Privacy policy
Who we are
Spelling Game is operated for users of spelling.live (the “service”). This policy explains how personal information is handled when you use the website or an app that loads this service.
Who this applies to
The service is intended for use with a parent or guardian involved in account setup and supervision. Child profiles and learning activity should be managed by an adult where possible.
UK GDPR & data protection compliance
We are based in the UK and build the service to comply with the UK GDPR and the Data Protection Act 2018, and we follow the principles of the ICO’s Age Appropriate Design Code (the “Children’s Code”). In practice this means:
- Data minimisation by design: children do not create their own accounts; we collect only what is needed to run practice and show progress. Handwriting photos and voice recordings are processed in the moment and discarded, not stored.
- Lawful bases: we rely on the bases set out in “Legal bases” below - contract, legitimate interests, and consent for optional features.
- Your data-subject rights: access, rectification, erasure, portability, and objection - all available self-service from within the app (see “Your rights and account deletion” below), or by emailing us.
- No AI training on your data: inputs sent to AI providers are not used to train their models, and we maintain data processing agreements with each provider - see our AI providers & your data page.
- Accountability documentation: we maintain a Data Protection Impact Assessment (DPIA), a Children’s Code self-assessment, and a Record of Processing Activities (ROPA) with a breach-response plan. These are available to parents, schools, or regulators on request at support@spelling.live.
- International transfers & retention: handled with appropriate safeguards and automatic retention limits - see “International transfers” and “Retention” below.
Data protection questions or rights requests: support@spelling.live.
Information we collect
- Parent sign-in (optional): If you sign in, authentication is provided by Supabase. We may process your email address, account identifiers, and sign-in provider metadata (e.g. if you use Google). That provider’s privacy policy also applies.
- Child profiles: Names or labels you enter for learners, learning level (Early or Fluent), and related settings may be stored on your device and, if you are signed in, synced to our database.
- Learning activity: Practice data such as words attempted, correct/incorrect counts, hint usage, and misspelling notes may be stored locally and/or synced when you use a signed-in account.
- Voice input (optional): If you use speech features, audio may be sent to our servers and then to a speech recognition service to produce text.
- AI-assisted features (optional): When you use AI-assisted features, text or images may be sent to one or more third-party AI providers to generate responses. Voice input may be sent to a third-party speech recognition service. We currently use OpenAI, Google and Anthropic for these features, and PostHog (EU Cloud) for product analytics, feature flags and session replay; the up-to-date list and what each receives is on our AI transparency page. If we change providers we will update this accordingly. Each provider processes data under their own privacy policy. We maintain data processing agreements with our AI providers. Your inputs are not used to train AI models. We review our AI providers’ terms on a recurring schedule and publish the list, what each receives, and our findings on our AI providers & your data page.
- Session replay (to improve the app): We record anonymised replays of how the app is used so we can see where parents get stuck or drop off and make setup easier. These replays are masked by default — every on-screen word and everything typed is hidden before it leaves the device, so a child’s name, the words being practised, passwords and handwriting are never captured. Only our own parent-facing setup screens (such as the sign-in and “add a child” screens) are shown unmasked, and none of those contain a child’s name or practice words. For a signed-in parent or tutor account we also record the account’s own email address so we can tell genuine parents apart from our internal test accounts; this is never done for a child’s login. Analytics and replay are handled by PostHog on their EU servers.
- Technical data: Hosting and infrastructure providers (e.g. Vercel) may collect IP address, device/browser type, and server logs for security, debugging, and reliability.
How we use information
We use this information to provide and secure the service (authentication, syncing progress, generating educational content), troubleshoot issues, and comply with law. We do not sell your personal information.
Legal bases (where applicable)
If you are in the UK, EEA, or similar regions, we rely on contract (to run the service you asked for), legitimate interests (security, product improvement that does not override your rights), and, where required, consent (e.g. optional features you turn on).
Storage, security, and third parties
Data is processed using services such as Vercel (hosting), Supabase (authentication and database), and vendors used for speech recognition and AI. Each processes data under its own terms and privacy policy. We use measures appropriate to the service; no system is perfectly secure.
We also use AI-assisted developer tools (such as Cursor) to help build and maintain our software. These tools are used only on our source code - they do not receive your or your children’s personal data.
Children’s privacy
The Service is designed for use by parents and guardians on behalf of children. We do not permit children to register for accounts independently. All accounts must be created and managed by a parent or guardian aged 18 or over. We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. Where a parent creates a child profile, the parent is responsible for supervising use of the Service and consenting to any data processing on the child's behalf. If you believe a child has provided personal information without appropriate parental consent, contact us at support@spelling.live and we will delete it promptly.
Your rights and account deletion
Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to certain processing.
You can exercise these rights yourself from within the app. Signed in as a parent, the account panel offers Download my data (a complete export of the data we hold for you and your children) and Delete account (an immediate, permanent erasure of your account and all associated data, including linked child profile data). Live data is removed immediately; residual copies in encrypted backups roll off within 30 days. If you need help, email support@spelling.live from your registered address.
Mobile app permissions
- Microphone (optional): used for speech spelling input.
- Camera / photos (optional): used when capturing or uploading written work or word-list images.
- If you deny permissions, other app features continue to work where possible.
Retention
We retain information only as long as needed to run the service, meet legal obligations, and resolve disputes, and we automatically remove old operational data on a schedule. As a guide: AI usage logs are kept for up to 14 months, email logs and support feedback for up to 12 months, and shareable game sessions for up to 90 days. Full-size handwriting photos and voice recordings are not stored - they are processed and discarded. Where the handwriting/formation report is enabled, a small thumbnail of your child's writing is kept for that report; it is included in your data export and removed when you delete the item or your account. Feedback screenshots are stored privately and are not publicly accessible. Synced data is removed when you delete your account, subject to backup roll-off and legal retention needs.
International transfers
Our service providers may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses).
Changes
We may update this policy. We will adjust the “Last updated” date and, for material changes, may provide additional notice (e.g. on the site or in the app).
Contact
Privacy and data requests: support@spelling.live
General help: see Support.