Privacy Policy

Last updated: [DATE — fill in on launch]

This document is a starting-point draft, not a substitute for legal advice. If you have users in the EU/UK or California, have a lawyer confirm GDPR/CCPA compliance specifically (data subject rights, legal basis for processing, a Data Processing Agreement with each vendor below, etc.) before launch.

1. Information We Collect

• Account information: username, email address, password (stored as a salted hash, never in plain text), and OAuth profile data if you sign in with Google or Discord.
• Content you upload: images, GIFs, videos, titles, and comments.
• Payment information: if you subscribe to Plus/Pro, payment is processed entirely by Stripe — we never receive or store your card number.
• Usage data: votes, follows, IP address (for rate-limiting and abuse prevention), and basic device/browser information.
• Cookies/local storage: used to keep you signed in and remember preferences.

2. How We Use Information

• To operate, maintain, and improve the Service.
• To detect and prevent fraud, abuse, and content policy violations.
• To process payments and manage subscriptions.
• To send account-related email (verification, password reset, billing).
• To comply with legal obligations, including responding to lawful requests.

3. Third-Party Service Providers

We share the minimum data necessary with the following providers to operate the Service:

• Stripe — payment processing and subscription billing.
• Railway — application hosting, database, and object storage.
• Cloudflare — bot/abuse protection (Turnstile CAPTCHA) and, if enabled, CSAM content scanning.
• Resend — transactional email delivery (verification, password reset).
• Google / Discord — optional OAuth sign-in.
• Advertising partners (e.g. Monetag) — ad delivery for free-tier users; these partners may use cookies/device identifiers subject to their own privacy policies.

4. Data Retention

We retain account and content data for as long as your account is active. Deleted content may persist in backups for a limited period before permanent removal.

5. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting [fill in contact email]. Note: your email address cannot be changed on an active account, but you may request account deletion, which removes your personal data subject to legal retention requirements.

6. Children's Privacy

MemeRank is not directed to, and does not knowingly collect personal information from, anyone under 18. If we learn a user is under 18, we will terminate the account.

7. Security

We use industry-standard measures (password hashing via Argon2, encrypted connections, access controls) to protect your data, but no system is completely secure.

8. International Users

Your information may be processed in countries other than your own. By using the Service, you consent to this transfer.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email.

10. Contact

Questions about this policy: [fill in contact email].