Last updated 17 August 2026
Wormix.io is a browser game. It has no advertising, no trackers, no analytics scripts from anybody else, and no cookies. It does not sell or share personal information, and there is nothing here to sell — the game is deliberately built so that most of what it knows about you never leaves your own device.
This page describes what is stored, where, and for how long. Everything below is visible in the game's source code.
Nothing about you is sent to the server. Your coins, unlocked items, equipped kit, chosen nickname and best score are written to your browser's local storage and stay there:
wormix.save.v1 — your progresswormix.save.local.v1 — a copy of that progress, kept only while you are signed in so it can be handed back when you sign outClearing your browser data deletes them, and they are gone. Nobody else can read them, including us.
Playing a multiplayer game does send your chosen nickname and your worm's position to the server for as long as you are in an arena, because otherwise other players could not see you. Solo play never contacts the server at all.
An account exists so your progress follows you to another device. It holds:
| What | Why |
|---|---|
| Your nickname | It is your name in the arena and how you sign in. |
| A scrypt hash of your password, and a random salt | So the password can be checked without being stored. The password itself is never written down anywhere. |
| An email address, optional | Only ever used to send a password reset link. There is no newsletter and no marketing. Leave it blank and the account works exactly the same — you simply cannot recover it if you forget the password. |
| Your progress | Coins, diamonds, unlocked items, equipped kit, perk charges, best score. |
| Purchase receipts | The payment provider's own reference, the pack bought and when. Kept so a repeated confirmation cannot credit you twice, and so a refund can be traced. |
| Sign-in tokens | A random string that keeps you signed in for 30 days. Password reset links last 30 minutes and work once. |
Records are stored on our own server. They are not shared with anyone.
You can do it yourself, without asking us. Open Account from the menu, scroll to the bottom, and choose Delete my account. It takes a password to confirm and happens immediately — the record, your progress, your purchase history and every sign-in session are erased.
Deletion is permanent, cannot be reversed, and diamonds you have paid for are not refunded. If you cannot sign in, email the address at the bottom of this page. Full details are on Delete your account.
Diamonds can be bought with real money. We never see or handle your card details. Payment is taken entirely by the payment provider, on their own pages, under their own privacy policy.
Card payments are handled by Stripe. You are sent to Stripe's own checkout page. We tell Stripe which pack you chose, its price, and your account name so the diamonds can be credited to the right place. Stripe tells us that a payment succeeded and which pack it was for. Card numbers never reach this site.
Purchases go through Google Play billing. Google takes the payment and gives the app a purchase receipt, which our server checks with Google before crediting anything. We receive no payment details.
The server keeps its own counts so we can tell whether anyone is playing. There is no third-party analytics, no cookie, and no profile of you.
To count a visitor only once a day without knowing who they are, the server takes your IP address and browser user-agent, mixes them with a random secret, and keeps only a short fragment of the resulting hash. That secret is thrown away and replaced every midnight, so two days of numbers cannot be lined up to follow one person across them. The IP address itself is never written to disk.
That deliberately costs us the ability to know how many people came back — we would rather not be able to.
Also counted, none of it tied to a person: page views, games joined, deaths,
scores, how many players were on at once, session lengths, bytes sent, and
errors. If you arrived from a link somewhere else, only the host of
that site is recorded (for example reddit.com) — never the full
address, which could carry a search term or a session id.
These daily counts are kept for 90 days and then deleted.
| Who | What they receive |
|---|---|
| Google Fonts | The page loads two typefaces from Google's font service, which means your IP address and browser details reach Google when the page opens. This is the only third party involved in simply viewing the site. |
| Stripe | Only if you buy diamonds on the website: your payment details, which you give to them directly. |
| Google Play | Only if you buy diamonds in the Android app. |
There is nobody else. No advertising networks, no social media pixels, no session recording, no data brokers.
This game is designed to be suitable for a general audience. We do not knowingly collect personal information from children, and we do not profile any player or show behavioural advertising to anyone.
An account needs nothing but a name and a password — no age, no real name, no address. If you are a parent or guardian and believe a child has given us an email address you would like removed, contact us and it will be deleted.
If you are in the UK, EU, or another place with similar law, these are your rights of access, rectification and erasure. You do not need to cite the law to use them; just ask.
Passwords are hashed with scrypt and a per-account random salt, and compared in a way that does not leak information through timing. The site is served over HTTPS. Sign-in attempts are rate limited per address and per account.
No system is perfect. If you find a security problem, please tell us before telling anyone else.
If this policy changes in a way that affects what is collected, the date at the top changes and the new version appears here. Continuing to play after that means the new version applies.
Email privacy@wormixio.com.
To delete your account, see Delete your account.