Service: Spelly (the “Service”), available at https://spelly.net
Operated by: Importify Limited (“we”, “us”, “our”)
Registered address: Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong
Privacy contact: support@spelly.net
1. Overview
This Privacy Policy explains what information Spelly collects, how we use it, who we share it with, and the choices and rights you have. It applies to the Spelly website, the web and mobile applications, and the Spelly browser extension (see section 9). By using Spelly, you agree to this Policy. If you do not agree, please do not use the Service.
2. Information We Collect
a) Information from Google Sign-In, Sign in with Apple, or email sign-up
An account is created on the device where Spelly is used, by a parent, guardian, teacher or the child, using Google Sign-In (Google OAuth), Sign in with Apple (iOS app only), or an email address and password. When you choose to sign in with Google, we receive from your Google account:
- Your name
- Your email address
- Your Google profile picture (if available)
- A unique Google account identifier
We do not receive or store your Google password.
With Sign in with Apple we receive your name (if you choose to share it), your email address or Apple's private relay address, and an Apple account identifier. With email sign-up we hold your email address and a hashed password.
b) Profile and learning information you provide
- A first name or nickname for the child, if one is entered (it is optional), and, in the classic version of Spelly, an age
- For teachers using Track my class: the student first names you type into a class roster, and each student's results on that shared list
- Practice language, definition language, and difficulty level
- Word lists you create, scan, or generate, and lists you save
- Words you add to your filter list and your app settings
c) Usage and progress data
- Learning progress such as XP, levels, coins, streaks, achievements, and quest progress
- Practice results (e.g., number of words attempted and answered correctly)
- We keep the wrong spellings children type, combined across many children and never linked to any child, to make practice better (for example, to show the mistakes children make most often).
- We keep which words a child has missed and the kind of mistake (for example, a double letter) with their progress, so Spelly can notice when they get it right later and build their Words to practice list. We do not keep the wrong spelling itself with the child's account.
d) Content you submit for AI features
- Topics or words you type to generate or define words
- Images you upload (e.g., a photo of a spelling worksheet) so we can extract the words from them. The photo is sent to our AI provider for reading and is not stored by Spelly once the words have been extracted — only the words are kept, in your list.
- On spelly.net, before you have an account, the Try Spelly box can read one worksheet photo a day. The photo is sent to our AI provider (OpenAI) to find the words, which are shown to you and are not stored unless you create an account and save them. If you use your phone to send a photo to a computer, the photo waits on our server only until that computer receives it, and is deleted within the hour.
e) Technical data
- Authentication/session cookies needed to keep you signed in
- Limited technical and log information (such as request metadata) used for security and reliability
- Locally stored data in your browser (e.g., cached voice audio, theme preference)
- For features a visitor can use without an account (such as one worksheet read a day), a one-way code made from your network address and the date, used only to keep those features to their limits. It cannot be turned back into the address, and it is deleted after 30 days.
- When you ask for a sign-in code by email, one-way codes made from the email address and your network address, used only to limit how many codes can be asked for. They cannot be turned back into either, and they are deleted after 30 days.
- Your approximate country, worked out once from your internet address at sign-up, so we know where Spelly is used. We don't keep the address and never use precise location.
- In the Android and iOS apps, a device identifier for notifications (a push token from Firebase Cloud Messaging or Apple Push Notification service). It is used only to deliver practice reminders a grown-up has turned on, which can be turned off at any time in Settings, and is never used for advertising.
3. How We Use Your Information
- To create, secure, and manage your account and keep you signed in
- To provide the Service and personalize your learning experience
- To power AI features (word generation, definitions, text-to-speech, and image/worksheet scanning)
- To save your word lists, settings, and track your progress across devices
- To build Spelly's shared word library, a bigger collection of words for all our users, with voices, meanings and ready-made lists by age and grade. The words people add to their lists are combined across users. We use single words that appear in lists from several different families, never a whole list, a list name, or anything that could identify you or your child. Combined practice statistics that identify no one (for example, how often children spell a word correctly) help us sort those words by difficulty.
- To process purchases and manage premium access
- To maintain security, prevent abuse, and comply with legal obligations
- To respond to your support requests
We do not use your information for third-party advertising, and we do not sell your personal information.
4. Google User Data & Limited Use
Spelly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- We only request the basic profile and email information needed to sign you in and create your account.
- We use Google user data solely to provide and improve the Spelly features described in this Policy.
- We do not sell Google user data, and we do not use it for advertising.
- We do not transfer Google user data to others except as needed to provide the Service (see “Service Providers” below), for security or legal reasons, or in connection with a merger or acquisition with appropriate notice.
- We do not use Google user data to develop, improve, or train generalized AI/ML models.
5. AI Processing
To deliver AI features, we send the relevant content you provide — for example a topic, a word, or an uploaded image of a word list — to our AI provider (OpenAI) for processing, and we return the result to you. We do not send your Google sign-in credentials to the AI provider.
To improve performance, some generated results (such as definitions and pronunciation audio) may be cached in our systems or in your browser.
If you choose to supply your own OpenAI API key, requests made with that key are sent directly to OpenAI under your own OpenAI account and terms; we do not store or monitor that usage.
6. How We Store and Protect Information
- Account, profile, progress, and word-list data are stored in our cloud database and authentication provider (Supabase).
- The application is hosted on Railway.
- Data is transmitted over encrypted connections (HTTPS/TLS).
- Access to personal data is restricted to what is needed to operate the Service.
No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
7. Service Providers We Share Data With
We share data only with providers that help us operate the Service, and only as needed:
- Google — sign-in / authentication
- Supabase — authentication and database hosting
- OpenAI — AI text generation, text-to-speech, and image/word extraction
- ElevenLabs — text-to-speech for the British English voice (receives only the word to be spoken)
- Google Firebase Cloud Messaging and Apple Push Notification service — delivery of app notifications, using the device push token described above
- Railway — application hosting and infrastructure
- PayPro Global — our authorized reseller and payment processor (Merchant of Record) for purchases made on the website; it handles your payment and billing details. We do not store full payment card numbers.
- Google Play and the Apple App Store — payment processing for purchases made inside the Android and iOS apps. We receive a purchase token to verify the purchase, never your payment details.
- ipwho.is, country.is and geojs.io: country lookup at sign-up. One of them receives the internet address, once, and returns the country; we store only the country.
- Postmark (ActiveCampaign) — delivery of account and service emails (welcome, purchase confirmation, practice reminders you can opt out of)
These providers process data on our behalf under their own terms and security commitments. We do not sell your personal information to anyone.
8. Cookies and Local Storage
We use cookies and similar technologies that are necessary to sign you in and keep your session active. We also store some preferences and cached content (such as voice audio and theme) locally in your browser to improve performance. We do not use advertising cookies.
9. Spelly Browser Extension
We offer an optional Spelly extension for Chrome. It builds a spelling list three ways — from the web page you are already looking at, from a ready-made topic, or from a photo of a worksheet — and lets you save it to your Spelly word lists. You do not need the extension to use Spelly, and installing it is entirely your choice.
a) What the extension reads, and where
By default the extension reads a page only when you ask it to, by pressing “Grab words from this page”. It has no standing access to your browsing. If you want it to check pages as you go, so the toolbar icon can tell you a list is there before you click, you can switch that on in the extension’s settings — Chrome will ask your permission, and switching it back off hands that permission back.
Either way, the analysis happens entirely on your own computer. The extension examines the page for list-shaped content, checks the words against a dictionary bundled inside the extension itself, and then discards what it looked at. The contents of the pages you browse are not transmitted to us, not to any third party, and not to any AI service. Neither is the address of the page you are on: the extension uses it only to suggest a name for your list, and it never leaves your browser.
The ready-made topic lists are bundled inside the extension. Choosing one involves no network request at all.
b) What is sent to Spelly, and when
Nothing leaves your browser automatically. Two things are sent, and each one only because you pressed a button:
- The list you save. We receive the words you chose to keep and the name you gave the list, so it can be saved to your account. You can remove any word before saving.
- A photo you choose to upload. If you use the photo option, the image is sent to spelly.net, along with the language your child practises in so the words can be read in the right language, and passed to an AI text-recognition provider (OpenAI) to read the words off it. We do not keep the image afterwards, and it is not used to train anyone’s model. Only the words it found come back to the extension, where you review them before saving. Worth knowing: a school worksheet often has your child’s name written at the top, so whatever is visible in the photo you choose is part of what you send. Crop or cover anything you would rather not share.
The extension makes no other network request of any kind, and it can only communicate with spelly.net.
c) Your account inside the extension
A free Spelly account is needed to save lists, to see lists you have already saved, and to read photos. Building a list from a page or a topic works without one. Signing in opens spelly.net in an ordinary browser tab — the extension never sees or stores your password. It uses the same sign-in cookie your browser already holds for spelly.net.
When you are signed in, the extension shows your email address in its settings so you can tell which account is in use, and the names and word counts of your saved lists so you can practise one directly. It does not send either of those anywhere. Your interface language is saved to your Spelly account so the website and the extension agree on it, and so it follows you to another computer — it is a display preference and nothing more. Signing out from the extension clears your spelly.net sign-in in every tab, exactly as signing out on the website would.
d) What the extension stores
- Words found on the current tab, held in temporary session storage and erased when you close your browser
- Your preference for whether the extension checks pages automatically, which you can switch off at any time
- The interface language and your child’s practice language, as chosen in the extension’s settings
- A count of how many times you have opened it, used only to stop showing a first-run tip
The extension does not store your browsing history, does not build a profile of the sites you visit, and contains no analytics or tracking code.
e) Permissions and why they are needed
- Access to the page you are on — granted for one tab at a time, at the moment you press “Grab words from this page”. Used only for the local analysis described above.
- Access to all sites (optional) — not requested when you install, and never required. Only if you switch on automatic checking, and revoked when you switch it off.
- Access to spelly.net — required to save a list, to show the lists you already have, to read an uploaded photo, and to sign out. Uses the sign-in you already have; the extension never asks for your password.
- Storage — for the temporary per-tab results and the preferences described above.
- Context menu — to add the “Add to Spelly” option when you right-click selected text.
f) Limited use
We use data from the extension solely to provide the features you asked for: saving a word list to your account, showing you the lists already in it, and reading a photo you uploaded. We do not use it for advertising, we do not sell it, and we do not share it with third parties beyond the text-recognition provider named above. Removing the extension from your browser deletes everything it stored locally; word lists you already saved remain in your Spelly account until you delete them.
10. Children's Privacy
Spelly is designed for children aged 6 to 12 to use with a parent, guardian or teacher. Children's privacy is built into how the Service works:
- Signing in. Spelly can be installed and played free, and the account can be created by a parent, guardian, teacher or the child. Google Sign-In, Sign in with Apple and email sign-up are the only ways in; a Google account for a child under 13 is one a parent manages, under Google's own rules. We encourage a grown-up to set Spelly up with their child.
- What we hold about the child is limited to the sign-in details above, what is entered in Spelly (an optional first name or nickname, a practice language, and an age in the classic version) and the child's activity in Spelly (words practised, results, XP, streaks and creatures). Spelly itself does not ask for a phone number, photo or location.
- No advertising. Spelly shows no ads and contains no advertising or third-party analytics SDKs in the mobile apps. We do not sell personal information and we do not use children's data for marketing.
- Purchases require a grown-up. In the mobile apps, the one-time unlock sits behind a grown-up check and is completed through Google Play or the App Store, which apply their own purchase authentication. The optional practice reminders we email go to the address on the account, and every one of them has a one-tap unsubscribe.
- Students on a shared class list practise from a link without creating an account. The teacher who shared the list can see each student's results on that list; we hold nothing else about them.
- Deleting a child's data. The account holder can delete the account and everything in it at any time from Settings or at spelly.net/delete-account. Deletion is permanent.
A parent or guardian who creates an account for their child, or lets their child use Spelly, consents to the collection described in this policy (COPPA, GDPR-K and equivalent laws). Teachers who create accounts for classroom use do so under their school's authority. If you are a parent or guardian and believe your child created an account without your consent, or that we hold information about a child without appropriate consent, contact support@spelly.net and we will delete it.
11. Your Rights and Choices
Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.
- You can view and edit much of your profile information inside the app.
- You can revoke Spelly's access to your Google account at any time from your Google Account settings.
- To delete your account and all associated data yourself, go to spelly.net/delete-account, or open the menu in the app and choose Delete account. You can also email support@spelly.net to request deletion, and we will complete it within 7 days.
12. Data Retention
We keep your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we permanently erase your personal data, including your profile, saved word lists, and all progress and gamification data. The one exception is payment and transaction records, which we may keep where the law requires it for legal, tax, and accounting purposes, and only for the period the law requires. We do not use retained records for anything else. Words in the shared word library and combined statistics that no longer identify anyone (section 3) can stay after an account is deleted.
13. International Transfers
We are based in Hong Kong and use service providers that may process data in other countries. Where required, we take steps to ensure your data receives an appropriate level of protection when transferred internationally.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate. Continued use of the Service after changes take effect means you accept the updated Policy.