Este documento está em inglês. As versões em inglês e polonês são as que valem.

Privacy Policy

Last updated: 2026-11-05

This policy explains what personal data ShowMeme processes on showmeme.app, why, on what legal basis, for how long and who else receives it. It gives you the information required by art. 13 and 14 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Who is responsible for your data

We are the controller of your data, and you reach us at one e-mail address.

The controller of your personal data is PIOTR WÓJCIK STRATEGY LAB (Piotr Wójcik), NIP 5222944891, REGON 52047073700000, entered in the Polish business register CEIDG, which lists our business address ("we", "us").

For any privacy question or request, write to [email protected]. We have not appointed a data protection officer.

2. Your photo and your results

Your photo lives in your browser, passes through our server only while the effect is made, and results disappear after 48 hours.

In your browser

When you add a photo, your browser shrinks it to at most 1024 pixels on the longest side, drops its metadata (including location data) and saves it in your browser's storage (IndexedDB). The same storage keeps the settings you chose for the photo, including your answer to "Who is in the photo?" (woman, man or skipped), and the steps of your current result. This copy stays on your device and reaches us only when you make an effect. When it is older than 24 hours, ShowMeme deletes it the next time you open the photo page or the studio. You can delete it sooner by clearing the site's data in your browser.

On our server

When you make an effect, your browser sends us the photo, the effect you picked and your settings. Our server shrinks the photo again, removes any metadata left and keeps it only in working memory while the effect is made. We never write your photo to disk. It is deleted when the effect is finished or fails, within about 10 minutes at the latest. We use your answer to "Who is in the photo?" only to word the instruction for the model and do not store it. For every further effect on the same photo, your browser sends the photo again, so we do not keep it between effects.

Moderation check

Before the effect starts, we send the photo to OpenRouter, which passes it to an AI model that checks it against our Content Rules. We request only model hosts that have committed to zero data retention, which means they keep no copy of the image after the check. The finished result goes through the same check before you see it.

Image editing

The photo then goes to deAPI, together with our instruction for the effect. From your second effect on the same photo, deAPI also receives the previous result. deAPI runs the AI model that edits the photo. deAPI's privacy policy (as read on 5 November 2026) says that it does not keep input files after the request has run, deletes generated images no later than 24 hours after the job was created and does not use customer content to train AI models. We download the result as soon as it is ready.

Results

We store each result on our server in the EU (Amsterdam, the Netherlands) for 48 hours, in two files: the result with the watermark, which you and anyone with the link can see, and a copy without the watermark, which we never show and use only as the starting point for your next effect. With each result we store the effects used, the creation and expiry times and the random session ID from your browser's cookie, so only your browser can delete the result or build on it. After 48 hours the link stops working and both files are deleted. "Delete now" removes both files sooner. If you share the link, Cloudflare may keep a cached copy of the link preview image for up to one hour, also after you tap "Delete now".

Purpose and legal basis: to provide the studio you asked for (art. 6(1)(b) GDPR, performance of a contract). We also run the moderation check in our legitimate interest in keeping illegal and harmful content out of ShowMeme and protecting the people shown in photos (art. 6(1)(f) GDPR).

People in someone else's photo

When someone uploads a photo that shows you, we receive your image from that person. We do not know who you are, so we cannot tell you directly (art. 14(5)(b) GDPR). We process and delete your image exactly as described above. Legal basis: our legitimate interest, and that of the person who uploaded the photo, in making the effect they asked for (art. 6(1)(f) GDPR). If you find a result that shows you without your consent, report it with the "Report" button or write to us, and we will remove it (Content Rules).

3. Faces and biometric data

AI edits your face, and nobody uses it to recognise who you are.

The AI models change the pixels of your photo to create an effect. We do not create face templates, compare faces, recognise who is in a photo or verify anyone's identity. The moderation model only decides whether an image shows content from our blocked list. For this reason we do not process biometric data as defined in art. 4(14) GDPR, and we process no special categories of data under art. 9 GDPR. We do not use your photos or results to train AI models.

4. Other data we process

Besides photos, we handle a few small pieces of data that keep the studio working and safe.

We store a random session ID, your year of birth if you are 16 or over, the number of effects you made today and, after an under-16 answer, a marker that blocks the studio for 24 hours. All of this sits in the signed sm_session cookie in your browser. Our server reads the cookie with each request and keeps no copy of it. Your session ID also appears in the limit counters, next to your results and in reports. We use it to check that you passed the age gate, to apply the daily limit and to tie your results to your browser. Legal basis: performance of a contract (art. 6(1)(b) GDPR) and our legitimate interest in keeping people under 16 out of the studio and preventing abuse (art. 6(1)(f) GDPR).

IP address and limits

Our server keeps counters of effects, reports and waitlist sign-ups per IP address and per session ID in its working memory. They limit how much one address or browser can do in a day, which protects ShowMeme from abuse and keeps our costs under control. The counters count only the current day (UTC) and never reach the disk. Old entries stay in working memory until newer ones push them out or the server restarts. Legal basis: our legitimate interest in security and preventing abuse (art. 6(1)(f) GDPR).

Reports

When you report a result, we save the result link, the reason, your description, your e-mail address if you give one, your session ID, your IP address and the time. We use this to handle the report, to answer you and to spot misuse of the report form. Legal basis: our legal obligation to handle notices under art. 16 of the Digital Services Act (art. 6(1)(c) GDPR) and our legitimate interest in a safe service (art. 6(1)(f) GDPR).

Waitlist

When you join the waitlist, we save your e-mail address, the site language and the time you signed up, so that we can tell you when the ShowMeme apps launch. Legal basis: your consent (art. 6(1)(a) GDPR). You can withdraw it at any time by writing to us; this does not affect what we did before.

E-mails to us

When you write to us, we process your address, your message and any attachments to answer you and handle your request. Legal basis: our legitimate interest in answering you (art. 6(1)(f) GDPR) or our legal obligation when you exercise your rights or file a complaint (art. 6(1)(c) GDPR).

Server and security logs

Our hosting provider records technical data about requests, such as IP address, time, page address, browser type and errors. Our own application logs record events such as "effect started" with random IDs; they contain no photos and no e-mail addresses. We use logs to keep ShowMeme running, find errors and stop attacks. Legal basis: our legitimate interest in security (art. 6(1)(f) GDPR). Cloudflare also processes request data for security under its own retention rules.

Language

The NEXT_LOCALE cookie remembers the language you picked. Legal basis: our legitimate interest in showing the site in your language (art. 6(1)(f) GDPR).

5. How long we keep data

Every type of data has one retention period, and this list has all of them.

Photo in your browser: 24 hours, then deleted the next time you open the photo page or the studio.
Photo on our server: Only while the effect is made, within about 10 minutes at the latest, never on disk.
Photo at the moderation model host: No copy kept after the check.
Photo and result at deAPI: The photo is not kept after the request; the result is deleted within 24 hours (deAPI's policy).
Results, with and without the watermark: 48 hours, or less if you tap "Delete now". After 48 hours the link stops working at once, and a cleanup that runs every 30 minutes deletes the files.
Link preview in Cloudflare's cache: Up to 1 hour.
sm_session cookie: 12 months from the last time our server updated it.
NEXT_LOCALE cookie: Until you close your browser.
Limit counters with IP addresses and session IDs: They stop counting at midnight UTC and stay in working memory until newer entries push them out or the server restarts. They never reach the disk.
Reports: 90 days.
Waitlist e-mail address: Until we send the launch notice or you withdraw consent, and never longer than 24 months after you sign up. Our server deletes older sign-ups automatically.
E-mails to us: Until the matter is closed, then up to 3 years in case of possible claims.
Server logs at our hosting provider: Up to 90 days. According to Railway's documentation, logs on the Hobby plan we use stay available for 7 days.

We keep data longer only where the law requires it or where we need it to establish, exercise or defend legal claims, for example when an authority asks us to preserve a report.

6. Who receives your data

We share data with the providers that run ShowMeme and, when the law requires it, with authorities. We never sell it.

Processors, who act only on our instructions under data processing agreements (art. 28 GDPR):

Railway Corporation (USA): Hosts our server and stores results, reports and the waitlist in its EU West region in Amsterdam, the Netherlands.
Cloudflare, Inc. (USA): Domain name system, encrypted connections, caching and protection against attacks. All traffic to showmeme.app passes through Cloudflare's network, including the photos you send; Cloudflare does not store uploads.
OpenRouter, Inc. (USA): Passes the moderation check to a model host. We send requests only to DeepInfra, Inc. (USA), which runs both moderation models (Gemma 3 12B and Gemma 3 27B) with zero data retention: it keeps no copy of the image after the check. OpenRouter's privacy policy says it does not keep image files longer than it needs to route the request. Since 27 October 2026 OpenRouter screens every request for child sexual abuse material and may keep flagged material to review and report it.
CoinAxe Ltd (Dragonara Business Centre, St Julian's, Malta), which operates deAPI: Runs the AI model that edits your photo.
Cloudflare, Inc. (USA) and Google (Gmail): Cloudflare forwards messages sent to [email protected] to our inbox, which Google hosts in Gmail. We have not yet chosen the service that will send the launch notice to the waitlist; we will add it to this policy before we use it.

When ads are switched on, Google receives data as described in section 9.

We disclose data to courts, the police, prosecutors and other authorities when the law requires it, and we report child sexual abuse material to Dyżurnet.pl, run by NASK, and to the police. Legal basis: our legal obligations (art. 6(1)(c) GDPR) and our legitimate interest in protecting the people concerned (art. 6(1)(f) GDPR).

We do not sell or rent personal data.

7. Transfers outside the European Economic Area

Some providers are based in the USA, so we rely on safeguards approved by the EU.

Railway, Cloudflare, OpenRouter and Google are US companies, and OpenRouter's model hosts and deAPI's computing partners may process data outside the European Economic Area. For each provider we rely on these safeguards:

Railway: Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914), which are part of Railway's data processing agreement. Results, reports and the waitlist stay in Railway's EU West region in Amsterdam.
Cloudflare: The EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023), under which Cloudflare is certified. Cloudflare's data processing agreement adds Standard Contractual Clauses in case that certification lapses.
OpenRouter: Standard Contractual Clauses in OpenRouter's data processing agreement.
deAPI: CoinAxe Ltd is based in Malta, inside the EU, but deAPI does not name the countries where its distributed network runs. Its privacy policy says that data may be handled on third-party computers in that network and names Standard Contractual Clauses, where they apply, and Commission adequacy decisions as its safeguards.
Google: The transfer safeguards set out in Google's terms for Gmail.

To get a copy of these safeguards, write to [email protected].

8. Cookies and browser storage

We use only what the studio needs to work, and advertising cookies will run only if you agree.

Strictly necessary storage needs no consent (art. 399 of the Polish Electronic Communications Law and art. 5(3) of the ePrivacy Directive 2002/58/EC), because the service you asked for cannot work without it:

sm_session (cookie, showmeme.app, 12 months): A signed session with a random ID, your year of birth or the under-16 block marker, and the number of effects you made today. Scripts on the page cannot read it.
NEXT_LOCALE (cookie, showmeme.app, until you close the browser): The language you picked. We set it only when it differs from your browser's language.
showmeme / photo (IndexedDB, showmeme.app, 24 hours): Your photo, your settings for it and the effect you chose before adding it.
keyval-store / showmeme.studio (IndexedDB, showmeme.app, 24 hours after the last step): The steps of your current result, with their links and expiry times. After 24 hours the studio deletes them the next time you open it.
Cloudflare security cookies, such as __cf_bm or cf_clearance (showmeme.app, short-lived): Cloudflare may set them when it checks whether a visitor is a bot.

Advertising cookies, only with your consent and only once ads are on: Google and its partners will set cookies such as __gads and __gpi on showmeme.app and IDE on doubleclick.net, for up to 13 months, and Google's consent message will keep your choice in a cookie such as FCCDCF. The consent message lists every cookie and partner when ads are on; we update this list after the first weeks of ads.

We run no analytics today. If we add Umami statistics, which work without cookies, we will update this policy before they start.

The share buttons for X, Facebook and WhatsApp are plain links. Those services receive nothing from us until you tap one, and then their own rules apply.

You can delete cookies and site data at any time in your browser settings. If you delete the session cookie, the studio asks for your year of birth again and you can no longer delete your earlier results with "Delete now"; they expire on their own after 48 hours.

There are no ads yet; once they start, personalised ads will need your consent.

Today showmeme.app shows no ads and sets no advertising cookies. We plan to show Google AdSense ads on content pages, such as the effect catalogue, and an ad from Google Ad Manager, often a video, before each free effect in the studio. Result pages and share links will carry no ads. Before the first ad runs, we will switch on Google's consent message, which is certified under the IAB Transparency and Consent Framework and lists every cookie and partner.

Once ads are on:

Google, its partners and other ad vendors use cookies to show you ads based on your earlier visits to showmeme.app and to other websites.
Google may receive your IP address, the address of the page, information about your device and browser, cookie identifiers and your consent choice.
In the European Economic Area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides Google AdSense and Google Ad Manager. Google decides how it uses the data collected through its ad code and acts as an independent controller for that use. Google explains it here: How Google uses information from sites or apps that use its services.
We ask for your consent in the consent message before any advertising cookie is stored or any data is used for personalised ads. Legal basis: your consent (art. 6(1)(a) GDPR, and for storing information on your device, art. 399 of the Polish Electronic Communications Law and art. 5(3) of the ePrivacy Directive). If you refuse, Google can still show a limited ad, with no advertising cookies and no personalisation, or show no ad.
You can change or withdraw your choice at any time through the "Privacy settings" link at the bottom of every page.
You can turn off personalised ads in Google's ad settings and opt out of other vendors' personalised-ad cookies at aboutads.info or youronlinechoices.eu.
Visitors from US states with their own privacy laws see a separate Google message that lets them opt out of the sale or sharing of their data.

Our pages are not directed at children. The studio is for people aged 16 and over, and we do not mark our pages or ad requests as directed at children.

10. Automated decisions

The only automatic decision is the moderation block, and you can ask a person to review it.

Moderation decides automatically whether we make an effect or show a result. It decides about one image at a time. We do not profile you, and we make no decisions with legal or similarly significant effects on you (art. 22 GDPR). If you think the filter blocked you wrongly, write to us and a person will review the case. We do not keep blocked photos, so we can review only what you describe to us.

11. Your rights

You can see, correct, delete or move your data, object to its use, and complain to the regulator.

You have the right to:

access your data (art. 15 GDPR);
have it corrected (art. 16);
have it deleted (art. 17);
restrict its processing (art. 18);
receive the data you gave us on the basis of a contract or consent in a machine-readable format (art. 20);
object to processing based on our legitimate interest (art. 21);
withdraw consent at any time, without affecting processing done before;
lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl, or with the data protection authority in your EU country.

Send requests to [email protected]. We answer within one month. For complex requests we may extend this by two more months and will tell you why.

ShowMeme has no accounts, so we usually do not know who you are. To help us find your data, include the link of the result or the e-mail address you used. We do not collect extra data only to identify you (art. 11 GDPR). You control much of your data yourself: "Delete now" deletes a result, and clearing the site's data in your browser removes your photo and your session cookie.

12. Children

The studio is for people aged 16 and over.

We do not knowingly let anyone under 16 use the studio, and the age gate blocks it. If someone enters a year that makes them under 16, we do not save the year and only block the studio in that browser for 24 hours. If we learn that a child under 16 has used the studio, we delete the data we can link to them. If you are a parent and think your child has used ShowMeme, write to us.

Adults may upload ordinary photos of children if they are the child's parent or legal guardian or have their permission (Content Rules). We process those photos exactly as described in section 2, and moderation blocks any nude or sexual context involving a minor.

13. Security

We protect data with encryption, minimal storage and restricted access.

All connections are encrypted (HTTPS), between your browser and Cloudflare and between Cloudflare and our server.
Photos lose their metadata, stay only in working memory and never reach a disk on our server.
Results can be opened only through a random link that is hard to guess, and they expire after 48 hours.
The session cookie is signed, so it cannot be forged, and page scripts cannot read it.
Only the operator has access to the server, and access keys are kept out of the code.
If a personal data breach puts your rights at risk, we notify the Personal Data Protection Office within 72 hours, and we tell you directly when the risk is high and we can reach you.

14. Do you have to give us data

Giving data is voluntary, but the studio cannot work without a photo and your year of birth.

No law requires you to give us personal data. To make effects you must give us a photo and your year of birth; without them we cannot provide the studio. Your e-mail address for the waitlist or a report is optional, and advertising cookies will be optional.

15. Changes to this policy

We date every version and announce important changes on the site.

We update this policy when ShowMeme or the law changes, for example before we switch on ads or launch accounts. The date at the top shows the current version. We announce material changes on the site before they take effect. Write to us if you want an earlier version. The Polish and English versions are both binding.