Legal

Privacy Policy

Last updated October 24, 2026

The short version. We collect what we need to run fedora.meme and keep it safe. We don't sell your personal information. Your memes and posts are yours. You can download everything we hold about you, or delete your account, yourself in Settings.

What we collect

What	Why
Account details Username, email, your password (stored only as a one-way hash), and, if you turn on two-factor login, an encrypted secret and recovery codes.	To create your account, log you in and keep it secure, and send account emails such as password resets.
Profile Display name, bio, avatar (a photo you upload, one you build in the avatar maker, or one of our ready-made avatars), banner, location and links you add. If you build one in the avatar maker, we also keep the parts you picked so you can change it later. Optionally your gender, which stays private unless you choose to show it on your profile.	To show your public profile.
Interests and invites The genres you say you like, what you told us brings you here (making memes, laughing at them or joining a community), and, if a member invited you, who that was.	To pick memes for your For you wall, to choose the steps on your Getting started list and the tips we show or email you in your first week, and to give the member who invited you their XP when you post your first meme. We also keep when you hid or finished that list, when we showed you the first-day tips, and which tip emails we sent.
What you post Memes, posts, comments, community threads, messages, collectives, templates, drafts.	To run the site. Public things are visible to others; drafts and messages are not public.
Activity Likes, saves, follows, reposts, views, XP, levels and badges, the searches you run on the site, and, if you take part in battles, your captions, entries and votes.	Feeds, notifications, the leaderboard, your analytics and the XP system. Searches power "Trending searches", which only ever shows a search once at least two different people have made it, never who searched. In battles, other members only see vote totals, never who voted for what.
How you found us On your first visit: the website that sent you here (if any), the first page you saw, campaign tags in the link (utm), whether you came from a member's invite or shared link, and your device type (phone, tablet or computer). If you sign up: which sign-up steps you reached. As a member: which days you opened the site.	So we know which ways of finding fedora.meme work, where signing up gets stuck, and whether people come back. Only our admins see these numbers, as totals. It's never sold or used for ads.
Links you share When you're logged in and share a page, the link gets a short code (?sh=...) tied to your account, and we count the visits and sign-ups it brings. Whether or not you're logged in, when you share a page from our share menu we note which page and how (for example copied the link, WhatsApp or a QR code), never who you sent it to. When you download a meme you made in Creator Studio, we note that too (not the picture).	So we can see which shares bring people in and thank the members who bring them, and what people make and share. The member who posted something sees in their Analytics how many times it was shared and how (WhatsApp, X, a copied link…), never by whom. Nobody is told who opened your link.
Device and security data IP address, browser and device type (including whether you're using the installed fedora.meme app, and which release of it, and when the app was first opened on each of your devices), when you were last active and the page you were on (including a search you ran), and the devices you're logged in on. To protect the site from automated floods, we count requests per network for one minute at a time; when a network goes over the limit, its IP address, browser name and the page it asked for are written to a security log.	Security (spotting suspicious logins, letting you log devices out), stopping spam, abuse and automated floods, the online indicator, and counting app installs (only our admins see those).
Staff training (moderators and admins only) Which staff training courses you finished, your best quiz score, how many tries it took and when you passed, plus when you first opened the staff control panel and its tour.	So everyone on the team knows how fedora.meme is moderated, and admins can see who still has required training to finish. Only admins see it.
Payments For boosts and badges: the amount, what you bought, and a payment reference.	To run boosts, add badges to your account and give you receipts. We never see or store your card number.
Solana wallet (only if you link one) Your public wallet address, your $DORA balance, and the signatures of tips and boost payments.	To log in with a wallet, receive tips, pay for boosts in $DORA, swap XP and award wallet badges (such as the $DORA presale badge). Wallet addresses and transactions are public on the blockchain by nature.

Our admins can see a live list of what happens on the site (for example new posts, likes, follows, purchases and reports) to keep it running and spot abuse. For private messages and collective chat it shows only who sent one, never what was said.

We share only what each service needs to do its job:

Stripe processes card payments for boosts and badges. Your card details go straight to Stripe, under Stripe's privacy policy.
Helius (a Solana data provider) is used to read $DORA balances and check payments on the blockchain. It receives public wallet addresses and transaction signatures only.
fedora.foundation, our sister site for $DORA, receives your username, display name, avatar and wallet address when you sign in with or link a wallet, so your accounts on both sites connect and XP swaps work.
Social sign-in (Facebook, Google, Discord, Reddit): if you sign in with one, it tells us your name, email and avatar from that account. We don't post anything to it.
Google reCAPTCHA checks sign-ups and the contact form for bots, under Google's privacy policy.
Google Analytics counts visits and which pages are used, so we know what to improve.
Google AdSense shows ads in the feed and the sidebar. Google and its partners use cookies to show ads, including ads based on your earlier visits to this and other sites (how Google uses information from sites that use its services). You can turn off personalized ads in Google's Ads Settings, or for many ad companies at once at aboutads.info. Visitors in the EU, the UK and Switzerland are asked for consent before personalized ads, and can change that choice at any time under Your choices below.
Embedded Instagram posts load from Instagram as they come into view, and YouTube videos load from YouTube when you press play. Their own privacy policies apply.
We may share information if the law requires it, or to protect people from harm.

We don't sell your personal information or rent it to anyone.

Cookies and similar storage

Needed to work: a session cookie to keep you logged in (and a longer one if you choose "Keep me logged in"), and a security token that protects forms. If you open a member's invite link, a cookie remembers who invited you for 30 days, so they get credit if you join. While you're logged in, a cookie (fm_m) with your member number and a signature lets our flood protection count your requests on your account instead of your network; it's removed when you log out. In the installed fedora.meme app, a cookie (fm_app) notes that you're using the app and which release it's on; a normal browser tab removes it. The app also keeps a random number in its own storage, so opening it again on the same device isn't counted as a new install.
Counting visits: our own cookie (fm_vid) holds a random number for up to a year, so we know where a visitor first came from if they later join, and so the same visitor sharing a page twice in a row counts once. It has nothing personal in it and isn't shared with anyone.
Preferences: your light or dark choice and your recent searches are stored in your browser only. You can clear recent searches from the search box.
Third-party: Google Analytics and Google AdSense set their own cookies, as described above.

Your choices and rights

See and download your data: Settings → Account → Download my data gives you a copy of everything, including your memes.
Change or correct it: edit your profile and account details in Settings.
Delete your account: in Settings → Account. Your login, profile, personal details, two-factor settings, logged-in devices and search history are removed straight away. Memes and replies you posted stay up as "Deleted User" so conversations still make sense; tell us if you want specific posts removed.
Emails: new accounts get notification emails by default. Choose what we email you about, or turn emails off, in Settings → Notifications, or use the link at the bottom of any email. While emails are on, you may also get up to two short tips in your first week (on day 2 and day 5) if you haven't gotten started yet.
Privacy settings: who can message you and see your activity are in Settings → Privacy & safety.
Push notifications: if you turn them on in Settings → Notifications, we keep the push address your browser or phone gives us for that device, so we can send them. The push itself carries nothing; your device then asks us for your newest notification. Turn it off there any time and the address is deleted.
Who sees each post: when you post a meme, a post or a Community thread, choose Public, Followers or Only me. You can change it any time from the post's ⋯ menu. Anything posted in a collective follows that collective's setting.
Ad consent:

Anything else, contact us and we'll help.

How long we keep it

We keep your account information while your account is open. Search history is kept for 90 days. First-visit records of people who never join, unfinished sign-up attempts and shared-link visits are deleted after a year, and the record of which days a member opened the site after about 13 months (only daily totals with no names are kept longer). The flood-protection security log is deleted after 14 days. When you delete your account, personal details go straight away. Some records, such as payment receipts and security logs, may be kept longer where the law requires it or to prevent fraud and abuse.

Keeping it safe

Passwords are stored as one-way hashes, two-factor secrets are encrypted, and the site only runs over HTTPS. No system is perfect, so use a strong password and turn on two-factor login.

Pictures you upload

Pictures can carry hidden details such as where they were taken. Anyone can download pictures you post publicly, so check what's in a picture before you share it.

Changes to this policy

We'll update this page when what we do changes, and say so on the site for any big change. The date at the top shows the latest version.