Privacy Policy

Spellcast is a spelling practice application for UK primary school children, operated by Made Good Software Ltd (company number 17455593, registered office Sunny Nook, Barhatch Road, Cranleigh, Surrey GU6 7DJ) ("we", "us", "our"). Spellcast is accessible at spellcast.academy.

We are the data controller for parent and family accounts, for the account, billing and marketing contact details of school staff, and for leaver records that a parent claims into a family account. For pupil accounts created by a school, the school is the data controller and we are its data processor (see section 4). Made Good Software Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC262206. For any data protection queries, contact us at: support@spellcast.academy

Parent / Guardian Accounts

• Email address — used to identify your account and send service communications
• Name — used to personalise your experience
• Password — stored as a one-way bcrypt hash; we cannot read it
• Subscription and billing data — subscription status and billing is handled by Stripe; we store only a Stripe customer reference ID

Child Accounts

• Display name and username — used to identify the child within your family account
• Year group — used to select age-appropriate word lists
• Character preferences — hero style, hair colour, cloak colour, skin tone, companion — used for in-app personalisation only
• Spelling session data — words attempted, correct/incorrect answers, scores, timestamps — used to power adaptive learning and progress reports

Photographs of Spelling Lists

• The photo you choose — when you use "Photo of a list" to add a week's spellings, the image is sent to our server so the words can be read from it, and the words are then shown to you to check before anything is saved.
• Your device shrinks the photo before sending it, so what leaves your phone is a smaller copy, not the full-resolution original.
• We do not show these images to anyone else, and we do not use them to identify you or your child.
• The reading is done by software running on our own servers.

Technical Data

• We do not use cookies for tracking or advertising
• We process the IP address of visitors to our marketing site to derive a daily-rotating session hash — this lets us count unique visitors and group their page views without identifying anyone. We do not store raw IP addresses for this; only the hash. Hashes rotate every 24 hours and cannot be reversed.
• We do store an IP address in one case: when a teacher or school administrator accepts our terms or data processing agreement in the app (at sign-up, or when an administrator accepts the agreement for their school). We record their IP address and browser with the acceptance, as evidence that it was accepted.
• Session authentication uses a JWT token stored in your browser's local storage

We use a small amount of anonymous data to understand how people find and use SpellCast before they sign up, so we can make it better. We do not use cookies. We do not share this data with anyone.

What we record

• Which pages people visit, and in what order
• Where they came from (the referring website and any UTM tags on the link)
• Whether they clicked a sign-up or get-started button — and which one (not who clicked it)
• Clicks on links that take you to other websites — we record only the destination domain (e.g. "bbc.co.uk"), not your identity
• How far down a page you scrolled (50% and 100% milestones only)
• Roughly how long you spent on a page
• Whether you moved to leave the page quickly ("exit intent")
• The type of device, a session hash, and the browser's user agent
• Approximate country and city, worked out on our own server from a lookup database held there. No third party is involved and we do not keep the IP address

All of the above is anonymous. We do not know your name, email address, or any other identifying detail from this data.

What we do not do

• No cookies — none, for any purpose
• No tracking pixels or third-party scripts — no Google Analytics, no Facebook Pixel, no Hotjar, no Plausible, nothing of that kind
• No selling of data to anyone, ever
• No advertising — we do not show ads, and we do not help others target ads at you
• No marketing analytics once you sign in — this analytics only runs on the public marketing pages, before you log in. Authenticated app pages (lessons, progress, class management) do not fire any of these events. The in-app product events a spelling game records are separate and are described in §2c. Public pages that need no sign-in, such as the school login page, record an anonymous pageview like any other page, including when a pupil opens them.

Lawful basis

We rely on legitimate interests under Article 6(1)(f) of UK GDPR. Our interest is understanding how our marketing site performs so we can improve it. This falls within the ICO's recognised analytics exception: the data is anonymous, used for statistical purposes only, and never shared with third parties. It does not result in any profiling or decision-making about individuals.

How long we keep it

Marketing-site analytics data is deleted automatically after 13 months.

How to opt out

Most browsers include privacy settings that let you block or limit site analytics — feel free to use them. You can also email support@spellcast.academy and we will disable tracking for your visits.

When you use the SpellCast app, our server keeps a short-lived log of each API request. We use this purely for performance monitoring — finding slow or failing endpoints so we can fix them quickly.

What we record

• Which endpoint was called — the route pattern only (e.g. /api/sessions/start), never the actual data IDs in the path
• HTTP method and response status code
• How long the server took to respond (in milliseconds)
• A randomly generated request ID (UUID) — used to correlate entries, not to track you
• For signed-in users: your internal account ID and account type (parent, child, teacher, admin)
• A daily-rotating hash of your IP address — the same approach described in §2 above; no raw IP is stored

What we do NOT record

• The contents of any request or response body — your spelling answers, messages, or any other payload
• The pages your browser visits (that is §2b territory — marketing-site only)
• Your name, email address, or any other identifying detail beyond your account ID

This request log is stored in a separate analytics database. The request log itself has no link to your main account record. Only SpellCast admins can query it.

Retention

Request log entries are deleted automatically after 7 days.

Lawful basis

Legitimate interests under Article 6(1)(f) of UK GDPR. Monitoring the performance and reliability of the service is necessary to keep it working correctly for all users, and does not override your rights or interests.

In-app product events

When a child plays a spelling game, the app also records a few simple events so we can see where children get stuck and fix it.

• Which game screen was opened
• When a round was started, finished or left
• When a word is shown on screen, and the position of that word in the round (for example, the third word)
• Taps on the button that plays a word's audio again
• How long it took to type the first letter
• Whether each answer was right or wrong
• Visits to the home screen, and which game was tapped there
• Audio playback problems, such as a word clip failing to play or a child reporting that they cannot hear it
• The type of device (web, iOS or Android)

These events are recorded against the child's internal account ID. They never include the spelling words or the answers typed. They are stored in the same separate analytics database as the request log, are deleted automatically after 90 days, and are used only to find where children get stuck. Lawful basis: legitimate interests under Article 6(1)(f) of UK GDPR, the same as the request log above.

The SpellCast apps for iOS and Android show the same service as spellcast.academy, so everything in this policy applies to them in the same way.

• The apps do not use an advertising ID, and they contain no third-party advertising or analytics software.
• Daily practice reminders are local notifications set on your device. They are scheduled on the device itself and need no push-notification service.
• To delete your account, see how to delete your account.

We never sell your data or share it with third parties for their own marketing purposes. The only advertising use is measuring our own adverts, described under Meta in section 6. It never involves pupil data.

Home accounts (parent-managed)

Spellcast home accounts are designed for use by children under parental supervision. Child accounts can only be created by a parent or guardian who holds the parent account.

We do not knowingly collect data directly from children. All account creation and data management for children is performed by the parent or guardian. The child account contains only the minimum data necessary to deliver the spelling practice service.

Home child accounts contain no email address and no contact information. The username chosen by the parent need not reflect the child's real name.

School accounts (teacher-managed)

Where Spellcast is used in a school context, pupil accounts are created and managed by the school (the Data Controller). We act as a Data Processor on the school's behalf under a signed Data Processing Agreement. Pupil data collected includes: first name, surname, username, year group, class, and spelling session history.

School pupils do not have email addresses within Spellcast. Password management is handled entirely by the teacher.

When a school connects its MIS through Wonde, pupil names, year groups and forms are imported with the school's approval, and removed pupils are erased after a grace period.

Free class accounts (anonymous nicknames). Where a teacher signs a class up via our free self-serve flow, we deliberately collect even less. The teacher tells us only how many pupils they have, and we generate anonymous accounts identified solely by a nickname (such as "Brave Owl") plus a username and password. No real name, surname, or class roster is uploaded or stored. The link between a nickname and a real child is held by the teacher, on paper, in school — it never reaches Spellcast.

Children's Code compliance

We comply with the UK GDPR, the ICO's Age Appropriate Design Code (Children's Code), and applicable guidance on processing children's personal data. Specifically:

• We do not use children's data for profiling or targeted advertising
• We do not share children's data with third parties for their own purposes
• Privacy settings are set to high by default. There is no pupil-facing leaderboard and nothing is shown across schools. Teachers can display a class board of weekly points. On paid school plans any teacher can also display year-group and whole-school boards. These show class totals and the first names and weekly points of the top 3 pupils in each year group. Free-class pupils appear by nickname.
• We do not use nudge techniques or dark patterns to encourage children to share more data
• Geolocation data is not collected from child accounts
• There is no child-to-child messaging or communication of any kind

• Active home accounts: Data is retained for as long as your account is active.
• Deleted child accounts (home): All data including session history and attempts is permanently deleted immediately upon removal.
• Closed parent accounts: Account data and all associated child data is deleted within 30 days of account closure.
• School pupil accounts: When a teacher or school admin deletes a pupil, the pupil's account and history are permanently erased straight away. Encrypted backups roll off within 30 days. After a school subscription ends we keep the data for 12 months so the school can restart, then delete it. The school can ask in writing for earlier deletion.
• Teacher/admin accounts: Retained until removed by the school admin or the school subscription ends.
• Billing records: Stripe retains billing records per their own retention policy for legal and tax compliance. We retain subscription status records for 7 years as required by UK financial regulations.
• Infrastructure server logs: 30 days (web server access logs).
• API request performance log: 7 days (see §2c).
• In-app product events: 90 days (see §2c).
• Error reports: 90 days. They are linked to the account (account id and type) and include the page address, browser user agent and error details.

Google Text-to-Speech

We use Google's text-to-speech service to pronounce spelling words aloud. Only the word text itself (e.g. "elephant") is sent. No personal data, usernames, or identifiers are transmitted to Google, and the text is never linked to a pupil. Google's privacy policy applies: policies.google.com/privacy (opens in a new tab)

Brevo (email delivery)

We use Brevo (formerly Sendinblue), based in France, to send emails such as account verification, password resets, teacher welcome emails and teacher progress summaries. Brevo receives the recipient's name and email address. Teacher progress-summary emails can include pupil first names, and emails to parents can name their own children. Children have no email addresses in Spellcast. Every such email has an unsubscribe link. Brevo's privacy policy: brevo.com/legal/privacypolicy (opens in a new tab)

ElevenLabs and Anthropic (United States)

ElevenLabs also turns spelling words into speech, and Anthropic writes example sentences for words. Both receive only spelling-word text, never linked to a pupil.

Meta (advertising measurement)

When a parent signs up, or a teacher registers through the free class sign-up, and our Meta credentials are set, our server sends Meta a one-way hash of the email address and name, the IP address, the browser user agent and any Facebook click id. We use this only to measure our own advertising. There is no Meta pixel on our site and no cookies. It never involves pupil data.

Stripe (family subscriptions)

Family subscription payments are processed by Stripe, Inc. Schools do not pay through Stripe; they pay by invoice. When you subscribe, you are directed to Stripe's hosted checkout. We receive only a customer reference ID and subscription status — no card details are stored on our servers. Stripe's privacy policy: stripe.com/gb/privacy (opens in a new tab)

IONOS (hosting)

Spellcast is hosted on an IONOS VPS in the United Kingdom. All data remains in the UK. IONOS privacy policy: ionos.co.uk/terms-gtc/privacy-policy (opens in a new tab)

OVHcloud (encrypted backups)

Encrypted backups of the Spellcast database are streamed continuously to OVHcloud object storage in London, United Kingdom, and retained for 30 days. OVHcloud is a European (French-headquartered) provider, and backup data does not leave the UK. Backups are encrypted at rest. OVHcloud's data protection information: ovhcloud.com/en-gb/personal-data-protection (opens in a new tab)

Cloudflare R2 (audio and resource files)

The pronunciation audio for spelling words and our free downloadable resource PDFs are stored on and served from Cloudflare R2, a file storage and delivery service. Only spelling-word text and audio are stored there, never linked to a pupil. These files contain no personal data, only spoken spelling words and public documents. As with any web request, Cloudflare receives standard connection information (such as your IP address) when your browser fetches a file. Cloudflare's privacy policy: cloudflare.com/privacypolicy (opens in a new tab)

As a data subject, you have the following rights. To exercise any of them, email support@spellcast.academy:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure ("right to be forgotten") — ask us to delete your data. Parents can delete their account from the Account section of the dashboard; every other request is by email. See how to delete your account.
• Right to restriction — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format. Parent accounts can export data directly from account settings. A school admin can download a full JSON export from Manage school, Data export, and teachers can download a class progress summary CSV from the class dashboard.
• Right to object — object to processing based on legitimate interests

We will respond to all requests within 30 days.

For school pupils: Rights are typically exercised through the school (as Data Controller) or by a parent or guardian contacting the school.

Automated decision-making: Spellcast does not make any automated decisions that produce legal or similarly significant effects. Adaptive word difficulty adjusts which spelling words are shown — this is a product feature with no consequences beyond the practice session.

Right to complain: If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) — the UK's data protection regulator. You can contact the ICO at ico.org.uk/make-a-complaint (opens in a new tab) or by calling 0303 123 1113. We would appreciate the opportunity to address any concern before you contact the ICO.

We take appropriate technical and organisational measures to protect your data:

• Staff and parent passwords are hashed using bcrypt (cost factor 10) and cannot be recovered. Pupil passwords are short generated passwords. They are stored hashed and also in a form teachers can view and reprint on login cards, and SpellCast's platform admin can see them too
• All data in transit is encrypted via TLS (HTTPS)
• Authentication tokens expire after 90 days for parents and 30 days for children
• Database access is restricted to the application server only

No method of transmission over the internet is 100% secure. In the event of a data breach affecting your account, we will notify affected users without undue delay.

We may update this privacy policy from time to time. We will notify you of significant changes by email (for parent accounts) and by posting a notice in the application. The "last updated" date at the top of this page will always reflect the most recent version.

For any privacy-related queries, requests, or complaints:

Email: support@spellcast.academy

Website: spellcast.academy