1. Who We Are

MemeDome ("we," "our," or "us") is an online meme-sharing and competition platform operated as a sole proprietorship. Our platform is accessible at memedome.com and via our progressive web app. For privacy inquiries, contact us at privacy@memedome.com.

2. Data We Collect

2.1 Data you give us

• Account data: email address, username, and password (hashed via Supabase Auth — we never store plaintext passwords).
• Profile data: display name, bio, profile photo, and any optional fields you complete.
• User-generated content: memes, captions, comments, and battle entries you upload.
• Communications: messages you send via our contact form (routed through Resend).

2.2 Data we collect automatically

• Usage data: pages viewed, features used, likes, shares, and timestamps — stored in Cloudflare D1.
• Device & network data: IP address, browser type, operating system, and approximate location (country/region derived from IP at request time — we do not store precise GPS coordinates).
• Push notification tokens: browser push subscription token (endpoint, p256dh, auth) stored in D1 if you grant notification permission. See Section 7.
• Cookies & local storage: see Section 5 (Cookies & Tracking).

2.3 Data from third parties

• Google OAuth: if you sign in with Google, we receive your name, email, and profile photo URL from Google. We store the photo URL — not the image itself.
• Advertising partners: Ezoic may share aggregated ad performance data with us. We do not receive individual-level data from Ezoic. See Section 6.

3. How We Use Your Data

We use personal data only for the following purposes:

• To operate, maintain, and improve the MemeDome platform.
• To authenticate users and manage accounts.
• To personalise your feed and experience.
• To deliver push notifications you have opted into (see Section 7).
• To moderate content and enforce our Community Guidelines and Terms of Service.
• To display advertisements via Ezoic and measure ad performance.
• To prevent fraud, abuse, and security incidents.
• To respond to your communications and support requests.
• To comply with legal obligations.

We do not sell your personal data to third parties.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area, UK, or Switzerland, our legal bases for processing are:

• Contract: processing necessary to perform our agreement with you (operating your account, hosting your content).
• Legitimate interests: fraud prevention, security, analytics, and platform improvement — balanced against your rights.
• Consent: push notifications, non-essential cookies, and advertising personalisation. You may withdraw consent at any time.
• Legal obligation: complying with valid legal requests (DMCA notices, court orders).

5. Cookies & Tracking

5.1 Cookies we use

We also use browser localStorage to cache feed preferences and vote history for performance. This data stays on your device and is not transmitted to our servers.

5.2 Managing cookies

You can manage cookie preferences via our Cookie Preferences banner (shown on first visit or accessible via Settings → Privacy → Cookie Preferences) or via your browser settings. Blocking strictly-necessary cookies will prevent you from logging in.

6. Advertising & Ad Data

6.1 Our ad partner

MemeDome is ad-supported. We use Ezoic (Ezoic Inc.) as our ad management platform. Ezoic connects MemeDome to advertising demand partners (ad networks and exchanges) and optimises ad placement and performance. Ezoic acts as an independent data controller for the data it collects.

6.2 Data collected for advertising

Ezoic and its demand partners may collect the following when you view or interact with ads on MemeDome:

• Cookies and device identifiers — to recognise your browser across sessions.
• IP address and approximate location — for geographic ad targeting.
• Browsing behaviour — pages visited, time on page, content categories.
• Device and browser information — type, OS, screen size, language.

MemeDome does not share your name, email, MemeDome username, or specific content you have posted with any advertiser.

6.3 Targeted advertising & opt-out

By default, ads may be personalised based on your interests inferred from your browsing behaviour. You can opt out of targeted advertising:

• Cookie preferences: decline advertising cookies via our consent banner or Settings → Privacy → Cookie Preferences.
• Industry opt-out: aboutads.info/choices (US)  · youronlinechoices.eu (EU).

Opting out of targeted advertising means you will see contextual (non-personalised) ads instead — the number of ads does not change.

6.4 GDPR & CCPA

EU/EEA/UK users: advertising cookies require your explicit consent. We obtain this via our cookie banner before any advertising cookies are set. You may withdraw consent at any time.

California residents: you have the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising under CCPA/CPRA. Use cookie preferences above or email privacy@memedome.com with subject “CCPA Opt-Out”.

6.5 Ad partner privacy policies

• Ezoic Privacy Policy
• Google Privacy Policy (Google Ad Exchange)

7. Push Notifications

If you grant browser notification permission, we store your push subscription token (endpoint, p256dh key, auth secret) in our Cloudflare D1 database, linked to your user account. This token is used solely to route notifications to your device. It is never shared with advertisers.

Push notifications are delivered via the browser's native push infrastructure (Chrome → Google FCM; Firefox → Mozilla push; Safari → Apple APNs). The relevant platform provider processes the token to deliver messages to your device; this is governed by their own privacy policies.

You can revoke notification permission at any time in your browser settings or in Settings → Notifications within MemeDome. Revoking permission invalidates your token and we will delete it from our database within 30 days.

8. Data Sharing & Sub-processors

We share data only with the following sub-processors, strictly for the purpose of operating the platform:

We share data with law enforcement or regulatory authorities only when required by law or valid legal process. We will notify you unless prohibited from doing so.

9. International Data Transfers

MemeDome is a global platform. Your data may be processed in countries outside your country of residence, including the United States. Cloudflare and Supabase maintain Standard Contractual Clauses (SCCs) or equivalent safeguards for EU/EEA data transfers. By using the platform, you acknowledge these transfers.

10. Data Retention

• Account data: retained for as long as your account is active. Deleted within 30 days of account deletion request.
• User-generated content: deleted within 30 days of account deletion; content you deleted individually is removed from public display immediately but may persist in backups for up to 7 days.
• Push tokens: deleted within 30 days of permission revocation or account deletion.
• Error logs: retained for 90 days then automatically purged.
• Points history: retained for the lifetime of the account for audit purposes.
• Contact form messages: retained for 12 months then deleted.

11. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure ("right to be forgotten"): request deletion of your data. Use the Data Deletion Request form or email privacy@memedome.com.
• Restriction: request we limit processing of your data.
• Portability: request your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw consent for push notifications or advertising cookies at any time without affecting prior processing.

To exercise any right, email privacy@memedome.com or use the Data Deletion Request form. We will respond within 30 days (GDPR) or 45 days (CCPA).

If you are in the EU/EEA and believe we have not handled your request correctly, you have the right to lodge a complaint with your local data protection authority.

12. Children's Privacy

MemeDome is not directed at children under 13. We do not knowingly collect personal data from children under 13 (or under 16 in the EU). If we discover we have collected data from a child below the applicable age, we will delete it immediately. If you believe a child has registered, contact us at privacy@memedome.com.

13. Security

We use industry-standard safeguards including HTTPS-only access, Cloudflare WAF, encrypted password storage (Supabase Auth), and access-controlled R2 storage. No system is completely secure. If you believe your account has been compromised, contact privacy@memedome.com immediately.

In the event of a data breach that affects your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

14. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via a platform banner and/or push notification (if enabled) at least 14 days before they take effect. The "Last updated" date at the top will always reflect the most recent revision.