Privacy

Privacy Policy

Effective date: August 11, 2026.

Version: 1.1.

This Privacy Policy applies to MemePulse and describes how personal information is handled in connection with the public website, accounts, and user-generated content features.

For privacy, legal, or deletion requests, contact support@memepulse.net.

1. Controller identity

MemePulse is operated by Matvei Mikhailovich Moshchin (Мощин Матвей Михайлович), an individual registered as a self-employed taxpayer in the Russian Federation, taxpayer identification number 532122987172. He is the controller responsible for the processing described in this Policy. Location: Veliky Novgorod, Russian Federation. A postal address will be provided through support@memepulse.net where disclosure is required by applicable law or for valid legal correspondence. MemePulse has no company, joint controller, establishment, or representative in the European Union, European Economic Area, or United Kingdom.

2. Scope of this Policy

This Policy explains how MemePulse collects, uses, stores, and discloses personal information when you visit the site, create an account, sign in with Google, upload content, comment, vote, or otherwise interact with the service.

3. Information we collect

We may collect your email address, display name, profile image, authentication user ID, and profile details provided by Google Sign-In or directly by you. We also collect content and media you submit, including avatars, posts, meme stories, media submissions, comments, votes, ratings, and related metadata. Technical data may include IP address, browser and device information, referring pages, timestamps, cookie or session identifiers, and server, security, and basic usage logs.

4. How and why we use information

We use information to provide accounts and requested features, authenticate users, display profiles and submissions, moderate content, secure the service, prevent fraud and abuse, measure reliability and usage, respond to requests, enforce the Terms, and comply with law. Depending on applicable law, processing is based on performance of our agreement with you, legitimate interests in operating and protecting MemePulse, consent where requested, and compliance with legal obligations.

5. Google Sign-In

If you sign in with Google, Google and our authentication provider may provide your name, email address, profile image, and identifiers needed for authentication and profile creation. We do not request access to Gmail, Google Drive, Google Calendar, or other Google services unless separately disclosed and authorized.

6. Public content

Profile information and content you intentionally publish may be visible worldwide and may be indexed, copied, quoted, or shared by others. Do not publish personal information you do not want to make public. Removing an account or submission does not guarantee removal of copies lawfully retained by others or from search-engine caches.

7. Service providers and disclosures

We do not sell personal information. The current processors, services, data, locations, and transfer approach are identified in the processor table below. We may also disclose information when required by law, to protect rights or safety, or to investigate and enforce violations.

8. Retention

The specific periods and deletion criteria for account data, content, logs, analytics, requests, moderation records, consent records, and backups are stated in the retention schedule below. A shorter period applies when the purpose ends or law requires it; a documented legal hold may preserve only the affected record.

9. Cookies, analytics, and logs

Necessary storage supports authentication, security and features you request. Google Analytics, guest audience measurement, external players and future advertising storage do not start before the relevant choice. You can accept, reject, or manage optional categories and later withdraw consent through Cookie settings in the footer. See the Cookie Policy for the current inventory.

10. International processing and regional availability

Information may be processed outside your country, including in jurisdictions with different data-protection laws. Until appropriate representatives and compliance arrangements are in place, MemePulse does not offer account registration or user-generated content features to persons located in the European Union, European Economic Area, or United Kingdom. Technical availability does not grant authorization to use those features. If you used them from one of those locations, contact support to request account or data action.

11. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Send requests from the email associated with your account to support@memepulse.net and identify the account and request. We may verify your identity and may retain information where law or a compelling legitimate reason permits or requires it. You may also complain to a competent data-protection authority.

12. Children

MemePulse is not intended for children under 13 or a higher minimum age required by local law. User uploads are limited to persons aged 18 or older. If you believe a child provided personal information contrary to these rules, contact support.

13. Changes to this Policy

We maintain a version and effective date. Minor clarifications may take effect when published. For material changes affecting registered users, we will normally provide a prominent account-visible notice at least seven days before they take effect. Changes required urgently by law, security, or abuse prevention may take effect sooner with notice when practicable. We will request consent where applicable law requires it.

Processing map and lawful bases

The table describes current processing. Contract means processing needed to provide a feature you request; legitimate interests means operation and protection of the small service after balancing those interests against user rights.

Data and source	Purpose	Legal basis	Storage / processor	Location	Retention
Email, Google identifier, name, avatar and session data — from you, Google and Supabase	Create and secure an account; sign in; provide account features	Performance of contract; legitimate interests for account security	Supabase Auth; profile records on the MemePulse origin	Paris, France; Frankfurt, Germany	Active account; authentication record deleted when the account is deleted, subject to the limited tombstone below
Username, bio, avatar and 18+ upload confirmation — from you	Operate profiles, show chosen public details and apply upload eligibility	Performance of contract; steps you request	PostgreSQL origin; Cloudflare R2 for uploaded files	Frankfurt, Germany; Cloudflare automatic/global network placement	Until edited, deleted, or the account is deleted
Posts, meme stories, media, comments, captions, metadata and rights confirmations — from you	Publish requested content, operate community features and moderate abuse	Performance of contract; legitimate interests in moderation and legal compliance	PostgreSQL; Cloudflare R2/CDN	Frankfurt, Germany; Cloudflare automatic/global network placement	Until you delete it or request removal; a published editorial story may remain without account attribution; removed content evidence follows the schedule below
Votes, ratings, favourites, rankings, notifications and account view history — from your activity	Provide and protect the corresponding account features	Performance of contract; legitimate interests against manipulation	PostgreSQL origin	Frankfurt, Germany	Deleted with account; notifications expire after 12 months
IP address, user agent, request headers, timestamps and pseudonymous viewer hash — from requests	Deliver and secure the service; prevent abuse and duplicate counts	Legitimate interests in service security; consent for optional guest audience measurement	Cloudflare network and origin logs; PostgreSQL view events	Cloudflare automatic/global network placement; Frankfurt, Germany	Origin access logs 30 days; viewer hash 24 hours; security-incident evidence up to 12 months
Page, event, browser/device and approximate-location analytics — from the browser only after consent	Understand aggregate site use and improve reliability	Consent	Google Analytics	Google global infrastructure, including the United States	Analytics event retention 2 months; analytics cookies up to 180 days
AI chat prompt and up to 12 recent chat messages — from you when you send a message	Answer the requested chat or meme-search question	Performance of the service you request	ModelHub API gateway and the selected model provider	Provider-controlled infrastructure	MemePulse does not store chat text; provider-side processing and logs follow provider terms
Support email, privacy request, complaint, URLs and supplied evidence — from the sender	Answer requests, verify identity, handle complaints and establish legal claims	Legal obligation; legitimate interests in support and legal claims	Cloudflare Email Routing to operator-controlled Gmail; relevant origin records	Cloudflare automatic/global network placement; Google global infrastructure, including the United States; Frankfurt, Germany	Routine privacy/support correspondence 3 years; serious moderation, copyright or legal records 6 years
Consent choice, timestamp, language and theme — from your browser choice	Remember and demonstrate choices; provide requested display settings	Consent record/legal obligation; requested functionality	Browser cookie or local storage	Your device	Consent choice 180 days; language/theme up to 1 year
IP, device and provider cookies disclosed by an external player — after consent or a one-time click	Display the external media you request	Consent or the one-time action you request	YouTube, TikTok, Instagram or Reddit	Provider-controlled global infrastructure	Controlled by the provider under its policy

Processors and recipients

MemePulse does not sell personal information. These are the services currently known to receive data. Local PostgreSQL backups remain on the same Hosting VDS origin and are not a separate vendor.

Provider	Service and data	Processing location	Contract / transfer approach
ООО «ЦИФРОВЫЕ РЕШЕНИЯ» (Hosting VDS)	Origin hosting, PostgreSQL and local backups: account, content, technical and security data	Frankfurt, Germany	Hosting contract and provider terms; processing necessary to supply the requested service
Supabase Pte. Ltd.	Authentication: email, OAuth identity, session and authentication metadata	Paris, France	Supabase data-processing terms; contractual safeguards offered by the provider where an international transfer occurs
Cloudflare, Inc.	CDN/security, R2 object storage and Email Routing: request data, uploaded objects and routing metadata	Cloudflare automatic/global network placement	Cloudflare data-processing terms and incorporated transfer safeguards; storage location is not falsely represented as fixed
Google LLC and affiliates	Google Sign-In, Google Analytics after consent, and Gmail as the operator’s support inbox	Google global infrastructure, including the United States	Sign-In is requested by the user; analytics relies on consent; applicable Google data terms and transfer safeguards
ModelHub and the selected model provider	AI chat: the message and limited recent chat context sent by the user	Provider-controlled infrastructure	Processing is initiated only when the user sends an AI chat message; provider terms apply
YouTube/Google, TikTok, Meta/Instagram and Reddit	External players may receive request/device data and set their own storage	Provider-controlled global infrastructure	No player loads before consent or an explicit one-time load; the provider’s own policy also applies

Retention schedule

A shorter period applies when the purpose ends, deletion is validly requested, or law requires it. A legal hold may temporarily override deletion for the specific record involved.

Record	Normal period or deletion rule
Active account and profile	Until account deletion
Supabase authentication record	Deleted when account deletion completes
Posts, comments, uploads and media	Until separate deletion, valid removal request, or account deletion; a published meme story may remain only after account attribution is removed
Deleted comment body	Blanked immediately
Favourites, votes, ratings, rankings, history and account notifications	Deleted with the account
Notifications	12 months
Pseudonymous viewer hash / view event	24 hours
Duplicate-view browser storage	1 hour
Origin web access logs	30 days
Confirmed security-incident evidence	12 months
Google Analytics events	2 months
AI chat text	Not stored by MemePulse; provider-side processing and logs follow provider terms
Routine privacy and support correspondence	3 years after closure
Serious moderation, copyright, legal reports and claims	6 years after closure
PostgreSQL backups	14-day rolling cycle
Removed R2 objects and provider cache copies	Targeted for deletion promptly; residual cache/backup copies up to 30 days where the provider retains them
Cookie-consent record	3 years for proof; browser preference is requested again after 180 days
Deleted-account authentication tombstone and blocked security identifiers	3 years
Moderation copy of blocked content	90 days, unless a documented legal hold or serious-report schedule applies

Your privacy rights

Where applicable, you may request confirmation and access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and complain to a competent authority. Brazilian users may also request confirmation of processing, anonymisation, blocking or deletion of unnecessary or unlawful data, information about sharing, portability where regulated, information about consent consequences, consent withdrawal, and review or explanation of decisions based solely on automated processing. Withdrawing consent does not affect earlier lawful processing.

How to make a request

Email support@memepulse.net from the account email where possible and state the account and right requested. MemePulse may ask only for information reasonably needed to verify identity. Confirmation or a full response is provided within the period required by applicable law: normally within 30 days for GDPR-style requests (extendable only where the law permits and with notice) and, for Brazilian users, a simplified confirmation promptly or a complete statement within 15 days. There is no automated export tool; a verified portability request is handled manually in a commonly used structured format where the right applies.

International transfers

The operator is in Russia; the origin is in Germany, authentication is in France, and Cloudflare and Google use international infrastructure. Transfers are limited to the purposes in the map. Depending on the route and applicable law, MemePulse relies on performance of the service requested by the user, consent for optional analytics or external media, provider data-processing terms and contractual transfer safeguards incorporated into those terms, or another mechanism lawfully available at the time. This Policy does not claim an adequacy decision or fixed Cloudflare storage country that does not exist.

Security and sensitive data

Access to administration is limited to the operator. MemePulse uses authentication, access controls, encrypted network transport, provider security/CDN controls, backups and moderation measures. No system is completely secure. AI chat text is sent to the AI provider only when you use that feature; do not include sensitive personal data. Do not place sensitive data in public content; it may be removed when found. Error-monitoring software is currently disabled. There is no marketing-email programme.