Privacy Policy

1. Information We Collect

We collect information when you provide it to us, when you use our website or Services, and when other sources provide it to us, as further described below.

1.1 Information You Provide to Us

• Account Information. When you create an account, we collect your email address. You can sign up with a six-digit code sent to your email address, or with your Google or Apple account. If you sign up with Google or Apple, we receive the information those services send us, which includes an account identifier and your email address, and may include your name, profile picture, and language preference.
• Your Blocks. We collect the settings you create in Happy Squid. This includes the websites you block, the categories you block, the names of your block groups, your intelligent exceptions, your locks, your Free Time settings, your Angry Squid settings, and other settings and preferences within the Services. When you start a task, we collect the description of the task and the websites you always allow while the task runs.
• Your Custom Instructions. You can write your own instructions telling Happy Squid how to handle your blocks. These instructions are free text, and we collect whatever you write. Please do not include sensitive information about yourself or other people, as described in Section 4 (AI Features).
• Happy Squid Chat Function. When you talk to Happy Squid on a blocked page, we collect the messages you send. To answer you, we send them to our AI providers, as described in Section 4 (AI Features). The conversations are saved only on your device and not stored on our servers.
• Support Requests. When you contact us by email, we collect your email address, the content of your message, and any information you choose to include.
• Feedback. You can send us feedback, suggestions, or ideas about Happy Squid at any time. Giving feedback is entirely up to you, and you never have to. When you do, we collect what you write and any information you choose to include, such as your email address if you want a reply. We save your feedback to understand what is working and to improve the Services.
• Bug Reports. If you report a bug, we collect the description you write, along with the version of Happy Squid you are using, your browser, and your operating system. Nothing else is included unless you choose to add it. Before your report is sent, we show you exactly what it contains and ask you to confirm. You can choose to include your settings and blocking rules, which cover the names and descriptions you wrote yourself, your custom instructions, and your tasks. You can also choose to include your recent browsing history, which helps us understand decisions Happy Squid made. Both are off by default, and neither is remembered between reports. Most problems with blocking or with Happy Squid's decisions cannot be reproduced from a description alone, and without your rules or your history we often cannot find the cause. We delete bug reports after thirty days. You may ask us to delete yours sooner.
• Payment Information. When you buy a Subscription, our payment providers collect your payment details and process the payment for us. We do not see or store your card number or bank details. We receive information about the transaction itself, such as your billing country, the Subscription you bought, and whether the payment succeeded.
• Job Applications. We may post job openings and opportunities on the website or our Services. If you reply to one of these postings by submitting your application, resume, cover letter, or other documents to us, we will collect and use your information to assess your qualifications.

1.2 Information We Collect Automatically

• Browsing Data. When you get past a block and choose an exception or use the chat function to unlock the blocked website, or while a task is running, Happy Squid looks at the pages you visit so it can judge whether you are doing what you said you would. For each page, we collect the address of the page, the page title, the time you visited it, and the decision Happy Squid made together with its reason. Page addresses often contain the terms you searched for, and we keep those, because Happy Squid needs them to identify whether you are doing what you said you would do. We also collect summaries Happy Squid writes about your sessions and days, which let it remember what happened earlier without keeping every page. The blocking itself runs entirely on your device and works offline. Ordinary browsing without using intelligent exceptions or tasks never leaves your device and never reaches our servers.
• Device and Connection Information. When you install Happy Squid, we generate a random identifier for that installation. It is not tied to your device hardware, and it stays the same if you sign out. While enforcement is running on your desktop, your installation sends us a signal every thirty seconds so we know it is still active. This signal contains the installation identifier and the time. Our hosting provider records IP addresses as part of running our servers and keeping them secure. We do not store IP addresses ourselves, and your IP address is never sent to our AI providers.
• Your Approximate Location. When you visit our website, we work out which country you are in from your IP address. We use this to show you prices in the right currency, and to apply the correct taxes. We only determine your country, not your precise location, and we do not use it for anything else.
• Usage Information. When Happy Squid makes a request to our AI providers, we record which model was used, how much text was processed, what it cost, and when it happened. We do not record the content of these requests. We also record how many minutes you have used when using Free Time and when your session has started, though nothing about the pages you visit is sent.
• Notifications. If you turn on notifications, we collect the token your device needs to receive them.
• Analytics. We do not use any analytics, tracking, or advertising tools anywhere in the Services or on our website. There are no third-party scripts on our website. We do not track you across other websites, and we do not build advertising profiles.

1.3 Information We Receive From Third Parties

• Sign-in Providers. If you sign up with Google or Apple, we receive an account identifier and your email address from them, and we may also receive your name, profile picture, and language preference, depending on the service you use and your settings with it.
• Payment Providers. Our payment providers send us information about your transaction, such as whether a payment succeeded or failed and when your Subscription renews.
• App Stores. If you buy a Subscription through the Apple App Store or Google Play Store, we receive information about that purchase from the store. Apple, Google, Mozilla, and Microsoft also collect their own information when you download Happy Squid, which is governed by their privacy policies, not this Policy.

2. How We Use Your Information

We use your information for a variety of purposes, including the following:

• Providing the Services. We use your information to create and secure your account, to sign you in, to keep your settings and rules in sync across your devices, and to run the features you use, including blocking websites, Happy Squid tasks, Free Time, Angry Squid, and locking websites. We do this to provide the Services and fulfill our contractual obligation to you.
• AI Decisions. When you access a blocked website by using an exception or explaining your use case to Happy Squid, or when you start a Happy Squid task, we use your exceptions, your custom instructions, your task description, and the pages you visit so that Happy Squid can judge whether you are doing what you set out to do, and grant access, refuse it, or end it accordingly. Our AI makes these decisions on its own, without anyone reviewing them first. You decide which websites to block, which exceptions to grant, which tasks you want to work on, and how strict Happy Squid’s decisions are supposed to be, and Happy Squid applies the decisions you made. You can change or delete your settings at any time, except while a lock you set yourself is still running. We explain how this works, and what it means for you, in Section 4 (AI Features). We do this to provide the Services and fulfill our contractual obligation to you.
• Payments and Subscriptions. We use your information to process your payments, to determine which payment provider handles your payment and in which currency, to apply the correct taxes, to manage renewals and cancellations, and to issue receipts and invoices. We do this to fulfill our contractual obligation to you and to comply with our legal obligations for tax and accounting records.
• Service Communications. We use your email address to send you messages about your account, your Subscription, security, changes to the Services or to our terms, and other legally required notices. These messages are part of the Services and you cannot opt out of them while you have an account. We do this to fulfill our contractual obligation to you.
• Support. We use your information to answer your questions, resolve problems, and confirm that we are speaking with the account holder. We do this to fulfill our contractual obligation to you.
• Security and Reliability. We use your information to keep the Services running, to protect our systems against attacks, and to investigate incidents when they happen. We do this because we have a legitimate interest in keeping the Services secure and available.
• Costs and Preventing Misuse. We use records of your AI usage to measure what our AI providers cost us. We also use your information to detect and prevent misuse of the Services, including fraudulent billing information and accounts created to obtain more than one free trial. We do this because we have a legitimate interest in running a sustainable service and preventing misuse.
• Fixing Problems and Improving the Services. We use bug reports and your feedback to find and fix problems. We also look at how the Services are used overall, so that we can understand which features work, where our AI makes poor decisions, and what to build next. We do this because we have a legitimate interest in maintaining and improving the Services.
• Surveys and Research. From time to time, we may invite you to take part in a survey or answer questions about Happy Squid, either by email or within the Services. Taking part is always voluntary, and we use what you tell us to improve the Services. We analyze aggregated data that cannot be traced back to you.
• Aggregated Information. We may combine information into aggregated statistics that no longer identify anyone, and we may use and publish those statistics to describe how Happy Squid is used or how it works. We do not sell aggregated information, and no information we publish can ever be traced back to you. We do this because we have a legitimate interest in understanding, analyzing, and describing our own Services.
• Promotional Messages. Where you have given us your consent, we use your email address and, if you have turned them on, notifications on your device to tell you about our products, features, and offers. You can withdraw your consent at any time, and withdrawing it does not affect the messages described under Service Communications above. We do this only with your consent.
• Job Applications. We use the information in your application to assess your qualifications, to communicate with you during the process, and to decide whether to offer you a position. We do this to take steps at your request before entering into an employment contract. If we cannot offer you a position, we keep your application so that we can answer questions about our decision. We do this because we have a legitimate interest in defending ourselves against claims arising from the application process. If you agree, we also keep your application to contact you about future openings. We do this only with your consent.
• Legal Compliance. We use your information to comply with the law, to respond to lawful requests from authorities, to enforce our Terms of Service, and to establish, exercise, or defend legal claims. We do this because we have a legitimate interest in enforcing our agreements and defending our rights, and to comply with our legal obligations.
• Business Transfers. If we are involved in a merger, acquisition, financing, insolvency, or a sale of all or part of our business or assets, your information may be transferred as part of that transaction. We do this because we have a legitimate interest in carrying out corporate transactions.

We do not use your browsing data for anything other than running the features you enabled. We do not use your information to train AI models, and the AI providers we work with are contractually and technically prevented from training on it. We do not sell your personal data, and we do not share it for advertising. We do not use your information to build advertising profiles or to target you with ads.

3. Disclosing Your Information

We share your personal data only with the providers we need to run the Services, and in the specific situations described below.

• Hosting and Databases. We use Supabase to host our servers, store your account and synced settings, and sign you in. Supabase runs on Amazon Web Services, and our database is located in Frankfurt, Germany. Supabase also sends automatic confirmations, such as the six-digit codes you use to sign in or subscription confirmations.
• AI Providers. We use OpenRouter to route our AI requests to the company that runs the AI model. Those companies are currently primarily CoreWeave, Novita, and DeepInfra, but OpenRouter may fall back to other companies when required, and we may change them. The model we use is an open-weights model, which means these companies run a copy of it on their own systems. We do not send your information to the company that originally created the model. We only allow routing to providers that commit not to train models on request data. Your IP address is never sent to any of them, because the request comes from our servers rather than from your device. We explain what we send and when in Section 4 (AI Features).
• Sign-In and Notifications. If you sign up with Google or Apple, we exchange information with them to sign you in. If you turn on notifications, we use Apple's and Google's notification services to deliver them to your device.
• Payment Providers. We use Stripe and Paddle to process payments. Which one handles your payment depends on where you live. Paddle sells our Subscriptions as the seller of record, which means it decides for itself how to handle your payment information and does so under its own privacy policy. Stripe processes payments on our behalf. Our bank receives the payouts from these providers and sees the transaction details that come with them.
• App Stores. If you buy a Subscription through the Apple App Store or Google Play Store, that store handles your payment and sends us information about the purchase. Apple, Google, Mozilla, and Microsoft also collect their own information when you download Happy Squid, under their own privacy policies.
• Our Website. When you visit our website, we use a third-party service to work out which country you are in from your IP address, so that we can show you the right prices. We do not use any other third-party services on our website.
• Authorities and Legal Claims. We may share your information with courts, authorities, and law enforcement where we are legally required to do so, where we need to respond to a lawful request, or where it is necessary to establish, exercise, or defend legal claims. We review every request, and we refuse requests that we are not legally obliged to answer.
• Business Transfers. If we are involved in a merger, acquisition, financing, insolvency, or a sale of all or part of our business or assets, your information may be transferred as part of that transaction.

We only work with providers we consider capable of protecting your information. Where a provider processes your information outside the European Economic Area, we take the steps described in Section 8 (Data Transfers). We do not sell your personal data. We never share your information with other users. Nobody else can see what you block, what you browse, what you write to Happy Squid, or anything else about your account.

4. AI Features

When We Do Not Use AI. Blocking websites runs entirely on your device, using the rules you set. This covers the sites you added yourself, and any site covered by a category. To know whether a page needs to be blocked, or whether you have an exception open on it, Happy Squid only reads the address of the tabs you open. This happens on your device only. On a website you are not blocking and while no task is running, nothing is recorded and nothing is sent anywhere.

When We Use AI. Happy Squid uses AI when a website you open is blocked and you get past the block by using your own exceptions or by explaining to Happy Squid why you need access to the website. Additionally, Happy Squid uses AI to review each page you open during a task. In both cases you have explained to Happy Squid what you intend to do, and it checks whether you are doing what you said you would. This happens while you are accessing a blocked website through an exception or by explaining yourself to Happy Squid, or while a task is running.

What We Send. While Happy Squid is checking on you in the situations described above, we send the address of the page you are on, its title, and the time you visited it. On Netflix, we also read the title of what you are watching from the page itself. This is the only website where we read anything from the page. Page addresses often contain the terms you searched for, and we send those too, because Happy Squid needs them to tell whether you are staying within your chosen exceptions or your task. We also send what happened earlier in the same session, including Happy Squid's own earlier decisions and short summaries it writes to keep track, along with your blocks, your custom instructions, your task description, and the messages you write to Happy Squid.

Where Your Information Is Processed. Your device sends this information to our servers, and our servers pass it to our AI providers, which are listed in Section 3 (Disclosing Your Information). Your device never contacts those providers itself. Our AI providers do not keep what we send them. Separately from the AI request, the record of the pages you visited is stored in your account on our servers, so that Happy Squid works the same way on all your devices. We explain how long we keep it in Section 7 (Data Retention).

Our AI Model. We use an open-weights AI model, which means the model is publicly available and any company can run its own copy of it. The companies listed in Section 3 (Disclosing Your Information) run a copy for us. We do not send your information to the company that originally created the model. We only allow routing to providers that commit not to train models on request data. We do not use your information to train any AI model ourselves, and we have built no system that could do so.

What Happy Squid Remembers. Happy Squid keeps the full addresses of the pages you visited while it was checking on you for one day. It then writes a short summary of what you did and deletes most addresses. The summaries can still name websites, and they are kept for seven days before they are deleted as well. Happy Squid keeps this record on your device and in your account, so that it remembers the same things wherever you use it. While a task is still open, Happy Squid keeps the addresses for as long as it runs, and for no longer than seven days. If you stop using Happy Squid without deleting your account, we delete the record we hold on our servers after thirty days.

Decisions Happy Squid Makes. Happy Squid decides on its own whether to grant, refuse, or end your access to websites and specific pages, without anyone reviewing the decision first. This is the point of Happy Squid. You choose which websites to block, which exceptions to include for each blocked website, how strict Happy Squid should be, and which tasks you want to work on. It only applies the decisions you made. Please be aware that AI models make mistakes and that Happy Squid may block pages you need or allow pages you did not want. Do not rely on Happy Squid as your only safeguard.

Please Keep Sensitive Information Out. Your custom instructions, your task descriptions, and your messages to Happy Squid are sent to our AI providers, as outlined above. Please do not put sensitive information about yourself or other people into them.

5. Cookies and Similar Technologies

Cookies. Cookies are small pieces of information that a website stores in your browser. The law treats other kinds of storage on your device the same way, including the storage our browser extension uses to keep your rules.

What We Use. We use only what is necessary to run the Services. When you sign in, we store a session token in your browser so that you stay signed in. Our browser extension stores your rules, your settings, and your recent activity on your device. Our desktop and mobile applications store the same kind of information on your device.

What We Do Not Use. We do not use cookies or any similar technology to track you, to build a profile of you, or to advertise to you. There are no third-party scripts and no analytics tools on our website or in the Services. Everything we store comes from us. No other company stores anything in your browser through our website or the Services, and there are no third-party scripts or analytics tools anywhere in them. Because everything we store is necessary to provide the Services you asked for, we do not need to ask you for consent, and you will not see a cookie banner on our website. When you buy a Subscription, our payment provider handles the payment on its own website and may store information in your browser as part of that. This is covered by that provider's privacy policy, not by ours.

Your Choices. You can delete stored information through your browser settings at any time. If you do, you will be signed out and the rules and settings on your device are removed. Signing in again restores them, because they are also stored on our servers. To delete them permanently, you have to delete your account.

6. Your Privacy Rights

You have rights over the personal data we hold about you. This section explains what they are and how to use them:

• Access and Correction. You can ask us whether we hold personal data about you, and if we do, you can ask for a copy of it together with an explanation of what we use it for and who we share it with. You can ask us to correct personal data that is inaccurate or incomplete.
• Deletion and Restriction. You can ask us to delete your personal data. You can also delete your account at any time. When you delete your account, we delete your personal data, apart from the small amount we are legally required to keep, such as invoices and other accounting records. You can ask us to stop using your personal data while keeping it stored.
• Portability. You can ask us for a copy of the information you gave us, in a format you can read and transfer to another service. This covers your blocks, your custom instructions, and your settings.
• Objection. You can object to any use of your personal data that we base on our legitimate interests. We will look at your objection and stop unless we have compelling reasons to continue. Much of what we do with your personal data is necessary to run Happy Squid. If you object to it, or ask us to restrict it, we may no longer be able to provide the Services to you. We will tell you when that is the case, so that you can decide what you would like to do.
• Withdrawing Consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing your consent does not affect anything we did with your personal data before you withdrew it.

Contact and Authorization. To use your rights, write to us at support@happy-squid.com. We may ask you for information that lets us confirm the request comes from you, so that we do not hand your personal data to somebody else. Someone else may make a request for you, and we may ask them to show that you authorized it.

How We Handle Requests. We answer within one month. If a request is complicated, we may take up to two further months, and we will tell you within the first month if that happens. Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why. In some circumstances we may need to deny your request in whole or in part, for example if we have a legal obligation to keep your information for a certain purpose. If we cannot do what you asked, we will tell you the reason. We will never treat you differently or give you a worse service because you used your rights.

Complaints. If you think we handle your personal data unlawfully, please tell us first, and we will try to sort it out. You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You can also complain to the authority where you live.

7. Data Retention

We keep your personal data only for as long as we need it. How long that is depends on what the information is and why we have it.

• Your Account and Settings. We keep your account information, your rules, your settings, and your custom instructions for as long as you have an account. When you delete your account, we delete them with it.
• Your Browsing History. Happy Squid keeps the full addresses of the pages you visited while it was checking on you for one day, and a short summary of what you did for seven days, both on your device and on our servers. While a task is still open, Happy Squid keeps the addresses for as long as it runs, so that it can follow what you are doing, but in any case for no longer than seven days. If you stop using Happy Squid without deleting your account, we delete the last summary we hold on our servers after thirty days.
• Support, Bug Reports, and Feedback. We keep your emails for as long as we need them to deal with your request. Where an email relates to your contract with us, German law requires us to keep it for six years. Feedback you send us we keep separately from your account, for as long as it is useful to us. We delete bug reports thirty days after you send them. You can ask us to delete yours sooner by contacting us.
• Technical Records. We keep records of what our AI requests cost us for twelve months, the signals that tell us enforcement is running on your desktop for seven days, and the connection logs our hosting provider keeps for one day. These records contain no page addresses, no titles, and none of your text.
• Payments and Invoices. Tax and commercial law require us to keep invoices, receipts, and accounting records for up to ten years from the end of the year in which they were created. We keep these even after you delete your account, and we use them only to meet those obligations.
• Job Applications. If we offer you a position, your application becomes part of your employment file. If we do not, we delete your application six months after we tell you our decision. You may raise claims about a hiring decision, and we keep your application for that period so that we can respond. If you agreed that we may keep your application for future openings, we keep it for two years and then delete it, and you can ask us to delete it sooner at any time.

When you delete your account, we delete your personal data from our systems, apart from what the law requires us to keep. We do not use backups for anything other than restoring our systems after a failure.

8. Data Transfers

European and International Data Transfers. Our database is located in Frankfurt, Germany. Your account, your blocks, your settings, your tasks, and the record of the pages you visited while Happy Squid was checking on you are all stored there, and reach it directly without passing through any other country. When Happy Squid makes a decision, the information described in Section 4 (AI Features) is sent to our AI providers in the United States. OpenRouter receives it first and passes it to the company running the model. We also work with providers in the United States for sign-in and for payments, as described in Section 3 (Disclosing Your Information).

How We Protect Data Transfers. United States law does not offer the same protection for personal data as European law. For every provider outside Europe, we rely on the Standard Contractual Clauses, a contract approved by the European Commission that requires the provider to protect your personal data to European standards. Our main providers may only use your personal data to provide their service to us, and never for their own purposes. They must pass the same obligations on to anyone they work with, and they remain responsible to us for what those companies do. If a government authority asks them for your personal data, they must tell us, unless the law forbids it, and they must challenge requests they believe are unlawful. You can ask us for a copy of the Standard Contractual Clauses by writing to support@happy-squid.com.

9. How We Protect Your Information

Your information is encrypted while it travels between your device, our servers, and our providers, and it is encrypted while it is stored. Only the people who work on Happy Squid can reach the systems that hold your personal data, and only when they need to. We take security seriously, but no service can promise that information is completely safe. If something happens to your personal data that puts you at risk, we will tell you and the authorities, as the law requires. If we learn of a security breach, we may attempt to notify you electronically by posting a notice on the Services, or by sending an email to you.

10. Children

You must be at least sixteen years old to use the Services if you live in the European Economic Area, and at least thirteen years old if you live anywhere else. If you are under eighteen, or under the age of majority where you live, you may only use the Services with the consent of your parent or legal guardian. The Services are not directed at children, and we do not knowingly collect personal data from anyone below these age limits. If we learn that we hold personal data from someone below these age limits, or from a minor whose parent or legal guardian has not consented, we will delete the data and close the account. If you are a parent or legal guardian and believe your child uses the Services without your consent, or that we hold information about your child, please contact us at support@happy-squid.com and we will delete the information and close the account.

11. Changes to This Policy

We may update this Policy from time to time, for example when we change how the Services work, when we start using a new provider, or when the law requires it. The current version is always available on our website, and the date at the top tells you when we last updated it. If we make a change that materially affects how we handle your personal data or what rights you have, we will tell you by email or through a notice in the Services at least thirty days before it takes effect. Smaller changes, such as adding or changing a provider or clarifying wording, take effect when we publish them. If you do not agree with a change, you can delete your account at any time.

12. How to Contact Us

Happy Squid is operated by Brünnel, Maar & Zinn GbR, Hufelandstraße 12, 10407 Berlin, Germany. It is the controller for the personal data described in this Policy. If you have questions about this Policy, or if you would like to use any of the rights described in Section 6 (Your Privacy Rights), please write to us at support@happy-squid.com. You may write to us at our address, but we prefer to be contacted by email, where we will be able to respond fastest.

13. Country-Specific Provisions

13.1 Residents of the United States

The following sections only apply to you if you reside in the United States.

What We Collect and Share. Section 1 (Information We Collect) describes the categories of personal information we collect. Section 2 (How We Use Your Information) explains what we use each of them for, and Section 3 (Disclosing Your Information) lists who we share them with. We have collected and disclosed these categories in the last twelve months.

We Do Not Sell Your Personal Information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in California and other US privacy laws. We have not done so in the last twelve months. Because we do not sell or share your personal information at all, there is nothing for you to opt out of.

Sensitive Personal Information. Some of what we collect may count as sensitive personal information under US privacy laws, including the pages you visit while Happy Squid is checking on you. We keep the full addresses for one day, or for as long as a task is open and no longer than seven days, and the summaries for seven days, as described in Section 7 (Data Retention). We use it only to provide the Services you asked for, and never for advertising, profiling, or any purpose that would give you the right to limit our use of it.

Your Rights. Depending on where you live, you have the right to know what personal information we hold about you and to receive a copy of it, to correct it, to delete it, to obtain it in a portable format, to opt out of the sharing of it and of targeted advertising, and to opt out of profiling that has legal or similarly significant effects. Section 6 (Your Privacy Rights) explains how to use these rights and how we handle your request. Some states also let you appeal if we decline a request. If we decline, we will tell you why and how to appeal. We will never deny you the Services, charge you a different price, or give you a lower quality of service because you used your privacy rights. Someone else may make a request for you, as described in Section 6 (Your Privacy Rights).

California Residents. If you live in California, the California Consumer Privacy Act gives you specific rights over your personal information. These rights apply to the extent you are a California consumer and we act as a “business” under that law. We do not disclose your personal information to third parties for their own direct marketing purposes.

13.2 Residents of the United Kingdom

If you live in the United Kingdom, the UK GDPR applies to you, and the references to European Union law in this Policy should be read as references to the equivalent UK provisions. You have the same rights described in Section 6 (Your Privacy Rights), and you can complain to the UK Information Commissioner's Office.