Last updated: 26 Sep 2026 · This English version is a convenience translation. Only the German version is legally binding.
Marco Mori
Birkachstraße 3
88131 Lindau
Germany
Phone: +49 171 2931804
Email: hello@marcomori.net
VAT ID: DE402613336
Squish Club (by macomoroni) is a browser game at https://www.marcomori.net/play/. This policy applies to Squish Club and supplements the general marcomori.net privacy policy (https://www.marcomori.net/privacy-policy). For Squish Club, this policy takes precedence.
We have not appointed a data protection officer at present.
| Area | Data | Why | Legal basis |
|---|---|---|---|
| Playing without an account | random browser ID (beatme.clientId, localStorage), settings | the game works; purchases and settings stay on the device | Art. 6(1)(b), (f) GDPR; § 25(2) no. 2 TDDDG |
| Age confirmation | confirmation "at least 16" when buying and before every upload (part of the required checkbox) | enforce and evidence the minimum age | Art. 6(1)(c), (f) GDPR |
| Live stats | aggregate counters only, not linked to anyone | "Worldwide today X" | not applicable (no personal data) |
| Product analytics | PostHog events, no cookies, no recurring ID | understand what gets used | Art. 6(1)(f) GDPR |
| Purchases | email, product, Stripe reference, browser ID, time and text version of your consent to immediate delivery | perform the contract, unlock, keep records | Art. 6(1)(b), (c) GDPR |
| Account | email, user ID, Apple/Google identifier if used, linked browser IDs | keep purchases across devices | Art. 6(1)(b) GDPR |
| Custom head | photo (briefly, then deleted), the resulting 3D model and preview, upload log | build your 3D head; evidence that the rules were followed | own face: Art. 6(1)(a), (b), Art. 9(2)(a) GDPR; other people: section 9.3; log: Art. 6(1)(c), (f) GDPR |
| Sharing a head* | share token, a friend's device ID (random, local), a copy of the head in their head list | share the head with friends, enforce the 5-device limit | Art. 6(1)(a) (and, as a precaution, Art. 9(2)(a)) GDPR for you as owner; Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG for the device ID |
| Feature wish | text, optional email, browser ID, coarse country, device type | improve Squish Club | Art. 6(1)(f) GDPR |
| Reports, withdrawals, requests | whatever you send us | handle them; legal duties | Art. 6(1)(b), (c), (f) GDPR |
| Bot and abuse protection | Turnstile signals, IP address (briefly) | stop spam and attacks | Art. 6(1)(f) GDPR |
\* New since 26 Sep 2026, see section 9.8.
Squish Club runs on Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes the technically necessary connection data, such as IP address, time and requested URL, to deliver the site and protect it from attacks (firewall, per-IP rate limits). We don't routinely look at these logs. How long they are kept depends on Cloudflare's settings.
We have a data processing agreement (DPA) with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply as well.
Legal basis: Art. 6(1)(f) GDPR (secure, working operation).
You can play Squish Club without registering. On your first visit, your browser creates a random ID (beatme.clientId) and keeps it in localStorage (not a cookie). Our APIs use it to recognise purchases and head jobs that belong to this browser. We also store your settings locally (reduce motion, tips, pimples on/off). These settings never leave your device. If you sign in (section 8), your browser also stores the sign-in session.
This storage is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). You can delete it by clearing site data for marcomori.net. Purchases not linked to an account are then lost on this device (see section 8).
The "Worldwide today …" numbers are daily totals counted in a Cloudflare Durable Object. They are never linked to individual players.
We use PostHog Cloud EU (servers in Frankfurt). The provider is PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA. It is set up like this:
persistence: 'memory'). Every page load gets a new random session ID, so you are not recognised across visits;$pageview, tool_used, pop, record, share, paywall_view, checkout_start, purchase, wish_open, wish_sent;Because nothing is stored on or read from your device, we believe no consent is needed under § 25 TDDDG. PostHog processes the events as our service provider. PostHog participates in the EU-US Data Privacy Framework.
Legal basis: Art. 6(1)(f) GDPR.
Payments go through Stripe Checkout, a payment page run by Stripe. Depending on your device and country, Stripe offers methods such as card, Apple Pay, Google Pay, Link, Klarna or PayPal.
Legal basis: Art. 6(1)(b) GDPR (contract) and (c) (tax and commercial record-keeping; proof under § 356(6) and § 312f BGB).
You never need an account to play. With your first purchase we automatically create an account for the email Stripe gives us, so the purchase isn't lost. You can then sign in voluntarily ("Save purchase") to use your purchases on other devices:
Supabase stores your user ID, email, unlocks and linked browser IDs. There are no passwords. Supabase is our processor; the contracting party is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The database is in Frankfurt (eu-central-1). Any access from third countries (support, operations) is covered by standard contractual clauses (Art. 46(2)(c) GDPR).
Legal basis: Art. 6(1)(b) GDPR.
Whether face photos used to build a 3D head count as "biometric data" under Art. 4(14) and Art. 9 GDPR is not settled. We don't match faces or identify anyone, but the process does recreate physical features technically. So we treat your photo and head as if they were specially protected data and process them only with your explicit consent (Art. 9(2)(a) GDPR), which you give in a separate checkbox before uploading. You must be at least 16.
Withdrawal: you can withdraw consent at any time with effect for the future by emailing hello@marcomori.net or deleting your head in the app (bin icon). We then delete the head and preview. Processing up to that point stays lawful.
Under our Terms (§ 7), a photo may show: you, or an adult private person who has expressly agreed in advance. Minors, nudity, degradation, deception and a person shown without their consent are never allowed — without exception, public figures included. Whoever picks and uploads the photo is responsible for following these rules, is solely liable if they misstate who the photo shows, and is responsible for anything they do with the head outside Squish Club (e.g. sharing clips).
What data about the depicted person we process: only the photo (briefly), the resulting head and preview, and the photo checksum in the log (9.4). We don't collect names, contact details or anything else about the depicted person, and we don't identify them.
Our legal basis: that person's consent (Art. 6(1)(a) GDPR and, as a precaution, Art. 9(2)(a) GDPR). The uploader passes it on to us as a messenger and must prove it if we ask. We can't verify it ourselves. The depicted person can withdraw it towards us at any time (see below).
Informing the depicted person (Art. 14 GDPR): we usually don't know who is shown in a photo, and we don't want to find out. Informing them individually is therefore impossible, or would take disproportionate effort and extra data collection (Art. 14(5)(b), Art. 11 GDPR). Instead we inform the public through this policy. You can reach us without an account by email (see below).
Rights of the depicted person: if you appear on a head and don't want to, you can object (Art. 21 GDPR), withdraw a consent (Art. 7(3) GDPR) and request erasure (Art. 17 GDPR). You don't need an account: email hello@marcomori.net (subject "Report"). To help us find the head, send a job ID, a screenshot or the original photo: if it is the same file, we find the job through the checksum in the log. When in doubt we delete immediately, usually within 24 hours (also Art. 16 DSA). We keep the photo checksum as a block entry so the same photo isn't processed again.
For every upload we keep a record as evidence: time (server time), browser ID and account if any, device type (e.g. "iPhone, Safari"), a keyed hash of the IP address, purchase/credit reference, the selection of who the photo shows (you, or a private person who agreed; a head from before 26 Sep 2026 may still carry the since-removed "public figure" selection), the version of the texts you agreed to (rules, consent), job ID and a cryptographic checksum (SHA-256) of the photo.
We keep this log for 3 years from the end of the year of upload (standard limitation period, §§ 195, 199 BGB), or until any proceedings have ended.
Legal basis: Art. 6(1)(c) GDPR with Art. 7(1) GDPR (proof of consent) and Art. 6(1)(f) GDPR (defence against third-party claims, enforcing our Terms and blocks, protecting depicted persons).
We never use photos or heads to train AI models. OpenAI does not use API data for training by default. Tripo's terms exclude training for paying customers (Tripo Terms § 5.2.2), and we use Tripo as a paying customer.
Custom heads are made with AI. Custom heads and exported clips and screenshots with a custom head do not carry a visible AI label; instead they carry only a machine-readable marker in the file (e.g. a metadata tag in the video file, or asset.extras in the GLB). This fulfils our duty as a provider under Art. 50(2) EU AI Act.
The visible disclosure duty for deepfakes under Art. 50(4) EU AI Act falls on the deployer of an AI system who creates or distributes a clip. If you use the head factory purely privately and not as part of a professional activity, you are exempt from this duty under Art. 2(10) EU AI Act. If you publish a clip publicly (e.g. on TikTok or Instagram), please label it there yourself as AI-generated, to the extent the platform or the law requires this of you (Terms § 7(11)).
If sharing is available for your head: you can share a head made from a photo of yourself (section 9.2) with friends via a private link. Before we create the first link for a head, we ask for separate, one-time consent: friends can squish, slap and record short clips of your head; you can revoke the link at any time. This consent is separate from the consent under section 9.2 (Terms § 7a).
What data we process for this:
How long: the link is valid for 30 days and is automatically invalidated afterwards. A friend's copy is automatically deleted 7 days after opening. If you revoke your consent or delete the link, we invalidate it immediately, and we delete all copies already opened immediately and everywhere, even before the 7 days are up.
Legal basis: your consent as the head's owner (Art. 6(1)(a) and, because your face is involved, as a precaution Art. 9(2)(a) GDPR); for the friend's device ID and abuse protection (e.g. getting around the 5-device limit), our legitimate interest and the statutory requirement under § 25(2) no. 2 TDDDG (Art. 6(1)(f) GDPR).
Report form: if a shared head or a clip of it is reported via https://www.marcomori.net/play/report, we process the form's data (category, reason, an identifier such as job ID or screenshot, name, email, optionally an uploaded photo for comparison). The form is protected from bots by Cloudflare Turnstile (section 12). Every report triggers a Telegram message to us (category and short description, without the IP address and without the reporting person's email), so we can react quickly. Report data is kept as described in section 13. Any uploaded comparison photo is used only to match against the log (section 9.4) and then deleted.
The friend as their own user: the friend uses Squish Club and the shared head with their own purchased tools; your purchased content does not transfer to them. This Privacy Policy applies to the friend like to any other user.
With "Wish a feature" you can send us a short text (max. 500 characters) and, optionally, your email. Supabase stores: text, email (if given), browser ID, coarse country (from the Cloudflare connection, e.g. "DE") and device type. Cloudflare Turnstile protects the form from bots.
Each wish also sends us a Telegram message (text, country, device type) so we see it quickly. We don't send your email address to Telegram. Telegram (Telegram Messenger Inc.) is an independent controller for this. Telegram says it stores data of EEA users in data centres in the Netherlands.
We delete wishes once handled, at the latest after 2 years, or earlier if you ask.
Legal basis: Art. 6(1)(f) GDPR.
Short clips are created on your device and shared through your operating system's share menu. We don't upload them. If a clip contains a custom head, it carries a machine-readable AI marker in the file (section 9.7), and you are responsible for sharing it (Terms § 7(4) and (11)).
We protect forms and payment endpoints with Cloudflare Turnstile and per-IP or per-browser-ID limits. If a limit is hit, we get a Telegram alert without the IP address. The IP address then only appears in the server logs at Cloudflare (section 3). More on Turnstile: https://www.cloudflare.com/privacypolicy/.
Legal basis: Art. 6(1)(f) GDPR.
If you report illegal content (Art. 16 DSA), withdraw from a contract using the withdrawal function (§ 356a BGB) or contact us in another way, we process what you send so we can handle it and confirm receipt. We keep it for 3 years from the end of the year in which the matter was closed. Tax-relevant records are kept as long as the law requires.
Legal basis: Art. 6(1)(b), (c), (f) GDPR.
| Service | Purpose | Seat / data location | Transfer basis |
|---|---|---|---|
| Cloudflare, Inc. | hosting, CDN, Turnstile, live stats, tunnel to the factory server | USA; global edge | DPA; DPF + SCCs |
| Supabase Pte. Ltd. | database, sign-in | Singapore; data in Frankfurt | DPA; SCCs |
| Stripe Payments Europe, Ltd. | payments, tax calculation (Stripe Tax) | Ireland; group USA | DPA; DPF + SCCs; partly independent controller |
| Plus Five Five, Inc. (Resend) | emails (sign-in link, order confirmation, withdrawal receipt) | USA | DPA; DPF + SCCs |
| PostHog, Inc. | product analytics | USA; data in Frankfurt | service provider; DPF |
| Hetzner Online GmbH | factory server (head factory) | Germany; data centre Helsinki, Finland | processing on our behalf; no third-country transfer |
| OpenAI Ireland Ltd. | photo normalisation | Ireland; group USA | DPA; SCCs |
| Holymolly Ltd (Tripo) | 3D model | Hong Kong | no adequacy decision; SCCs, see section 9.6 |
| Telegram Messenger Inc. | internal notifications | stored in the Netherlands | independent controller |
| Apple / Google | sign-in, Apple Pay / Google Pay | Ireland; group USA | independent controllers |
Coinbase Commerce (crypto payment) and NFT unlocks are not live yet. We will update this policy before they launch.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3)). Email hello@marcomori.net.
You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.
Squish Club is 16+. It contains exaggerated, cartoon-style violence against a rubber head (slapping, popping pimples). When buying and before every upload you confirm that you are at least 16. The head factory and the consent in section 9 are only available from age 16. Purchases by minors are covered in the Terms (§ 3). If someone under 16 has given us data, a parent can ask us to delete it: hello@marcomori.net.
We update this policy when Squish Club or the law changes. The current version is at https://www.marcomori.net/play/legal/privacy?lang=en.
Marco Mori, Birkachstraße 3, 88131 Lindau, Germany · hello@marcomori.net · +49 171 2931804