com.

U.S. Residents

Depending on where you live in the United States, you may have certain rights with respect to your Personal Data under applicable U.S. Privacy Laws (including CCPA, Colorado Privacy Act, Connecticut PDPOM, Utah Consumer Privacy Act, and Virginia CDPA).

Personal Data We Collect: We collect the categories of Personal Data listed in "What Personal Data Do We Collect About You?" above, including identifiers (email, IP hash), internet activity information (usage logs), and geolocation data (country code derived from IP).

Disclosing Personal Information: We do not "sell" or "share" your Personal Data as defined under U.S. Privacy Laws. We disclose Personal Data only with service providers as described in this Privacy Policy.

Your U.S. Privacy Rights

• Right to Access/Know: Request information about the Personal Data we collect, use, or disclose about you.
• Right to Correct: Request correction of inaccurate Personal Data we maintain about you.
• Right to Request Deletion: Request deletion of the Personal Data we have collected from you.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a request to exercise your rights or to appeal a consumer rights action, please email us at privacy@memescribble.com. To protect your Personal Data, we may need to verify your identity before processing your request. You may also designate an authorized agent to make these requests on your behalf with written permission.