Privacy policy

This is the Squirm.io privacy policy: what the game uses, why, and what you can do about it. Last updated 29 October 2026. Auf Deutsch.

The short version

The game makes a guest account for you the first time you play, on our website and in our apps. It is a random code, not your name. We do not ask for your real name, age or address, and we do not ask for an email address.
You can sign in with Google, Apple or Discord to keep your progress on every device. We keep only which service you used and the ID number it gives us for you: no name, no email, no picture.
The nickname you type is shown to other players and on the game's leaderboards, and a very long worm can put it on our public Hall of Fame.
Your games, your level, your Nuggets and anything you unlock are saved to your account on our server.
In our apps you can buy Nuggets and the Starter Pack with real money. Apple or Google takes the payment; we never see your card.
The apps and the website show adverts, and the apps can send you notifications if you allow them. You can say no to each, and the game works the same.
You can delete your account and everything in it at any time, in the game or on the web (see Deleting your account, below).
We do not sell your information.

Who we are

Squirm.io is a free multiplayer worm game made by Pranksters LTD, 20-22 Wenlock Road, London N1 7GU, United Kingdom (company number 94888825). You can play it at squirm.io, on games websites such as CrazyGames, and in our apps for iPhone, iPad and Android. Pranksters LTD decides how the information on this page is used, which makes it the "data controller". For anything on this page, email support@squirm.io or use our contact form: that is the way to reach us.

Your nickname

You can type a nickname before you play; leave it blank and you are "Worm" with four numbers, like Worm4827. Please don't use your real name or anything that could identify you, like your school or a username you use elsewhere: your nickname is public. It is shown above your worm, on the live top 10, to a player whose worm eats yours (and to you, if yours eats theirs), on the game's Today, This week and All time leaderboards (with your level and the skin you played), and on the all-time Hall of Fame if you get long enough.

Our server checks every nickname against a list of rude and hateful words and changes a name that fails to "Worm". If a name upsets you, hide it or report it from the screen you see when your worm is eaten. A report sends us the name, the arena and the time, and nothing about you.

The Hall of Fame

A public list of the 100 longest worms of all time, on our website and in the game. For each entry we keep three things: the nickname, the length, and the day. An entry stays until a longer worm pushes it off. Deleting your account does not remove an entry: to have one removed, email support@squirm.io with the nickname and roughly when. We can't tell who typed a name, so we remove an entry for anyone who asks.

Your account

The first time you play, on our website or in an app, the game makes a guest account for you on our server. It holds:

a random code that identifies it: not your name, and nothing about you;
a record of each game: the nickname and skin you played it under, how long your worm got, how many worms it ate, how long it lasted, how many Nuggets it collected, and when it ended;
your totals: best length, total length, number of games, and your XP and level, which are worked out from your games;
your Nuggets balance, and the ledger: a list of each change to it, with the amount, the date and the reason (what earned it, such as an achievement, the daily gift, the reward wheel, a video or a purchase, or what it was spent on). The ledger is how we make sure each reward is paid once;
your power-up upgrade levels and the power-up charges you are carrying;
the skins, backgrounds and other looks you have unlocked or bought;
a note of when the progress your browser had saved before accounts existed was copied in (this happens once);
if you sign in, which service you used (Google, Apple or Discord) and the ID number it gives us for you (see the next section);
if you buy something in an app, the purchase records described under Buying in the apps;
if you use an app and allow notifications, your phone's notification address, described under Notifications.

Your browser or app keeps a key to the account (another random code), so your games keep counting towards the same progress. When the key is used, our account server records that session: when it started and expires, and the internet address and type of browser or phone it came from. That is kept to keep accounts secure, and goes when the session expires (about 13 months after you last used it) or you delete the account.

We use the account to save your progress, to check, when you join a game, what you have unlocked, and to pay what you have bought or earned. Your settings (sound, graphics, language and so on) are saved on your device.

Signing in with Google, Apple or Discord

You can sign in, so your progress follows you to other devices. It is your choice, and you can play without it. Apple and Google sign-in are offered in the apps and on our website; Discord on our website. From the service we keep only which one you used and the ID number it gives us for you. We don't ask them for your email, name or picture, and if any of that is sent anyway we throw it away before saving anything. We don't keep the codes they give us to act for you, except Apple's, which we need so we can cancel your Apple sign-in when you delete your account.

Your guest progress comes with you. When you sign in on a device where you were playing as a guest, everything in that guest account (your games, Nuggets, unlocks, power-up upgrades and charges) is moved into your signed-in account, and the guest account is deleted. If you sign in on a new device, you get the progress your account already has.

The sign-in bonus. The first time you sign in with Google, Apple or Discord, you get 2,500 Nuggets. To make sure it is paid once for each account there, and not again if you erase your game and sign in again, we keep a scrambled, one-way version of your ID number. It cannot be turned back into your ID, or into you.

The sign-in log

To see whether sign-in works on different devices, and to fix it when it doesn't, our account server keeps a log of sign-ins. Each step of a sign-in adds a line: when it started, whether it worked or failed, which service you chose (Google, Apple or Discord), a rough device type (iPhone, iPad, Android or desktop, never the exact model), whether a guest account was moved in and how many games it held, whether the bonus was paid, and the random codes of the accounts involved. It holds no name, no email and no internet address. If you delete your account, the random codes are removed from the log lines and only the counts are left. We keep the log for as long as we need it to run and improve sign-in.

Bans

If an account breaks the rules in our terms of use, we may ban it. To do that we keep the account's random code, a short note of the reason, and the date. A banned account is refused when it tries to join a game, its games stop counting, and its names are taken off the leaderboards. A ban is on the account only, never on an internet address, because phone networks, schools and homes share one address between many people. We keep a ban for as long as it lasts.

What is saved on your device

The game saves small pieces of information on your own device, in your browser or in the app:

the key to your account;
your progress and settings: your last nickname, chosen skin and floor, best and total length, unlocked skins, sound, graphics, language and server choices;
on our website, your cookie choice, so we don't ask again;
the day you closed the offer to add the game to your home screen, so we don't ask again for a while;
names you have hidden, so they stay hidden;
which updates you have seen under the bell, and that you've closed the beta notice;
in the apps, whether you have seen our explanations before the notification and tracking questions, and when you said no, so we don't keep asking;
a note if your device needed lower graphics, and short-lived notes that stop the page reloading itself in a loop;
a short diagnostics log of the last things the page did (such as "tab hidden" or "graphics restored"), which helps us fix black screens if you choose to send it to us. It never leaves your device on its own.

These are needed for the game to work the way you expect, so we don't ask before saving them. The website also keeps a copy of its own files on your device (a "service worker") so the game opens on a poor connection. That holds no information about you.

What our game server handles while you play

While you play, your device sends our game server your nickname and skin, which way you are steering and whether you are boosting, your screen size and whether you are on a phone (so we send you the right part of the arena), and a pass that lasts ten minutes and says which account you are, so your game can be saved to it. When you leave, your worm is removed.

Your internet address. When you join a game, our game server notes your address and the time, so it can stop anyone joining too many times too fast. That is held in memory only, never written down, and forgotten within about 20 seconds. Our servers also keep technical logs for fixing problems; they are deleted automatically.

Analytics

On our website (squirm.io only) we use Google Analytics to count visitors and see which pages are used. It sets cookies, and Google receives the pages you visit, your device and browser type, and your rough location. In the UK, the EU and Switzerland, Google's consent message asks first: say no and it stores no cookies and sends only anonymous, cookieless counts. Google keeps this data for up to 14 months, under Google's privacy policy. It is not used on games websites.

In our apps we use no analytics service of our own: no Google Analytics, no Firebase Analytics, no crash-reporting service. The only counts we keep ourselves are on the server: how many notifications of each kind were opened (by the random code in each one), the sign-in log above, and the visit records described next. Google's advertising software in the apps (AdMob, see Adverts) collects its own usage and diagnostic data, as Google describes in its AdMob and Firebase documentation.

Where players come from. To understand who plays and where, our account server keeps a record of each visit: the random code of the account, when the visit started and ended, whether it was on a phone, a tablet or a computer, the system (such as iOS, Android or Windows), the language, the floor in use, whether it was on our website, in an app or on a games website, and an approximate region and city. The region and city are derived from your connection and we do not store your internet address for this. The lookup happens on our own server with a free database, IP geolocation by DB-IP, so your address is not sent to anyone for it. Deleting your account deletes its visit records.

Cloudflare and our servers

Our website is delivered through Cloudflare, which keeps websites fast and safe. Like any host, it sees your internet address when you load a page. When the game starts, it asks Cloudflare which country you are in so it can connect you to the nearest game server, and so it can show your country's flag beside your name if you leave your flag set to "Your country". You can pick a different flag, or no flag, in your profile. The flag you play under is shown to other players and kept with your runs on the leaderboard; apart from the approximate location in the visit records (see Analytics), your country is not saved anywhere else. Our game servers and accounts are hosted in the European Union (Finland).

Adverts

On our website, adverts come from Google AdSense. You see a full-screen advert now and then between games: never during a game, never after your first game of a visit, and at most one every few minutes. You also see video adverts that you choose to watch for a reward, such as a second life or extra Nuggets. There are no adverts over the arena while you play.

Google uses cookies and your device's identifiers to show adverts, to measure them and to stop fraud. In the UK, the EU and Switzerland, Google asks you first whether adverts may be personalised. If you say no, you still see adverts, but not based on your interests. You can change your choice at any time with (also at the bottom of every page), and manage Google's adverts at Google's Ad Settings. How Google uses information from websites that show its adverts is explained at policies.google.com/technologies/partner-sites.

In our apps, adverts come from Google AdMob, and there are two kinds:

Rewarded videos, only when you choose to watch one, for a reward such as a second life, extra Nuggets or another go on the reward wheel. The app asks our server for a single-use code, and AdMob uses it to tell our server that you finished the video, so the reward is paid once. For that, AdMob is given your random account code (not your name or anything about you), and our server is told which advert you watched.
Full-screen adverts between games, shown when you start another game: never after your first game of a visit, and at most one every three minutes. You can't choose these, but you never meet one during a game.

The ads in the apps are limited to content suitable for general audiences (Google's "parental guidance" setting). Google also uses your device's advertising identifier, and your approximate location worked out from your internet address, to show and measure adverts and to stop fraud.

Your choices. In the UK, the EU and Switzerland, and wherever else the law asks, Google's consent message (the "UMP") appears when you first open the app and asks about personalised adverts; you can change your answer later under Settings, Options, Privacy Choices. On iPhone and iPad, after your first finished game the app explains what tracking means and then the phone asks whether to allow it. We give nothing for saying yes, and the game and its adverts work either way; if you say no, the advertising identifier is not used. You can change it later under Settings, Privacy & Security, Tracking on your phone. On Android, you can reset or delete your advertising ID under Settings, Privacy (or Google), Ads.

On games websites, that website decides which ads appear, under its own privacy policy.

Notifications

The apps can send you notifications, such as "your daily gift is ready", news of an event, or a reminder to come back. Nothing is sent unless you allow it. After you collect your first daily gift, the app explains what it would send and only then asks the phone's own question; you can say no, and nothing is given for saying yes.

If you allow them, the notifications go through Firebase Cloud Messaging (Google), and Apple's notification service on iPhone. For this our server keeps, for each phone: the notification address Firebase gives the app (a long random code), whether it is an iPhone or an Android, your time zone, your language, the app version, which kinds of notification you have switched on, when the phone was registered and when the app was last opened. We keep a record of each notification we send (a random code, its kind and when it was sent), and the code comes back to us when you open it, so we can count how many of each kind are opened. We use your time zone so nothing arrives in the middle of the night. Some reminders (such as "your daily gift is ready") are scheduled by the app on your own phone and never go through our server.

To turn them off: use the switches under Settings, Options, Notifications in the app (one for each kind), or switch notifications off for Squirm.io in your phone's own settings. Deleting your account removes the phone's notification address and the record of what was sent. A notification address that Apple or Google reports as no longer working is deleted.

Buying in the apps

In the Squirm.io apps for iPhone, iPad and Android you can buy packs of Nuggets and the Starter Pack (2,000 Nuggets and an exclusive skin, bought once). The payment is made entirely by Apple (the App Store) or Google (Google Play), under their terms and privacy policies. We never see or keep your card, your bank details, your name or your email, and we cannot take a payment ourselves. Nothing on our website or on games websites costs real money.

To give you what you bought, the app sends our server proof of the purchase from the store: the store's own signed record (from Apple) or the purchase token (to Google, who confirm it to us). Our server checks it with the store, and then adds the Nuggets to your account once. For this we keep, for each purchase: the store, the store's transaction or order number, which pack it was, the date, whether it was a test, and which account it went to. To tie a purchase to your account and nobody else's, we give your account two random codes, one for each store, which the app hands to Apple or Google when you buy. They are not your name and contain nothing about you. The purchase also appears in your ledger.

Refunds. We can't refund a payment, because we never took it: ask Apple (at reportaproblem.apple.com) or Google Play (under your order history). If Apple or Google refunds a purchase, or takes it back, the store tells us, and we take the Nuggets back from your account, and the Starter Pack's skin. If you have already spent the Nuggets, your Nugget balance can go below zero, and you cannot spend Nuggets until it is back above zero. We do not take away anything else you have already bought, and we do not ban or mark your account for a refund.

Purchases are available to guest accounts too. If you delete your account, we remove the link between a purchase and your account, but keep the purchase record (store, transaction number, pack and date) so the same purchase cannot be paid out again and so that our accounts and refunds stay correct. Nuggets are a game currency, they have no cash value, and they cannot be turned back into money.

Contact form and emails

If you write to us through the contact form or by email, we keep what you send: your message, the topic you picked, and the name and email you chose to give (both optional). We also keep your internet address and browser type from the form, to stop abuse. It is used only to answer you and to deal with what you raised.

Playing on a games website

On games websites such as CrazyGames, that website runs its own tools and ads around the game, covered by its own privacy policy. There the game keeps an account for you and talks to our game server as described above, but does not offer Google, Apple or Discord sign-in, and nothing can be bought.

Children

Squirm.io is made for players aged 13 and over (see our terms), and it is built so that we need no personal information from anyone: no real name, no age and no photos, no chat between players, and no profiling by us. Adverts are personalised only where you agree (see Adverts). Parents and carers: you can delete your child's account at any time from the game's settings, or on our delete account page. If their nickname is on the Hall of Fame, or anything here worries you, email support@squirm.io with the nickname and roughly when it was used, and we will remove it. You don't need to prove anything.

In the UK and the EU, if you tell us you are under 16 (under 13 in the UK), we will delete your account and its records on request, and nothing about you is kept for advertising by us.

Why we are allowed to use this information

Running the game you asked to play, showing nicknames and the Hall of Fame, and saving your progress: our legitimate interests, and yours as a player.
Keeping the game and accounts safe and fair, such as the join-rate limit, session records, the sign-in log and bans: legitimate interests.
Visit records, to see who plays, on what and roughly where, and so to improve the game: our legitimate interest in running and improving it. They hold no name, no email and no internet address.
Buying in the apps: so we can deliver what you bought. Keeping the purchase record and checking it with the store: our legitimate interest in stopping a purchase being paid twice or after a refund, and our legal duty to keep correct accounts.
Paying the sign-in bonus once, and moving your guest progress into your account: it is what you ask for when you sign in, and our legitimate interest in stopping the bonus being paid twice.
Rewarded videos: so we can give you the reward you asked for, and our legitimate interest in stopping a reward being paid twice.
Notifications: your consent, given when you allow them on your phone, which you can take back at any time.
Personalised adverts, advertising identifiers and website analytics: your consent, which you can take back at any time. Adverts that are not personalised: our legitimate interest in funding a free game.
Answering your messages: legitimate interests.

Who we share information with

We don't sell it. Only the companies that help us run Squirm.io are involved: our hosting provider in Finland, Cloudflare for the website, Google for analytics if you say yes and for adverts (AdSense on squirm.io, AdMob in the apps), Google's Firebase Cloud Messaging and Apple's notification service for notifications, Apple and Google, who run the App Store and Google Play and tell us whether a purchase is real or was refunded, games websites when you choose to play there, Google, Apple or Discord if you choose to sign in with them. We may also share information if the law requires it. Google, Apple and Cloudflare are based in the United States and may handle information there, under the safeguards the law requires.

How long we keep things

Your internet address on our game server: about 20 seconds, in memory only.
What you send while playing: only while you play.
Your account and everything in it, including the ledger: until you delete it. We may delete accounts nobody has used for a long time.
Session records: until the session expires (about 13 months after you last used it) or the account is deleted.
One-time codes for rewarded videos: 15 minutes, or until you delete the account.
Your phone's notification address and the record of what was sent to it: until you delete the account, or the address stops working.
The sign-in log: as long as we need it, with the account codes removed if you delete your account.
Visit records (when you played, on what kind of device, and the approximate region and city): until you delete your account.
The scrambled sign-in ID used to pay the bonus once: as long as the bonus exists, so it cannot be claimed twice.
Purchase records (store, transaction number, pack, date): without any link to you once you delete your account. We keep them for as long as the law requires us to keep accounting records (six years in the UK) and to deal with refunds.
Bans: for as long as the ban lasts.
Hall of Fame entries: until a longer worm pushes them off, or you ask us to remove them.
Name reports: only as long as it takes to deal with them.
Google Analytics: up to 14 months.
Messages to support: up to 12 months after our last reply.
What is saved on your device: until you delete it, clear your browser or remove the app.

Deleting your account, and your rights

The quickest way to delete everything is Erase in the game's settings (Settings, then Account): it deletes your account on our server, with every game, Nugget and unlock in it, and then everything Squirm saved on your device. It can't be undone. If you no longer have the game, use our delete account page, which works on the web without the app, and says exactly what is deleted and what is kept.

You also have the right to ask what information we hold about you and get a copy, to have it corrected, to have it deleted, to ask us to stop or limit using it, to object to our use of it, and to take back your consent. Email support@squirm.io and we will reply within one month. A guest account has no name or email on it, so tell us your nickname and roughly when you played, and we'll do our best to find it.

Complaints

If you're unhappy with how we've used your information, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113, or, in the EU, to your country's data protection authority.

Changes to this policy

When we change how we use information, we update this page and the date at the top. If a change is important, we'll also say so in the game, under the bell.

Contact

Pranksters LTD, 20-22 Wenlock Road, London N1 7GU, United Kingdom. Email: support@squirm.io. See also our terms of use and how to delete your account.