Privacy Policy - Petit Meme
Last updated: July 2026
This Privacy Policy describes how Petit Meme (accessible at https://petit-meme.io) collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR).
1. Data controller
The data controller is:
- Petit Meme
- Website: https://petit-meme.io
- Contact: legal@petit-meme.io
When you create an account via Twitter/X, we collect your name, email address and profile picture. By signing in, you accept this Privacy Policy.
2. Data collected
2.1. Account data
When creating an account, we collect:
- Username
- Email address
- Password (stored in hashed form)
- Twitter/X identifier (for social login)
2.2. Browsing and session data
- IP address (temporarily processed for security purposes)
- Authentication session data (session cookies)
- Last activity date (automatically updated on login and service usage)
2.3. View and interaction data
- A daily technical identifier, computed server-side from your IP address, a secret salt and the current date. It is used to count only one view per meme, per visitor and per day. It changes every day, is never sent to your browser and cannot be used to re-identify you
- Number of views and watch time for memes
2.4. Search and Algolia analytics data (with consent)
If you accept cookies, we send to Algolia:
- View events (memes viewed)
- Click events (memes clicked from search results)
- An anonymous identifier (
algoliaUserToken) linking these events, with no connection to your personal identity
This data is used to improve search result relevance and generate recommendations.
2.5. Studio generation data
When you use the Studio feature (generating images from memes), we record:
- The date and time of each generation
- The identifier of the meme used
This data is used for usage control (limiting the number of free generations) and service improvement (aggregated usage statistics). It is retained for 365 days, then automatically deleted.
2.7. AI search data
When you use the AI search feature (natural language description of a meme you're looking for), we record:
- The text of your request (prompt)
- Keywords extracted by the AI
- Identifiers of the memes returned
- The date of the search
This data is used for usage control (limiting the number of free searches) and service improvement. Your prompt is transmitted to Anthropic for keyword extraction, with no connection to your personal identity (only the request text is sent). Data is retained for 365 days, then automatically deleted.
2.8. Payment data
Payments are handled by Stripe. We never store your credit card information. Stripe collects the data necessary for payment processing in accordance with its own privacy policy.
2.9. Activity log
To measure the site's audience, keep it secure and prevent abuse (automated scraping of videos, quota circumvention), we record server-side every action performed on the service:
- The action type: view, download, share, generation, AI search, bookmark added, sign-up, subscription
- The date and time
- Your IP address and your user-agent (browser and operating system)
- The country inferred from your IP address, as a two-letter code. We infer neither your city, nor your region, nor your geographic coordinates
- The identifier of the meme concerned, when the action targets one
- Your account identifier, if you are signed in
This processing relies on legitimate interest: since most traffic is not signed in, it is the only way to measure actual usage of the site and to spot abusive behaviour. It sets no cookie and is used neither for advertising nor for profiling.
The IP address is erased after 30 days, and the country inferred from it disappears along with it: it has no retention period of its own. Past that point, the record carries no location data at all. The record itself is deleted after 90 days. You may object to this processing at the address given in section 11.
3. Purposes and legal bases
| Purpose | Legal basis | Data concerned |
|---|---|---|
| Account creation and management | Performance of contract | Username, email, password |
| Authentication and security | Legitimate interest | Session data, IP |
| Unique view counting | Legitimate interest | Daily fingerprint derived from the IP address |
| Audience measurement, security and abuse prevention | Legitimate interest | IP address, country inferred from the IP, user-agent, actions performed and their date |
| Search improvement (Algolia Insights) | Consent | Anonymous identifier, view and click events |
| Payment processing | Performance of contract | Data transmitted to Stripe |
| Sending transactional emails | Performance of contract | Email address |
| Meme search | Performance of contract | Search queries |
| Usage control and Studio analytics | Legitimate interest | Generation date, meme identifier |
| AI search by natural language | Performance of contract | Prompt, extracted keywords, results, date |
| Inactivity detection and account anonymization | Legitimate interest | Last activity date |
| Error tracking and service stability | Legitimate interest | Technical data (URL, browser, error traces) |
4. Cookies
Cookie table
| Name | Purpose | Duration | Consent required |
|---|---|---|---|
cookieConsent | Remember your consent choice | 1 year | No (strictly necessary) |
better-auth.session_token | Authentication session | Session duration | No (strictly necessary) |
theme | Theme preference (light/dark) | 1 year | No (strictly necessary) |
PARAGLIDE_LOCALE | Remember the chosen language (fr/en) | 1 year | No (strictly necessary) |
localeBannerDismissed | Remember dismissal of the language suggestion banner | 1 year | No (strictly necessary) |
anonId | Former view-counting identifier. No longer set, only read for visitors who already have it, to preserve the continuity of Algolia recommendations | 1 year | Yes |
algoliaUserToken | Linking search events (views, clicks) for Algolia | 1 year | Yes |
You can manage your cookie preferences at any time. If you decline analytics
cookies, the algoliaUserToken cookie will not be set and no events will be
sent to Algolia. View counting itself relies on no cookie at all (see
section 2.3).
5. Sub-processors and recipients
We use the following sub-processors for the operation of the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | United States (standard contractual clauses) |
| Resend | Sending transactional emails | United States (standard contractual clauses) |
| Bunny CDN | Video hosting and delivery | European Union |
| Algolia | Search engine | European Union / United States (standard contractual clauses) |
| Twitter/X | Social authentication (OAuth) | United States (standard contractual clauses) |
| Sentry | Error tracking and stability monitoring | Germany (European Union) |
| Google Fonts | Loading display fonts (IP address transmitted) | United States (standard contractual clauses) |
| Neon | Database hosting | United States (standard contractual clauses) |
| Vercel | Application hosting and execution | United States (standard contractual clauses) |
| Anthropic | AI search by natural language | United States (standard contractual clauses) |
For data transfers outside the European Union, appropriate safeguards are in place (European Commission standard contractual clauses).
6. Data retention periods
| Data | Retention period |
|---|---|
| Account data | Until account deletion by the user |
| Session data | Duration of active session (automatically deleted upon expiry) |
| Verification tokens | Automatically deleted 24 hours after expiry |
Detailed view data (MemeViewDaily) | 90 days, then aggregated (global counter) and deleted |
anonId cookie | 1 year (with consent) |
algoliaUserToken cookie | 1 year (with consent) |
| Algolia event data (views, clicks) | Per Algolia's retention policy (30 days by default) |
| Studio generation data | 365 days, then automatically deleted |
| Administrative audit log data | 2 years, then automatically deleted |
| AI search data | 365 days, then automatically deleted |
| Activity log — IP address and inferred country | 30 days, then permanently erased |
| Activity log — full record | 90 days, then automatically deleted |
| Last activity date | Cleared upon account deletion or anonymization |
| Payment data (Stripe) | Per Stripe's legal obligations |
| Transactional emails | Per Resend's retention policy |
An automated cleanup process runs every day to delete expired sessions and obsolete verification tokens, aggregate view data beyond 90 days and enforce the activity log retention periods.
Upon deletion of your account, your personal data is deleted within 30 days, except for data we are required to retain under legal obligations.
7. Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to the processing of your data based on legitimate interest
- Right to withdraw consent: withdraw your consent to analytics cookies at any time
To exercise your rights, contact us at: legal@petit-meme.io
We commit to responding to your request within one month.
8. Security
We implement appropriate technical and organizational measures to protect your personal data:
- Encrypted communications (HTTPS/TLS)
- Password hashing
- Restricted access to personal data
- Secure hosting
9. Filing a complaint with the CNIL
If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):
- Website: https://www.cnil.fr
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
10. Changes to this policy
Petit Meme reserves the right to modify this Privacy Policy. In the event of a substantial change, users will be informed via the website.
11. Contact
For any questions regarding this privacy policy: legal@petit-meme.io