Privacy Policy

1. Information We Collect

We collect information when you provide it to us, when you use our website or Services, and when other sources provide it to us, as further described below.

1.1 Information You Provide to Us

• Account Information. When you create an account, we collect your email address. You can sign up with a six-digit code sent to your email address, or with your Google or Apple account. If you sign up with Google or Apple, we receive the information those services send us, which includes an account identifier and your email address, and may include your name, profile picture, and language preference.
• Your Blocks. We collect the settings you create in Happy Squid. This includes the websites and applications you block, the categories you block, the names of your block groups, your intelligent exceptions, your locks, your schedules, your Free Time settings, your Angry Squid settings, your content filters, your Morning Lock, your Task Goal, and other settings and preferences within the Services. The list of applications you block stays on the device where you chose them and is not stored in your account, although we record the name of an application when you unlock it, as described below. When you start a task, we collect the description of the task, how long it should run, and the websites you always allow while it runs. We keep a list of your recent and saved tasks so that you can start them again, together with how long you have worked on each of them, the websites you had open when it last ended, and the pages Happy Squid learned to trust while it ran. We also keep the descriptions of tasks Happy Squid has already approved as productive, so that it does not review them again.
• Applications You Block. In our desktop and mobile applications, you can block applications as well as websites. The list of applications you block stays on the device where you created it and is not stored in your account.
• Your Custom Instructions. You can write your own instructions telling Happy Squid how to handle your blocks, and describe what counts as productive work for you, which Happy Squid uses when it reviews your tasks. These instructions are free text, and we collect whatever you write. Please do not include sensitive information about yourself or other people, as described in Section 4 (AI FEATURES).
• Happy Squid Chat Function. You can talk to Happy Squid on a blocked page, in the chat window it opens on a website you are visiting, in the notification it shows on your phone before it blocks a page, on a blocked application, and when it reviews whether a task you want to start is productive. We collect the messages you send and the answers Happy Squid gives, and to answer you, we send them to our AI providers, as described in Section 4 (AI FEATURES). Conversations on a blocked page, on a blocked application, or on a website you unlocked stay on your device. Conversations during a task are stored in your account with the task, so that Happy Squid remembers them on all your devices. If you start a task from Raycast, this review takes place on our servers, which keep the conversation until you start the task, cancel it, or begin a new one, and for up to one day after that.
• Support. When you contact us by email, we collect your email address, the content of your message, and any information you choose to include.
• Feedback. You can send us feedback, suggestions, or ideas about Happy Squid at any time. Giving feedback is entirely up to you, and you never have to. When you do, we collect what you write and any information you choose to include, such as your email address if you want a reply. We save your feedback to understand what is working and to improve the Services.
• Bug Reports. If you report a bug, we collect the description you write, along with the version of Happy Squid you are using, your browser, and your operating system, and we link your report to your account. Nothing else is included unless you choose to add it. Before your report is sent, we tell you what it contains and ask you to confirm. You can choose to include your settings and blocking rules, which cover the names and descriptions you wrote yourself, your custom instructions, the applications you block, and your tasks. You can also choose to include your recent browsing history, which helps us understand decisions Happy Squid made. Both are off by default, and neither is remembered between reports.
• Payment Information. When you buy a Subscription, our payment providers collect your payment details and process the payment. We do not see or store your card number or bank details. We receive information about the transaction itself, such as your billing country, the Subscription you bought, and whether the payment succeeded.
• Cancellations and Withdrawals. You can cancel your Subscription or withdraw from your contract through forms on our website without signing in. When you do, we collect the email address you enter, the type of cancellation, and the reason you give, if any. When you withdraw, we also record when your contract began, your billing country, and any refund we issue. We keep a record of every request, including requests that do not match an account, so that we can show that we received and handled it.
• Free Trials and Access Codes. If you redeem an access code, we record which code you used, how many months of access it gave you, and when you redeemed it. We also record when your free trial ends, and we remember when your last free trial ended for as long as you have an account.
• Job Applications. We may post job openings and opportunities on the website or our Services. If you reply to one of these postings by submitting your application, resume, cover letter, or other documents to us, we will collect and use your information to assess your qualifications.
• Tasks from Obsidian. If you use our Obsidian plugin and start a task from a note, we collect the task together with where it sits in your vault, as described in Section 3 (DISCLOSING YOUR INFORMATION). The plugin never sends us anything else from your notes.
• Tasks from Raycast. If you use our Raycast extension, you can start and manage your tasks from Raycast. You connect it to your Happy Squid account by confirming in Happy Squid, or with a sign-in code sent to your email address. The extension then sends us what you do in it, such as the tasks you start, change, pause, or complete and your messages to Happy Squid, and our servers carry it out and review your tasks. While you are signed in, it regularly asks our servers for your current task and your recent tasks, so that it can show them to you together with Happy Squid's answers. The extension keeps your sign-in and a copy of your current and recent tasks, and removes them when you sign out.

1.2 Information We Collect Automatically

• Browsing Data. Happy Squid's AI only looks at your browsing when you ask it to. Blocking itself runs entirely on your device and works offline, and so do content filters, which hide parts of websites such as feeds, recommendations, or comments if you turn them on, without recording or sending anything they see. Browsing websites you have not blocked, while no task is running, never leaves your device and never reaches our servers. When you get past a block with an exception or by explaining yourself to Happy Squid, or while a task is running, Happy Squid looks at the pages you visit so it can judge whether you are doing what you said you would. For each page, we collect the address of the page, the page title, the time you visited it, and the decision Happy Squid made together with its reason. On Netflix, Instagram, and TikTok, the page title does not describe the page, so Happy Squid reads it from the page itself: the title and episode you are watching on Netflix, and the author and caption of a post or video, or the name and description of a profile, on Instagram and TikTok. We also record each time you get past a block: which website it was for, which exception you used, how long you stayed and why it ended, and whether it happened on a phone or a computer. Free Time and emergency access are recorded the same way, but Happy Squid does not look at the pages you visit during them. We also collect summaries of your sessions, tasks, and days, which our servers write from this record with the help of our AI providers, so that Happy Squid can remember what happened earlier without reading every page again.
• Identifier stripping. Before any page address reaches an AI model, Happy Squid strips out its identifiers. It automatically detects the parts of an address that only serve to identify something, such as account numbers, order numbers, document IDs, session codes, and tracking values, and replaces each of them with "…". The AI model still sees which website you are on and the readable words of the address, including your search terms, because Happy Squid needs them to judge whether you are doing what you said you would, but not the identifiers. This applies to every address Happy Squid sends to an AI model, including those in the summaries our servers write. The complete address stays in your own record.
• Activity on Your Phone and Computer. To block applications, and websites outside your browser, our applications check what you are using. On Android, Happy Squid uses Android's accessibility service to see which application is open, to read the address and title of the page in your browser, and, in YouTube, Reddit, X, Instagram, TikTok, Netflix, and Disney+, to read which screen you are on and some of its text, such as your search terms, the caption of a video, or the title of something you tapped. If you turn on uninstall protection, it also reads your settings screens while a lock is running, so that Happy Squid cannot be removed during the lock. On iPhone, we use Apple's Screen Time, which only tells us how many minutes you spend in an application you unlocked with Free Time. On a computer, our desktop application checks whether blocked applications and browsers are open and on screen, and how long ago you last used your keyboard or mouse, but never what you type. All of this stays on your device, with three exceptions: the pages and screens Happy Squid looks at while it is checking on you, which we handle as Browsing Data; the name of an application you unlocked and how long you used it; and your conversation with Happy Squid when you ask it for access to an application.
• Device and Connection Information. When you install Happy Squid, we generate a random identifier for that installation. It is not tied to your device hardware, and it stays the same if you sign out. When you turn on enforcement for our desktop application, every browser in which you are signed in to Happy Squid sends us a signal every thirty seconds, so that the application knows the extension is still running. This signal contains your account, the installation identifier, and whether the browser is Safari, and our servers record when it arrived. We also store your device's time zone with your synced settings, so that your days, statistics, and summaries follow your local time, and we record whether you use Happy Squid on a phone or a computer. When Happy Squid makes a decision, it receives your local date and time.
• Your Approximate Location. When you visit our website, your browser estimates which country you are in from your device's time zone and language settings. This happens on your device and does not involve your IP address. We use it to show you prices in the right currency, to decide which payment provider handles your payment, and to show you the legal information that applies where you live. When you start a checkout, your browser sends us this country so that we can send you to the right payment provider. We do not store it, we never determine your precise location, and we do not use it for anything else.
• Usage Information. When Happy Squid makes a request to our AI providers, we record which model was used, how much text was processed, what it cost, and when it happened. We do not record the content of these requests.
• Your Daily Statistics. For each day, we record how much time you spent on tasks, which tasks you worked on and when you started them, how often Happy Squid blocked you, how much Free Time you used, when you pressed the Morning Lock button, and your progress towards your Task Goal. We keep them for eight days, so that we can show you your statistics and your Task Goal on all your devices.
• Analytics. We do not use any analytics, tracking, or advertising tools anywhere in the Services or on our website. There are no third-party scripts on our website. We do not track you across other websites, and we do not build advertising profiles. The only usage statistics we receive are the ones Apple and Google may share with us, which do not tell us who you are, as described in Section 1.3 (INFORMATION WE RECEIVE FROM THIRD PARTIES).

1.3 Information We Receive From Third Parties

• Sign-in Providers. If you sign up with Google or Apple, we receive an account identifier and your email address from them, and we may also receive your name, profile picture, and language preference, depending on the service you use and your settings with it.
• Payment Providers. Our payment providers send us information about your transaction, such as whether a payment succeeded or failed and when your Subscription renews.
• Todoist. To connect Happy Squid to Todoist, you enter your email address in Todoist and we send you a sign-in code, which creates a Happy Squid account if you do not have one yet. Todoist then asks you to allow Happy Squid to read and change your Todoist data. We receive your Todoist account identifier and an access key, which we keep on our servers and never on your devices, and we only use this access for the tasks you start with Happy Squid. When you start a Happy Squid task from Todoist, we receive the title and description of the task, its project and section, the title and description of its parent task, and a link to it. We use them as the description of your task, as described in Section 4 (AI FEATURES). Whenever a task is completed in your Todoist account, Todoist sends us its details. We only use them to end your Happy Squid task if it is the one you are working on. In that case we keep the task's identifier. Otherwise, we do not store them.
• Obsidian. We do not receive any information about you from Obsidian. When you install our Obsidian plugin, Obsidian downloads it from GitHub, and both collect their own information about that download, which is governed by their privacy policies, not this Policy. GitHub only tells us how often the plugin has been downloaded, not who downloaded it.
• Raycast. We do not receive any information about you from Raycast. When you install our Raycast extension from the Raycast Store, Raycast collects its own information about that download and about how you use Raycast, which is governed by its privacy policy, not this Policy.
• Raycast. Raycast itself does not send us any information about you. Like anyone visiting the Raycast Store, we can only see how many people have installed our Raycast extension, not who they are. What the extension sends us is described under Tasks from Raycast in Section 1.1 (INFORMATION YOU PROVIDE TO US). When you install and use the extension, Raycast collects its own information about that download and about how you use Raycast, which is governed by its privacy policy.

When you use it, it sends us what you do, such as the tasks you start, change, pause, or complete and your messages to Happy Squid, and receives your current task, your recent tasks, and Happy Squid's answers.

2. How We Use Your Information

We use your information for a variety of purposes, including the following:

• Providing the Services. We use your information to create and secure your account, to sign you in, to keep your settings and rules in sync across your devices, and to run the features you use, including blocking websites and applications, content filters, Happy Squid tasks, Free Time, Angry Squid, Morning Lock, Task Goals, locking websites, and our integrations with Todoist, Obsidian, and Raycast. We do this to provide the Services and fulfill our contractual obligation to you.
• AI Decisions. Happy Squid uses AI to decide on your access in three situations. When you explain to Happy Squid why you need a blocked website or application, it decides whether to let you in, based on what you tell it, your exceptions, your custom instructions, and your recent activity. When you open a blocked website through one of your exceptions or through Happy Squid, and while a task is running, it looks at the pages you visit to judge whether you are still doing what you set out to do, and ends your access or blocks the pages that do not fit. And before a task starts, it may review whether the task is productive, based on your description and on what you told it counts as productive work, and refuse to start a task it considers unproductive. If you discuss this review with Happy Squid, it may start the task under a description it writes itself. You can turn this review off in your settings. Our AI makes all of these decisions on its own, without anyone reviewing them first. You decide which websites and applications to block, which exceptions to allow, which tasks to work on, and how strict Happy Squid should be, and Happy Squid applies the decisions you made. You can change or delete your settings at any time, except while a lock you set yourself is still running. Our servers also regularly send the record of the pages you visited to our AI providers, so that Happy Squid can write the summaries described in Section 1.2 (INFORMATION WE COLLECT AUTOMATICALLY). We explain how this works, and what it means for you, in Section 4 (AI FEATURES). We do this to provide the Services and fulfill our contractual obligation to you.
• Payments and Subscriptions. We use your information to process your payments, to determine which payment provider handles your payment and in which currency, to apply the correct taxes, to manage renewals and cancellations, and to issue receipts and invoices. We also use your information to handle withdrawals from your contract, to refund your payments where you are entitled to a refund, and to decide whether you can receive a free trial. We do this to fulfill our contractual obligation to you and to comply with our legal obligations, including those for withdrawals and for tax and accounting records.
• Integrations. If you connect Todoist, or use our Obsidian plugin or our Raycast extension, we use the information from them to start the task you chose. In Obsidian, we also use it to show your current task and your daily statistics in your notes, and in Raycast, to show your current and recent tasks and to carry out what you do there, such as pausing or completing a task. When you finish a task you started from Todoist, we add a comment with the time you worked on it and mark it as completed in Todoist. We do this to provide the Services and fulfill our contractual obligation to you.
• Service Communications and Support. We use your email address to send you messages about your account, your Subscription, security, changes to the Services or to our terms, and other legally required notices. These messages are part of the Services and you cannot opt out of them while you have an account. We use your information to answer your questions, resolve problems, and confirm that we are speaking with the account holder. We do this to fulfill our contractual obligation to you.
• Security and Preventing Misuse. We use your information to keep the Services running, to protect our systems against attacks, and to investigate incidents when they happen. We use records of your AI usage to measure what our AI providers cost us and to apply the usage limits of the free version of Happy Squid. We remember when your last free trial ended, so that each account receives one free trial every six months, and our payment providers check payments for fraud. We do this because we have a legitimate interest in keeping the Services secure, available, and sustainable.
• Improving the Services. We use bug reports, your feedback, and the crash reports and usage statistics we receive from Apple and Google to find and fix problems, understand which features work or do not work, where our AI makes poor decisions, and what to build next. We do this because we have a legitimate interest in maintaining and improving the Services.
• Surveys and Research. From time to time, we may invite you to take part in a survey or answer questions about Happy Squid, either by email or within the Services. Taking part is always voluntary, and we use what you tell us to improve the Services. We analyze aggregated data that cannot be traced back to you. We do this only with your consent.
• Aggregated Information. We may combine information into aggregated statistics that no longer identify anyone, and we may use and publish those statistics to describe how Happy Squid is used or how it works. We do not sell aggregated information, and no information we publish can ever be traced back to you. We do this because we have a legitimate interest in understanding, analyzing, and describing our own Services.
• Promotional Messages. Where you have given us your consent, we use your email address and, if you have turned them on, notifications on your device to tell you about our products, features, and offers. You can withdraw your consent at any time, and withdrawing it does not affect the messages described under Service Communications above. We do this only with your consent.
• Job Applications. We use the information in your application to assess your qualifications, to communicate with you during the process, and to decide whether to offer you a position. We do this to take steps at your request before entering into an employment contract. If we cannot offer you a position, we keep your application so that we can answer questions about our decision. We do this because we have a legitimate interest in defending ourselves against claims arising from the application process. If you agree, we also keep your application to contact you about future openings. We do this only with your consent.
• Legal Compliance. We use your information to comply with the law, to respond to lawful requests from authorities, to enforce our Terms of Service, and to establish, exercise, or defend legal claims. We do this because we have a legitimate interest in enforcing our agreements and defending our rights, and to comply with our legal obligations.
• Business Transfers. If we are involved in a merger, acquisition, financing, insolvency, or a sale of all or part of our business or assets, your information may be transferred as part of that transaction. We do this because we have a legitimate interest in carrying out corporate transactions.

We do not use your browsing data for anything other than running the features you enabled and, if you include it in a bug report, investigating the problem you reported. We do not use your information to train AI models, and we only send it to AI providers that commit not to train models on it. We do not sell your personal data, and we do not share it for advertising. We do not use your information to build advertising profiles or to target you with ads.

3. Disclosing Your Information

We share your personal data only with the providers we need to run the Services, and in the specific situations described below.

• Databases. We use Supabase to run our servers, to store your account and your synced settings, and to sign you in. Supabase runs on Amazon Web Services, and our database is located in Frankfurt, Germany.
• Website Hosting. Our website is hosted by Cloudflare. Cloudflare delivers our pages to you from a server near you and protects the website against attacks. To do this, Cloudflare processes your IP address and technical details about your visit, such as the page you asked for, your browser, and the time of your visit. Because Cloudflare operates a worldwide network, this may happen outside the European Economic Area, as described in Section 8 (DATA TRANSFERS). We do not use Cloudflare to analyze or track your visits. Apart from Cloudflare, our website only connects to our own servers at Supabase and to Stripe, and to Stripe only on the pages where you can buy a Subscription. If you sign in on our website with Google or Apple, it sends you to them to sign in.
• Emails. We use Resend to send the emails the Services send automatically, such as the six-digit codes you use to sign in, the confirmation of your Subscription, and confirmations of a cancellation or withdrawal. Resend receives your email address and the content of each email, and records whether it was delivered. Resend is based in the United States and keeps the emails and delivery records there for thirty days, as described in Section 8 (DATA TRANSFERS), and sends our emails from servers in Ireland. When you write to us, your email is stored by our email provider IONOS in Germany.
• AI Providers. We use OpenRouter to route our AI requests to the companies that run the AI model. We only use companies headquartered in the United States or Europe, and we never send your information to the company that originally created the model. From those companies, our servers automatically choose up to five at a time based on their speed, price, and reliability, so the companies we use change over time, and if one of them cannot answer, our servers send the request to the next. We only use companies that commit not to train models on request data. Your IP address is never sent to any of them, because the request comes from our servers rather than from your device. We explain what we send and when in Section 4 (AI FEATURES).
• Sign-In Providers. If you sign up with Google or Apple, we exchange information with them to sign you in. If you use Apple's option to hide your email address, Apple forwards our emails to you.
• App Stores. You can download our mobile apps from the Apple App Store and the Google Play Store, and our browser extensions from the Mac App Store, the Chrome Web Store, Firefox Add-ons, and Microsoft Edge Add-ons. These stores collect their own information when you download our apps, under their own privacy policies.
• Payment Providers. We use Stripe to process payments. We give Stripe your email address and an identifier for your account, so that it can connect your payment to your account, and Stripe collects your payment details and billing address on its own checkout page. In most countries, Stripe processes the payment on our behalf. In some countries, Stripe handles your purchase itself as the merchant of record, through its service Link. In that case, Stripe decides for itself how to handle your payment information and does so under Link's privacy policy, and it sends you receipts and other messages about your purchase directly. Our bank receives the payouts from Stripe and sees the transaction details that come with them.
• Todoist. If you connect Happy Squid to Todoist, we share information with Todoist. When you complete a task you started from Todoist, or when the time you set for it runs out, we add a comment to it in Todoist saying how long you worked on it, and mark it as complete. If a task cannot start because you have used up your free tasks for the week, we add a comment saying so. If you sign in to Happy Squid inside Todoist, what you enter there, such as your email address and sign-in code, passes through Todoist. You can disconnect Happy Squid at any time in your Todoist settings. Todoist handles your information under its own privacy policy.
• Obsidian. Our Obsidian plugin runs inside your vault and sends information only to our servers, never to Obsidian. When you start a task from a note, the plugin sends us the words of the task, the name and folder of the note, the heading and the item the task sits under, the lines you wrote below the task, and up to twenty of the open items nested under it. We use them as the description of your task, as described in Section 4 (AI FEATURES). Nothing else from your vault leaves your device. The plugin keeps your sign-in and a copy of your day records in its own file inside your vault, so if you sync or back up your vault with another service, that file goes with it. You install the plugin through Obsidian's plugin directory, which downloads it from GitHub. Obsidian and GitHub handle that download under their own privacy policies.
• Raycast. We do not share your information with Raycast. Our Raycast extension runs on your computer and sends your information only to our servers. You install the extension through the Raycast Store, and Raycast handles that download and its own app under its own privacy policy.
• Authorities and Legal Claims. We may share your information with courts, authorities, and law enforcement where we are legally required to do so, where we need to respond to a lawful request, or where it is necessary to establish, exercise, or defend legal claims. We review every request, and we refuse requests that we are not legally obliged to answer.
• Business Transfers. If we are involved in a merger, acquisition, financing, insolvency, or a sale of all or part of our business or assets, your information may be transferred as part of that transaction.

We only work with providers we consider capable of protecting your information. Where a provider processes your information outside the European Economic Area, we take the steps described in Section 8 (DATA TRANSFERS). We do not sell your personal data. We never share your information with other users. Nobody else can see what you block, what you browse, what you write to Happy Squid, or anything else about your account.

We only work with providers we consider capable of protecting your information. Where a provider processes your information outside the European Economic Area, we take the steps described in Section 8 (DATA TRANSFERS). We do not sell your personal data. We never share your information with other users, and no other user can see what you block, what you browse, what you write to Happy Squid, or anything else about your account.

4. AI Features

When We Do Not Use AI. Blocking websites runs entirely on your device, using the rules you set. This covers the sites you added yourself, and any site covered by a category. To know whether a page needs to be blocked, or whether you have an exception open on it, Happy Squid reads the address of the tabs you open. Our Android app also reads the title of the page in your browser and, in the applications listed in Section 1.2 (INFORMATION WE COLLECT AUTOMATICALLY), which screen you are on, and on Netflix, Instagram, and TikTok our browser extension reads the title of what you are looking at from the page itself. This happens on your device only. On a website you are not blocking and while no task is running, nothing is recorded and nothing is sent anywhere.

When We Use AI. Happy Squid uses AI when a website you open is blocked and you get past the block by using your own exceptions or by explaining to Happy Squid why you need access to the website. Additionally, Happy Squid uses AI to review each page you open during a task. In both cases you have explained to Happy Squid what you intend to do, and it checks whether you are doing what you said you would. This happens while you are accessing a blocked website through an exception or by explaining yourself to Happy Squid, or while a task is running.

Happy Squid uses AI when a website you open is blocked and you get past the block by using your own exceptions or by explaining to Happy Squid why you need access to the website, and when you explain why you need a blocked application. Additionally, Happy Squid uses AI to review each page you open during a task, and, unless you turned this review off, to review whether a task is productive before it starts or when you change its description. In all of these cases you have explained to Happy Squid what you intend to do, and it checks whether you are doing what you said you would. This happens while you are accessing a blocked website or application through an exception or by explaining yourself to Happy Squid, while a task is running, or when you start or change a task. Our servers also use AI to write short summaries of your sessions, tasks, and days from the record described below.

What We Send. While Happy Squid is checking on you in the situations described above, we send the address of the page you are on, its title, and the time you visited it. On Netflix, Instagram, and TikTok, the page title does not describe the page, so we read it from the page itself: the title and episode you are watching on Netflix, and the author and caption of a post or video, or the name and description of a profile, on Instagram and TikTok. In our Android app, we read the same kind of information from the screens of the applications listed in Section 1.2 (INFORMATION WE COLLECT AUTOMATICALLY). Page addresses often contain the terms you searched for, and we send those too, because Happy Squid needs them to tell whether you are staying within your chosen exceptions or your task. We also send what happened earlier in the same session, including Happy Squid's own earlier decisions and short summaries it writes to keep track, along with your blocks, your custom instructions, your task description, and the messages you write to Happy Squid.

What We Send. While Happy Squid is checking on you in the situations described above, we send the address of the page you are on, its title, and the time you visited it. On Netflix, Instagram, and TikTok, the page title does not describe the page, so we read it from the page itself: the title and episode you are watching on Netflix, and the author and caption of a post or video, or the name and description of a profile, on Instagram and TikTok. In our Android app, we read the same kind of information from the screens of the applications listed in Section 1.2 (INFORMATION WE COLLECT AUTOMATICALLY). Page addresses often contain the terms you searched for, and we send those too, because Happy Squid needs them to tell whether you are staying within your chosen exceptions or your task. Before an address is sent, Happy Squid strips out its identifiers, as described in Section 1.2 (INFORMATION WE COLLECT AUTOMATICALLY). Page titles, and addresses you type into a message or a task description, are sent as they are. We also send your local date and time, what happened earlier in the same session or task, including Happy Squid's own earlier decisions and short summaries it writes to keep track, along with the names of the exceptions you set for the website and the one you are using, your custom instructions, your task description, including where it sits in Todoist or Obsidian if you started it there, and the messages you write to Happy Squid. When you ask for access on a blocked page or to a blocked application, we also send how much Free Time you have left and what you did earlier that day, together with the summaries of your last three days, and, for an application, its name. For the productivity review, we only send your task description, what you told Happy Squid counts as productive work, and your conversation about the review.

Where Your Information Is Processed. Your device sends this information to our servers, and our servers pass it to our AI providers, which are described in Section 3 (DISCLOSING YOUR INFORMATION). Our servers also send the record stored in your account to our AI providers on their own, to write the summaries described above, and they review the tasks you start from Raycast. Your device never contacts those providers itself. Our AI providers commit not to train models on what we send them, but some of them may keep it for a time under their own policies. Separately from the AI request, the record of the pages you visited is stored in your account on our servers, so that Happy Squid works the same way on all your devices. We explain how long we keep it in Section 7 (DATA RETENTION).

Our AI Model. The AI model we use is run for us by the companies described in Section 3 (DISCLOSING YOUR INFORMATION), which are all headquartered in the United States or Europe. We never send your information to the company that originally created the model. We only allow routing to providers that commit not to train models on request data. We do not use your information to train any AI model ourselves, and we have built no system that could do so.

What Happy Squid Remembers. Happy Squid keeps the full addresses of the pages you visited while it was checking on you for seven days. If they belong to a session or task that lasted longer, it may keep them until seven days after that session or task ended. Our servers also write short summaries of your sessions, tasks, and days, which do not replace the addresses. The summaries can still name websites, and they are kept for seven days after the period they describe before they are deleted as well. Happy Squid keeps this record on your device and in your account, so that it remembers the same things wherever you use it. If the copy in your account has not been updated for nine days, for example because you stopped using Happy Squid, we delete it. Your recent and saved tasks keep the websites you had open when a task last ended, and the pages Happy Squid learned to trust while it ran, which can be exact addresses, for as long as the task stays in your list. When you delete a task from your list, Happy Squid keeps a hidden copy of it until you have deleted five newer tasks, so that the deletion reaches your other devices.

Decisions Happy Squid Makes. Happy Squid decides on its own whether to grant, refuse, or end your access to websites, specific pages, and applications, and, unless you turned the review off, whether a task you want to start or a new description for a running task is productive, without anyone reviewing the decision first. If it considers a task unproductive, it does not start it, and if you discuss this with Happy Squid, it may start the task under a description it writes itself. This is the point of Happy Squid. You choose which websites and applications to block, which exceptions to include for each blocked website, how strict Happy Squid should be, and which tasks you want to work on. It only applies the decisions you made. Please be aware that AI models make mistakes and that Happy Squid may block pages you need or allow pages you did not want. Do not rely on Happy Squid as your only safeguard.

Please Keep Sensitive Information Out. Your custom instructions, your description of what counts as productive work, the names and descriptions of your exceptions, your task descriptions, including the tasks and notes you start them from in Todoist, Obsidian, or Raycast, and your messages to Happy Squid are sent to our AI providers as you wrote them, as outlined above. Please do not put sensitive information about yourself or other people into them.

5. Cookies and Similar Technologies

Cookies. Cookies are small pieces of information that a website stores in your browser. The law treats other kinds of storage on your device the same way, including the storage our browser extension uses to keep your rules.

What We Use. We use only what is necessary to run the Services. When you sign in, we store a session token in your browser so that you stay signed in. If you open our website with a country chosen in its address, it remembers that country, so that it keeps showing you the prices and information for it. Our browser extension stores your rules, your settings, and your recent activity on your device. Our desktop and mobile applications store the same kind of information on your device. Our Obsidian plugin keeps your sign-in and a copy of your day records in a file inside your vault, and our Raycast extension keeps your sign-in and a copy of your current and recent tasks in Raycast.

What We Do Not Use. We do not use cookies or any similar technology to track you, to build a profile of you, or to advertise to you. There are no third-party scripts and no analytics tools on our website or in the Services. Everything we store comes from us. When you sign in with Google or Apple, your browser passes through our sign-in server, where Cloudflare, which protects our servers, stores a security cookie for up to thirty minutes, and you then sign in on Google's or Apple's own website, which may store information in your browser under its own privacy policy. Because everything we store is necessary to provide the Services you asked for, we do not need to ask you for consent, and you will not see a cookie banner on our website. When you buy a Subscription, our payment provider handles the payment on its own website and may store information in your browser as part of that. This is covered by that provider's privacy policy, not by ours.

Your Choices. You can delete what our website stores through your browser settings at any time, and what our browser extension and applications store by removing them. If you do, you will be signed out and the rules and settings on your device are removed. Signing in again restores your synced rules and settings, because they are also stored on our servers. The applications you block, and the other settings and conversations that stay on one device, are not restored. To delete what we store on our servers permanently, you have to delete your account.

6. Your Privacy Rights

You have rights over the personal data we hold about you. This section explains what they are and how to use them:

• Access and Correction. You can ask us whether we hold personal data about you, and if we do, you can ask for a copy of it together with an explanation of what we use it for and who we share it with. You can ask us to correct personal data that is inaccurate or incomplete.
• Deletion and Restriction. You can ask us to delete your personal data. You can also delete your account in your account settings at any time, except while a lock you set yourself is running. You can always ask us to delete it by email instead. When you delete your account, we delete your personal data from our servers, apart from invoices and other accounting records we are legally required to keep, and the records of your cancellations and withdrawals, including the email address you entered, which we keep so that we can show how we handled them. Our payment provider keeps its own records of your payments. Deleting your account does not remove Happy Squid's access to your Todoist account, which you can remove in your Todoist settings, and it does not delete what is stored on your devices. You can ask us to stop using your personal data while keeping it stored.
• Portability. You can ask us for a copy of the information you gave us, in a format you can read and transfer to another service. This covers your blocks, your custom instructions, your settings, and your tasks.
• Objection. You can object to any use of your personal data that we base on our legitimate interests. We will look at your objection and stop unless we have compelling reasons to continue. Much of what we do with your personal data is necessary to run Happy Squid. If you object to it, or ask us to restrict it, we may no longer be able to provide the Services to you. We will tell you when that is the case, so that you can decide what you would like to do.
• Withdrawing Consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing your consent does not affect anything we did with your personal data before you withdrew it.

Contact and Authorization. To use your rights, write to us at support@happy-squid.com. We may ask you for information that lets us confirm the request comes from you, so that we do not hand your personal data to somebody else. Someone else may make a request for you, and we may ask them to show that you authorized it.

How We Handle Requests. We answer within one month. If a request is complicated, we may take up to two further months, and we will tell you within the first month if that happens. Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why. In some circumstances we may need to deny your request in whole or in part, for example if we have a legal obligation to keep your information for a certain purpose. If we cannot do what you asked, we will tell you the reason. We will never treat you differently or give you a worse service because you used your rights.

Complaints. If you think we handle your personal data unlawfully, please tell us first, and we will try to sort it out. You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You can also complain to the authority where you live.

7. Data Retention

We keep your personal data only for as long as we need it. How long that is depends on what the information is and why we have it.

• Your Account and Settings. We keep your account information, your rules, your settings, your custom instructions, your recent and saved tasks, the descriptions of tasks Happy Squid has already approved, the tasks you started from Todoist or Obsidian together with the information they came with, your connection to Todoist, the access codes you redeemed, and when your last free trial ended for as long as you have an account. When you delete your account, we delete them with it.
• Your Browsing History. Happy Squid keeps the full addresses of the pages you visited while it was checking on you, and the short summaries of your sessions, tasks, and days, for seven days, both on your device and on our servers. If the addresses belong to a session or task that lasted longer, Happy Squid may keep them until seven days after it ended, so that it can follow what you are doing. Your devices delete the older parts of this record, and the copy on our servers is updated whenever one of them syncs. If that copy has not been updated for nine days, for example because you stopped using Happy Squid, we delete it, together with your daily statistics.
• Your Tasks and Daily Statistics. We keep your daily statistics for eight days. Your conversation with Happy Squid during a task is kept with the task, and deleted when the task ends, after an hour without a new message, or when a new day starts in Happy Squid, whichever comes first. A paused task keeps its conversation until you resume it. If you use Raycast, our servers keep Happy Squid's review of your task as described in Section 1.1 (INFORMATION YOU PROVIDE TO US), the requests your devices send each other to control a task for up to one hour, and the one-time codes that connect Raycast to your account for up to five minutes.
• Support, Bug Reports, and Feedback. We keep your emails for as long as we need them to deal with your request. Where an email relates to your contract with us, German law requires us to keep it for six years. Feedback you send us we keep separately from your account, for as long as it is useful to us. We delete bug reports thirty days after you send them. You can ask us to delete yours sooner by contacting us.
• Technical Records. We keep records of your AI usage and of what our AI requests cost us for twelve months, the signals that tell us enforcement is running on your desktop for seven days, and the connection logs our hosting provider keeps for seven days. After twelve months, we only keep monthly totals of our AI costs that identify no one. These records contain no page addresses, no titles, and none of your text.
• Payments and Invoices. Tax and commercial law require us to keep invoices, receipts, and accounting records for up to ten years from the end of the year in which they were created. We keep these even after you delete your account, and we use them only to meet those obligations. We also keep the records of your cancellations and withdrawals, including the email address and any reason you entered, and the notices our payment provider sends us about your Subscription, even after you delete your account, so that we can show that we received and handled them.
• Job Applications. If we offer you a position, your application becomes part of your employment file. If we do not, we delete your application six months after we tell you our decision. You may raise claims about a hiring decision, and we keep your application for that period so that we can respond. If you agreed that we may keep your application for future openings, we keep it for two years and then delete it, and you can ask us to delete it sooner at any time.

When you delete your account, we delete your personal data from our systems, apart from what the law requires us to keep and the records of cancellations and withdrawals described above. We do not use backups for anything other than restoring our systems after a failure.

8. Data Transfers

European and International Data Transfers. Our database is located in Frankfurt, Germany. Your account, your blocks, your settings, your tasks, and the record of the pages you visited while Happy Squid was checking on you are all stored there, and reach it directly without passing through any other country. When Happy Squid uses AI, the information described in Section 4 (AI FEATURES) is sent to OpenRouter in the United States, which passes it to one of the companies running the model. We also work with providers outside the European Economic Area for sign-in, payments, emails, and our website, including Google, Apple, Stripe, Resend, and Cloudflare, as described in Section 3 (DISCLOSING YOUR INFORMATION).

How We Protect Data Transfers. United States law does not offer the same protection for personal data as European law. For every provider outside Europe, we rely on the Standard Contractual Clauses, a contract approved by the European Commission that requires the provider to protect your personal data to European standards. The providers that process your personal data on our behalf may only use it to provide their service to us, and never for their own purposes. They must pass the same obligations on to anyone they work with, and they remain responsible to us for what those companies do. If a government authority asks them for your personal data, they must tell us, unless the law forbids it, and they must challenge requests they believe are unlawful. Google and Apple when you sign in with them, the app stores, and Stripe when it handles your purchase as the merchant of record decide for themselves how to handle your information, as described in Section 3 (DISCLOSING YOUR INFORMATION). You can ask us for a copy of the Standard Contractual Clauses by writing to support@happy-squid.com.

9. How We Protect Your Information

Your information is encrypted while it travels between your device, our servers, and our providers, and it is encrypted while it is stored. Only the people who work on Happy Squid can reach the systems that hold your personal data, and only when they need to. We take security seriously, but no service can promise that information is completely safe. If something happens to your personal data that puts you at risk, we will tell you and the authorities, as the law requires. If we learn of a security breach, we may attempt to notify you electronically by posting a notice on the Services, or by sending an email to you.

10. Children

You must be at least sixteen years old to use the Services. If you are a minor under the law of the country where you live, you may only use the Services with the consent of your parent or legal guardian. The Services are not directed at children, and we do not knowingly collect personal data from anyone below this age limit. If we learn that we hold personal data from someone below this age limit, or from a minor whose parent or legal guardian has not consented, we will delete the data and close the account. If you are a parent or legal guardian and believe your child uses the Services without your consent, or that we hold information about your child, please contact us at support@happy-squid.com and we will delete the information and close the account.

11. Changes to This Policy

We may update this Policy from time to time, for example when we change how the Services work, when we start using a new provider, or when the law requires it. The current version is always available on our website, and the date at the top tells you when we last updated it. If we make a change that materially affects how we handle your personal data or what rights you have, we will tell you by email at least thirty days before it takes effect. Smaller changes, such as adding or changing a provider or clarifying wording, take effect when we publish them. If you do not agree with a change, you can delete your account, as described in Section 6 (YOUR PRIVACY RIGHTS).

12. How to Contact Us

Happy Squid is operated by Brünnel, Maar & Zinn GbR, Hufelandstraße 12, 10407 Berlin, Germany. It is the controller for the personal data described in this Policy. If you have questions about this Policy, or if you would like to use any of the rights described in Section 6 (YOUR PRIVACY RIGHTS), please write to us at support@happy-squid.com. You may write to us at our address, but we prefer to be contacted by email, where we will be able to respond fastest.

13. Country-Specific Provisions

13.1 Residents of the United States

The following sections only apply to you if you reside in the United States.

What We Collect and Share. Section 1 (INFORMATION WE COLLECT) describes the categories of personal information we collect. Section 2 (HOW WE USE YOUR INFORMATION) explains what we use each of them for, and Section 3 (DISCLOSING YOUR INFORMATION) lists who we share them with. We have collected and disclosed these categories in the last twelve months.

We Do Not Sell Your Personal Information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in California and other US privacy laws. We have not done so in the last twelve months. Because we do not sell or share your personal information at all, there is nothing for you to opt out of.

Sensitive Personal Information. Some of what we collect may count as sensitive personal information under US privacy laws, including the pages you visit while Happy Squid is checking on you. We keep the full addresses and the summaries for seven days, or, for a session or task that lasted longer, until seven days after it ended, as described in Section 7 (DATA RETENTION). We use it only to provide the Services you asked for, and never for advertising, profiling, or any purpose that would give you the right to limit our use of it.

Your Rights. Depending on where you live, you have the right to know what personal information we hold about you and to receive a copy of it, to correct it, to delete it, to obtain it in a portable format, to opt out of the sharing of it and of targeted advertising, and to opt out of profiling that has legal or similarly significant effects. Section 6 (YOUR PRIVACY RIGHTS) explains how to use these rights and how we handle your request. Some states also let you appeal if we decline a request. If we decline, we will tell you why and how to appeal. We will never deny you the Services, charge you a different price, or give you a lower quality of service because you used your privacy rights. Someone else may make a request for you, as described in Section 6 (YOUR PRIVACY RIGHTS).

California Residents. If you live in California, the California Consumer Privacy Act gives you specific rights over your personal information. These rights apply to the extent you are a California consumer and we act as a "business" under that law. We do not disclose your personal information to third parties for their own direct marketing purposes.

13.2 Residents of the United Kingdom

If you live in the United Kingdom, the UK GDPR applies to you, and the references to European Union law in this Policy should be read as references to the equivalent UK provisions. You have the same rights described in Section 6 (YOUR PRIVACY RIGHTS), and you can complain to the UK Information Commissioner's Office.