Privacy policy

Last updated 11 September 2026

Who we are

SpellSense runs SpellSense at https://spellsense.app. We are responsible for the personal data described here. Contact us about anything in this policy at[email protected].

What we collect

If you use SpellSense without an account, your progress is saved in your own browser and never sent to us.

If you create an account, we store:

• your name, email address and username;
• your password, stored only as a one-way hash that nobody — including us — can turn back into the password;
• if you sign in with Google instead: the name, email address, profile picture link and account ID Google shares with us;
• your practice: which words you have practised, when, how often you got them right, and when each is next due;
• who you have added as a friend and the friend requests you have sent or received;
• for each device you are signed in on: a session record with its IP address and a description of the browser, so you can sign out of other devices and so we can spot misuse.

What we do not do

• We do not sell or rent your data.
• We do not show advertising or use advertising or analytics trackers.
• We do not use your data to build profiles or make automated decisions about you.

Why we use it

• To provide the service you asked for — keeping you signed in, saving and scheduling your practice, and running friends and leaderboards. (Legal basis: performance of our agreement with you.)
• To keep SpellSense secure — protecting accounts and preventing abuse. (Legal basis: our legitimate interest in a safe service.)
• To email you when you ask us to, such as a password reset link. We do not send marketing email.

What your friends can see

Only people whose friend request you have accepted, or who accepted yours, can see you on a leaderboard. They see your username, how many words you practised today and how many words you have mastered. They never see your name, email address or which words you practise. Anyone who knows your exact username can send you a friend request; nothing happens unless you accept it.

Who else handles your data

We use a small number of service providers, who may only use data to provide their service to us:

• Our hosting provider, which runs the server and database.
• Cloudflare, which stores the pronunciation recordings. Your browser downloads them straight from Cloudflare, which therefore sees your IP address.
• Google Fonts, which supplies the Lexend typeface. Your browser loads it from Google, which therefore sees your IP address.
• Google, only if you choose to sign in with Google.
• Resend, which delivers the emails we send, such as password resets.

Some of these providers may process data outside your country. Where that happens, they do so under safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Account and practice data: until you delete your account.
• Sign-in sessions: they expire after 30 days of not being used.
• Password reset links: they expire after one hour.

Deleting your account removes your account, practice history and friendships from our database immediately. Any copy in a backup is removed when that backup is replaced.

Your rights

Depending on where you live, you have the right to:

• get a copy of your data — use “Download my data” on youraccount page;
• correct it — change your name or username on your account page;
• delete it — use “Delete this account” on your account page;
• object to or ask us to limit how we use it;
• complain to your data protection authority.

For anything you cannot do yourself, email [email protected]. We reply within 30 days.

Children

SpellSense is built for learners of any age, including children. Anyone under13 needs permission from a parent or guardian to create an account; without an account, nothing is sent to us at all. There are no public profiles and no messaging — friends can only be added by exact username, and only see the counts described above. A parent or guardian can ask to see or delete their child's data by emailing [email protected]. If we learn that we hold an account for a child under 13 without that permission, we will delete it.

Security

Connections to SpellSense are encrypted, passwords are stored only as hashes, and our database is not reachable from the public internet. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.

Cookies

We use only the cookies needed to keep you signed in. See thecookie policy for the full list.

Changes to this policy

If we change this policy we will update the date at the top, and if the change is significant we will say so on the site before it takes effect.